The answer is that granting the SQL Database server’s managed identity Get, Wrap Key, and Unwrap Key permissions on the Key Vault key is one of the two required steps to configure customer-managed key TDE for Azure SQL Database with Key Vault. This is essential because Azure SQL Database uses its server identity to authenticate against Azure Key Vault; without these specific permissions, the database engine cannot retrieve or use the customer-managed key to encrypt the database encryption key, leaving TDE locked to a service-managed key. On the Microsoft Azure Database Administrator Associate DP-300 exam, this scenario tests your understanding of the Azure RBAC and Key Vault access policy chain—a common trap is forgetting that the server’s system-assigned managed identity must be explicitly granted these cryptographic operations, not just read access. The second required step is setting the TDE protector to the Key Vault key, which finalizes the switch from service-managed to customer-managed encryption. Memory tip: think “Get, Wrap, Unwrap” as the three keys to unlock CMK—without them, your key stays in the vault, not on the database.
DP-300 Implement a secure environment Practice Question
This DP-300 practice question tests your understanding of implement a secure environment. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are required steps to configure Azure SQL Database to use a customer-managed key (CMK) for Transparent Data Encryption (TDE) with Azure Key Vault? (Choose two.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the TDE protector to the Key Vault key via the Azure portal or T-SQL
Option B is correct because setting the TDE protector to the Key Vault key is the step that actually enables customer-managed key (CMK) encryption for Azure SQL Database. This can be done via the Azure portal, PowerShell, Azure CLI, or T-SQL (using ALTER DATABASE SCOPED CONFIGURATION SET TDE_PROTECTOR). Without this step, the database continues to use a service-managed key.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Create a user-assigned managed identity for the SQL Database server
Why it's wrong here
A system-assigned managed identity can also be used.
✓
Set the TDE protector to the Key Vault key via the Azure portal or T-SQL
Why this is correct
This configures the server to use the CMK.
Related concept
Read the scenario before looking for a memorised answer.
✓
Grant the SQL Database server's managed identity Get, Wrap Key, and Unwrap Key permissions on the Key Vault key
Why this is correct
These permissions are required for the server to use the key.
Related concept
Read the scenario before looking for a memorised answer.
✗
Store the encryption key in the SQL Database server's hardware security module (HSM)
Why it's wrong here
CMK requires the key to be in Azure Key Vault.
✗
Ensure the SQL Database server is inside the same virtual network as the Key Vault
Why it's wrong here
Not required; Key Vault can be accessed over the internet or private endpoint.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the required managed identity type (system-assigned vs. user-assigned) or assume network-level constraints (like VNet integration) are mandatory, when in fact only identity and key permissions are strictly required.
Detailed technical explanation
How to think about this question
When you set a customer-managed key for TDE, Azure SQL Database uses the server's system-assigned managed identity to authenticate to Azure Key Vault. The key permissions (Get, Wrap Key, Unwrap Key) are required for the database engine to encrypt and decrypt the database encryption key (DEK) using the CMK. The DEK is stored in the database boot page, and the CMK is never stored in SQL Database—only referenced via Key Vault URI.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this DP-300 question in full detail.
Implement a secure environment — This question tests Implement a secure environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Set the TDE protector to the Key Vault key via the Azure portal or T-SQL — Option B is correct because setting the TDE protector to the Key Vault key is the step that actually enables customer-managed key (CMK) encryption for Azure SQL Database. This can be done via the Azure portal, PowerShell, Azure CLI, or T-SQL (using ALTER DATABASE SCOPED CONFIGURATION SET TDE_PROTECTOR). Without this step, the database continues to use a service-managed key.
What should I do if I get this DP-300 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.