Quick Answer
The answer is Transparent Data Encryption (TDE) with a customer-managed key. This is correct because TDE performs real-time I/O encryption and decryption of database data files, logs, and backups at rest, and when paired with a customer-managed key stored in Azure Key Vault, it gives you full control over key rotation and revocation to meet regulatory compliance. On the Microsoft Azure Database Administrator Associate DP-300 exam, this scenario tests your understanding of the difference between service-managed keys and Bring Your Own Key (BYOK); a common trap is confusing Always Encrypted with TDE, but remember that Always Encrypts protects data in transit and in use, not at rest. For a memory tip, think “TDE for rest, Always for query and client.”
This DP-300 practice question tests your understanding of plan and implement data platform resources. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You need to deploy an Azure SQL Database that complies with a regulatory requirement to encrypt data at rest using a customer-managed key stored in Azure Key Vault. The database will be used by a line-of-business application. Which feature should you enable?
Transparent Data Encryption (TDE) with customer-managed key
TDE encrypts data at rest and supports customer-managed keys.
Azure Defender for SQL
Why wrong: Azure Defender provides security monitoring, not encryption.
Dynamic Data Masking
Why wrong: Dynamic Data Masking obfuscates data but does not encrypt it.
Always Encrypted
Why wrong: Always Encrypted encrypts data in use, not at rest.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Transparent Data Encryption (TDE) with customer-managed key
Transparent Data Encryption (TDE) with a customer-managed key (CMK) in Azure Key Vault encrypts the database at rest, meeting the regulatory requirement for customer-controlled encryption keys. TDE performs real-time I/O encryption and decryption of data files, logs, and backups, and when configured with a CMK (also known as Bring Your Own Key or BYOK), the encryption key is stored and managed in Azure Key Vault, giving the customer full control over key rotation and revocation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Transparent Data Encryption (TDE) with customer-managed key
Why this is correct
TDE encrypts data at rest and supports customer-managed keys.
Related concept
Read the scenario before looking for a memorised answer.
Azure Defender for SQL
Why it's wrong here
Azure Defender provides security monitoring, not encryption.
Dynamic Data Masking
Why it's wrong here
Dynamic Data Masking obfuscates data but does not encrypt it.
Always Encrypted
Why it's wrong here
Always Encrypted encrypts data in use, not at rest.
Common exam traps
The trap here is that candidates often confuse Always Encrypted (which encrypts data at rest and in transit but at the column level with client-side keys) with TDE (which encrypts the entire database at rest with server-managed or customer-managed keys), leading them to select Always Encrypted when the requirement is for full database-at-rest encryption with a customer-managed key.
Detailed technical explanation
TDE with CMK uses a hierarchical key architecture: a Database Encryption Key (DEK) is encrypted by a server-level TDE protector, which when using CMK is an asymmetric key stored in Azure Key Vault. The DEK is stored in the database boot record and is decrypted during startup, allowing the SQL Server engine to transparently encrypt/decrypt data pages as they are written to or read from disk. A real-world scenario is a financial institution that must comply with PCI DSS or GDPR, requiring the ability to revoke access to the encryption key immediately if a breach is suspected, which is possible by disabling the key in Key Vault.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Plan and implement data platform resources — study guide chapter
Learn the concepts, then practise the questions
Plan and implement data platform resources practice questions
Targeted practice on this topic area only
All DP-300 questions
953 questions across all exam domains
Microsoft Azure Database Administrator Associate DP-300 study guide
Full concept coverage aligned to exam objectives
DP-300 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise DP-300 questions linked to Plan and configure a high availability and disaster recovery environment.
Practise DP-300 questions linked to Plan and implement data platform resources.
Practise DP-300 questions linked to Monitor, configure, and optimize database resources.
Practise DP-300 questions linked to Configure and manage automation of tasks.
Practise DP-300 questions linked to Plan and configure high availability and disaster recovery.
Practise DP-300 questions linked to Implement a secure environment.
Practise DP-300 questions linked to DP-300 fundamentals.
Practise DP-300 questions linked to DP-300 scenario.
Practise DP-300 questions linked to DP-300 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Plan and implement data platform resources — This question tests Plan and implement data platform resources — Read the scenario before looking for a memorised answer..
The correct answer is: Transparent Data Encryption (TDE) with customer-managed key — Transparent Data Encryption (TDE) with a customer-managed key (CMK) in Azure Key Vault encrypts the database at rest, meeting the regulatory requirement for customer-controlled encryption keys. TDE performs real-time I/O encryption and decryption of data files, logs, and backups, and when configured with a CMK (also known as Bring Your Own Key or BYOK), the encryption key is stored and managed in Azure Key Vault, giving the customer full control over key rotation and revocation.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: Jun 24, 2026
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.