Secure, monitor, and optimize data storage and data processing →mediumMultiple Choice

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

Refer to the exhibit.

{
  "identity": {
    "type": "SystemAssigned",
    "principalId": "00000000-0000-0000-0000-000000000001",
    "tenantId": "00000000-0000-0000-0000-000000000002"
  },
  "properties": {
    "encryption": {
      "keyVaultProperties": {
        "keyVaultUri": "https://mykeyvault.vault.azure.net/",
        "keyName": "mykey",
        "keyVersion": "1"
      },
      "infrastructureEncryption": "Enabled"
    }
  }
}

Refer to the exhibit. You are deploying an Azure Synapse Analytics workspace using an ARM template. The exhibit shows the encryption configuration. What is the effect of setting infrastructureEncryption to Enabled?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys.

Enabling infrastructureEncryption adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys (double encryption). Option A is incorrect because enabling infrastructure encryption does not disable customer-managed key encryption; it adds an additional layer. Option B is incorrect because infrastructure encryption applies to data at rest, not in transit between nodes. Option C is incorrect because infrastructure encryption applies to the entire Azure Synapse Analytics workspace, not just SQL pools, and it is not transparent data encryption (TDE); it is a separate infrastructure-level encryption.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It disables encryption using the customer-managed key.
Why it's wrong here
Infrastructure encryption adds a second encryption layer using platform-managed keys; it does not disable customer-managed key encryption, which remains configured separately via the key vault properties. The option tempts because both settings concern encryption keys, but they operate on different layers and are not mutually exclusive.
✗
It enables encryption of data in transit between nodes.
Why it's wrong here
Infrastructure encryption protects data at rest with a second layer of platform-managed keys; data in transit between nodes is handled by transport-level encryption, not this ARM setting. The confusion arises because encryption settings commonly cover both states, yet this property targets stored data only.
✗
It enables transparent data encryption for SQL pools.
Why it's wrong here
Infrastructure encryption applies a second at-rest encryption layer to the workspace's Azure resources; transparent data encryption is configured on the SQL pools themselves, not through this workspace property. The option tempts because TDE is a familiar encryption control, but it operates at a different scope.
✓
It adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys.
Why this is correct
Infrastructure encryption applies a second, independent encryption layer at the hardware level using a platform-managed key, in addition to the service-level encryption already applied with your key. Data is therefore encrypted at rest twice, with two different keys, satisfying the infrastructureEncryption Enabled setting.

Go deeper

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question