Implement a secure environment →hardMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "type": "Microsoft.Sql/servers/databases/transparentDataEncryption",
  "apiVersion": "2022-05-01-preview",
  "properties": {
    "status": "Enabled"
  }
}
```

Refer to the exhibit. You are deploying an Azure SQL Database with Transparent Data Encryption (TDE) enabled via ARM template. The database will contain highly sensitive data, and your security policy requires that the encryption key be managed by your organization using Azure Key Vault. What additional configuration is needed?

⚠ Common exam trap

Many exam-takers assume enabling TDE in the ARM template automatically uses customer-managed keys, but they overlook the need to explicitly configure the encryption protector with Key Vault properties to switch from service-managed to customer-managed keys.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set the 'keyVaultUri', 'keyName', and 'keyVersion' properties to reference the key in Key Vault

When deploying Azure SQL Database with TDE and customer-managed keys (CMK) via ARM template, you must explicitly specify the 'keyVaultUri', 'keyName', and 'keyVersion' properties under the 'encryptionProtector' resource to link the database to the specific key in Azure Key Vault. Without these properties, the template would only enable TDE with a service-managed key, not the required customer-managed key.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Set the 'keyVaultUri', 'keyName', and 'keyVersion' properties to reference the key in Key Vault
Why this is correct
Required to use customer-managed keys for TDE.
✗
No additional configuration is needed; the template already enables TDE with customer-managed keys
Why it's wrong here
The template enables TDE with service-managed keys only.
✗
Deploy a separate key rotation policy in the ARM template
Why it's wrong here
Key rotation is separate and not required for initial configuration.
✗
Enable 'autoRotationEnabled' property
Why it's wrong here
Auto-rotation is optional, not required.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question