A healthcare app stores clinical documents in blob storage. The app must encrypt each document before it leaves the client, using keys held in Key Vault, so the storage service only ever receives ciphertext. Which approach meets this?
Show answer and explanation
Answer: D
Client-side encryption means the application encrypts data before sending it, so the service stores only ciphertext. The Storage client libraries support envelope encryption: a generated content encryption key protects the data, and that key is wrapped by a key-encryption key held in Key Vault. The wrapped key is stored alongside the blob's metadata. Only a principal that can use the key-encryption key can unwrap the content key and decrypt the document.
Why the other options are wrong
- A. Customer-managed keys control the key used for server-side encryption at rest. The storage service still receives and processes plaintext, which this scenario forbids.
- B. HTTPS protects data in transit, and server-side encryption protects data on disk. In both cases the service still handles plaintext, so this does not meet the client-side requirement.
- C. A private endpoint limits the network path but does nothing to the content itself. The bytes are still plaintext when they reach the storage service.