What is required before a Key Vault key can be used as a customer-managed key for another Azure service?
- A The vault must have soft delete and purge protection enabled (correct answer)
- B The key must be exportable
- C The vault must be in Standard tier
- D Public access must be enabled
Shortcut: Services depending on a CMK require soft delete and purge protection so the key cannot be destroyed, which would render the encrypted data permanently unrecoverable.