Nordlicht Reisen GmbH, a fictional travel agency, wants to encrypt the file archive with the contracts and photos (about 40 TB, an assumption of the task) with a key of its own that the data protection officer controls. The booking portal needs credentials for the database and for the payment provider, the portals need TLS certificates, and the partner interface requires certificates on both sides. The exam calls this: recommend a solution that manages secrets, certificates and keys. Here you learn which Azure service fits which requirement and how you can tell.

Prior knowledge. What Key Vault is is covered in "AZ-900 compact", lesson 2.7. How an app reads secrets with a managed identity, assigns roles instead of access policies and turns on deletion protection is taught by K3 in lesson 3.3.2; key versions, rotation, expiry events and TLS material are shown by K3 in lesson 3.3.7. None of that is repeated here. What is new is the decision: Standard, Premium or Managed HSM, how many vaults, who issues certificates.

The requirement

All numbers are assumptions of the task, none of them measured.

Requirement Source Measure (assumption)
Encrypt the archive with a key of its own Data protection officer key in the hardware security module (HSM), rotation at least every two years
Data and keys stay in the EU Data protection region germanywestcentral
Portal and partner interface need TLS certificates Operations about 6 public names; none may expire unnoticed
Credentials for payment provider and partner contracts Development about 40 secrets, read by the portal with a managed identity
No key sovereignty of its own toward the cloud provider required Management no single-tenant requirement
Operation with two people on the key team IT management little administrative effort

The last two rows help decide. Whoever changes them arrives at a different recommendation; that is intended. Cards are not stored (payment only through the provider), so any obligation for payment HSMs does not apply.