AZ-500 Secure compute, storage, and databases Practice Question
You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.
Azure Storage Service Encryption with Microsoft-managed keys only applies to Azure Storage accounts, not to Azure SQL Database. It does not use customer-managed keys or support automatic rotation. Option B is wrong because Azure Disk Encryption encrypts VM disks, not the Azure SQL Database. It does not meet the requirement for encrypting the database at rest. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access. Option D is wrong because Always Encrypted encrypts specific columns but requires the client application to handle the column encryption keys, violating the requirement that the application not have direct access to the key vault.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.
Why it's wrong here
Azure Storage Service Encryption with Microsoft-managed keys only applies to Azure Storage accounts, not to Azure SQL Database. It does not use customer-managed keys or support automatic rotation.
- ✗
Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.
Why it's wrong here
Azure Disk Encryption encrypts VM disks, not the Azure SQL Database. It does not meet the requirement for encrypting the database at rest.
- ✓
Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.
Why this is correct
Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access.
- ✗
Implement Always Encrypted with column encryption keys stored in Azure Key Vault.
Why it's wrong here
Always Encrypted encrypts specific columns but requires the client application to handle the column encryption keys, violating the requirement that the application not have direct access to the key vault.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.