Microsoft Azure Solutions Architect Expert AZ-305 Practice Question

Azure Managed HSM is a fully managed cloud-based hardware security module service that is validated to FIPS 140-2 Level 3, the highest level available for Azure key-management services. Managed HSM supports automatic key rotation and maintains previous key versions for recovery. Access is controlled through Azure RBAC rather than separate key vault policies, simplifying authorization. Managed HSM instances can be provisioned in a clustered, geo-redundant configuration, eliminating any need for customer-owned HSM appliances.

Azure Key Vault Premium uses HSM-backed keys but is validated only to FIPS 140-2 Level 2, so it fails the Level 3 requirement. Azure Dedicated HSM meets Level 3 but requires customers to deploy and manage the physical devices in Azure datacenters and does not natively integrate with Azure RBAC or provide automatic key rotation. Azure App Configuration is for configuration data, not for storing encryption keys or certificates and lacks FIPS 140-2 certification. Therefore, Azure Managed HSM is the only option that satisfies every stated requirement.