An organization is using Azure Key Vault to store encryption keys. They must ensure that the keys are stored in a physical Hardware Security Module (HSM) that is FIPS 140-2 Level 3 compliant and that Azure administrators cannot access the key material. Which Key Vault tier or service should they use?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Azure Key Vault Managed HSM

Managed HSM is a fully managed, highly available, single-tenant, standards-compliant cloud service that enables you to safeguard cryptographic keys....

๐Ÿ“‹Part of Microsoft Certified: Azure Solutions Architect Expert (AZ-305) ยท Azure Certification Practice
Real Exam ScenarioMicrosoft Entra ID

An organization is using Azure Key Vault to store encryption keys. They must ensure that the keys are stored in a physical Hardware Security Module (HSM) that is FIPS 140-2 Level 3 compliant and that Azure administrators cannot access the key material. Which Key Vault tier or service should they use?

โœ“ Correct Answer & ExplanationMicrosoft Entra ID

Correct Answer

Azure Key Vault Managed HSM

Why This Answer Is Correct

Managed HSM is a fully managed, highly available, single-tenant, standards-compliant cloud service that enables you to safeguard cryptographic keys.

๐Ÿ“š What This Question Tests

This question evaluates your knowledge of Microsoft Entra ID โ€” a core concept tested in Microsoft Certified: Azure Solutions Architect Expert (AZ-305). Understanding Microsoft Entra ID is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.