Implement a secure environment →hardMultiple Choice

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "type": "Microsoft.Sql/servers/databases/transparentDataEncryption",
  "apiVersion": "2022-05-01-preview",
  "properties": {
    "status": "Enabled"
  }
}
```

Refer to the exhibit. You are deploying an Azure SQL Database with Transparent Data Encryption (TDE) enabled via ARM template. The database will contain highly sensitive data, and your security policy requires that the encryption key be managed by your organization using Azure Key Vault. What additional configuration is needed?

⚠ Common exam trap

Many exam-takers assume enabling TDE in the ARM template automatically uses customer-managed keys, but they overlook the need to explicitly configure the encryption protector with Key Vault properties to switch from service-managed to customer-managed keys.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set the 'keyVaultUri', 'keyName', and 'keyVersion' properties to reference the key in Key Vault

When deploying Azure SQL Database with TDE and customer-managed keys (CMK) via ARM template, you must explicitly specify the 'keyVaultUri', 'keyName', and 'keyVersion' properties under the 'encryptionProtector' resource to link the database to the specific key in Azure Key Vault. Without these properties, the template would only enable TDE with a service-managed key, not the required customer-managed key.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Set the 'keyVaultUri', 'keyName', and 'keyVersion' properties to reference the key in Key Vault
Why this is correct
Customer-managed keys require the TDE protector to be stored in Azure Key Vault, so the ARM template must supply keyVaultUri, keyName and keyVersion to point at that key. Without these properties, Azure SQL Database defaults to a service-managed key, breaching the policy.
✗
No additional configuration is needed; the template already enables TDE with customer-managed keys
Why it's wrong here
The template enables TDE with service-managed keys by default; customer-managed keys require an explicit Key Vault key and identity configuration. It is tempting because TDE is indeed active, but the security policy demands organisational key control, which the default deployment does not provide.
✗
Deploy a separate key rotation policy in the ARM template
Why it's wrong here
A rotation policy only governs key versions after customer-managed keys exist; it does not create the Key Vault key or grant the server access. It is tempting because rotation is part of key management, but the missing step is configuring the customer-managed key itself.
✗
Enable 'autoRotationEnabled' property
Why it's wrong here
Auto-rotation only schedules periodic key rotation; it does not move the TDE protector from the service-managed key to a customer-managed key in Azure Key Vault. It is tempting because it is a key-management property, and it would be correct once customer-managed keys are already configured and the policy requires scheduled rotation.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question