Your cognitive services resource is encrypted by default using Microsoft managed encryption keys. However, you are tasked to use customer-managed keys (CMK) instead of using the default method for greater flexibility. 
Review the statements given below and select the ones that are true.(Choose three statements)

Answer options:

A.To recover data, disable “soft delete” and “do not purge” properties.
B.Use a URI value from Key Identifier to use it in Key URI of Cognitive resource.
C.Azure key vault must be used for storing CMK.
D.While rotating the key, an update to the Cognitive resource is not required.
E.Use a key from the key vault for customer-managed keys.

Correct Answers: B, C and E
Option A is incorrect because “soft delete” and “do not purge” properties need to be enabled using Powershell or CLI in the key vault, while using CMK for encryption in a cognitive resource.
Option B is correct. One of the methods you can use is to use the URI value from Key Identifier in the key settings of the key vault. In order to set up CMK, you pass this value to the Key URI field in the encryption blade.
Option C is correct because you can only store customer-managed keys in the key vault. Additionally, the key vault, AD tenant and Cognitive Resource should be in the same Azure region.
Option D is incorrect because when keys are rotated, the new key URI or key value from the key vault must be updated.
Option E is correct because this is an alternate CMK method using which you can encrypt the Cognitive resource. 
Reference:
To learn more about Cognitive services encryption using CMK, use the link given below: 

https://docs.microsoft.com/en-us/azure/cognitive-services/custom-vision-service/encrypt-data-at-rest#update-the-key-version