A. Store the RSA-HSM key in Azure Cosmos D
B. Apery the built-in policies for customer-managed keys and allowed locations.
C. Create a free tier Azure App Configuration instance with a new Azure AD service principal.
D. Store the RSA-HSM key in Azure Key Vault with soft-delete and purge-protection features enabled.
E. Store the RSA-HSM key in Azure Blob storage with an Immutability policy applied to the container.
F. Create a standard tier Azure App Configuration instance with an assigned Azure AD managed identity.
Explanation:
Scenario: All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key.
Microsoft Azure Key Vault is a cloud-hosted management service that allows users to encrypt keys and small secrets by using keys that are protected by hardware security modules (HSMs).
You need to create a managed identity for your application.
Reference: https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references