You must encrypt registry content with a key you control and rotate yourself. What is required?
- A Premium SKU, a customer-managed key in Key Vault, and a user-assigned managed identity (correct answer)
- B Standard SKU with Content Trust enabled
- C Any SKU with soft delete enabled
- D Premium SKU with geo-replication
Shortcut: Customer-managed key encryption requires Premium, a Key Vault key with soft delete and purge protection, and a user-assigned identity granted wrap/unwrap permissions. It must be configured at registry creation.