Implement a secure environment →easyMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

{
  "identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
      "/subscriptions/123/resourceGroups/rg1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/mi-sql-access": {}
    }
  },
  "properties": {
    "serverKeyType": "AzureKeyVault",
    "uri": "https://kv-sql-keys.vault.azure.net/keys/sql-key/abc123",
    "serverKeyName": "sql-key"
  }
}

Refer to the exhibit. You are configuring Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys (CMK) stored in Azure Key Vault. The deployment uses a user-assigned managed identity. However, after deployment, the TDE status shows 'Inaccessible'. What is the most likely cause?

⚠ Common exam trap

Watch out — candidates often assume the issue is with the Key Vault firewall or the identity assignment, but the most common post-deployment cause of 'Inaccessible' TDE is missing cryptographic permissions on the managed identity, not network or identity existence issues.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The managed identity lacks 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the Key Vault key

When using customer-managed keys (CMK) for TDE in Azure SQL Database, the managed identity assigned to the logical server must have 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the key in Azure Key Vault. Without these specific permissions, the SQL Database service cannot retrieve or use the key to encrypt or decrypt the database encryption key, resulting in an 'Inaccessible' TDE status.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The key specified in the URI does not exist
Why it's wrong here
The key exists because it is specified.
✗
The user-assigned managed identity is not assigned to the SQL Database server
Why it's wrong here
The identity is specified in the template, so it is assigned.
✗
The Key Vault firewall is enabled and does not allow Azure services
Why it's wrong here
If firewall is enabled, it could block access, but the most common issue is missing permissions.
✓
The managed identity lacks 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the Key Vault key
Why this is correct
These permissions are required for TDE with CMK.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question