220-1201 Practice Question: Migrating its on-premises database to a cloud…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Ensuring the PaaS provider has physical security at their data center

  Why it's wrong here

  While physical security is a fundamental aspect of any data center and a responsibility of the PaaS provider, it is not the most critical consideration for data protection during a database migration. The focus during migration should be on securing the data itself, both in transit and at rest within the cloud environment, rather than auditing the provider's physical infrastructure, which is a prerequisite for any reputable cloud service.

• ✓

  Configuring encryption for data at rest and in transit

  Why this is correct

  Configuring encryption for data at rest ensures that if the cloud storage is ever compromised, the stored database contents remain unreadable without the proper decryption keys. Simultaneously, encrypting data in transit protects the information as it moves across networks during the migration process, preventing unauthorized access or interception. This dual-layer encryption is the most effective method for safeguarding sensitive data throughout its lifecycle in a cloud environment.

• ✗

  Setting up a VPN between the on-premises network and the cloud

  Why it's wrong here

  Setting up a Virtual Private Network (VPN) establishes a secure, encrypted tunnel for network traffic between the on-premises environment and the cloud provider. While a VPN is excellent for securing the *connection path* during migration, it primarily protects the network communication channel. It does not inherently encrypt the data *within* the database once it's stored in the PaaS environment, nor does it guarantee the data itself is encrypted before it enters the VPN tunnel or after it exits.

• ✗

  Verifying that the provider uses a specific hypervisor

  Why it's wrong here

  The specific hypervisor technology (e.g., VMware ESXi, Microsoft Hyper-V, Xen) used by a PaaS provider is a foundational virtualization detail that is largely abstracted from the customer. While hypervisor security is critical for the provider's infrastructure integrity, its particular type does not directly impact the customer's responsibility for data protection during a database migration. The security measures for the database itself, such as encryption and access controls, are independent of the underlying hypervisor.

Go deeper

Related to this question