DP-300 Plan and implement data platform resources Practice Question
You are deploying an Azure SQL Database and need to ensure that the database files are encrypted at rest using a key that you manage in Azure Key Vault. You also need to ensure that the key is automatically rotated. What should you configure?
⚠ Common exam trap
Watch out — candidates often confuse Always Encrypted with TDE; Always Encrypted protects data in use but does not encrypt the entire database at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.
TDE with customer-managed keys in Azure Key Vault allows you to control the encryption key and manage its lifecycle. You can configure automatic key rotation by setting a rotation policy in Key Vault and enabling the TDE protector to use the latest key version. This satisfies both the encryption at rest and key management requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Transparent Data Encryption (TDE) with service-managed keys.
Why it's wrong here
Service-managed keys are managed by Microsoft and do not allow you to control or rotate the keys yourself. While TDE with service-managed keys encrypts data at rest, it does not meet the requirement for customer-managed keys and automatic key rotation under your control.
- ✗
Enable Dynamic Data Masking with Azure Key Vault integration.
Why it's wrong here
Dynamic Data Masking is used to limit sensitive data exposure to non-privileged users by masking data in query results. It does not encrypt data at rest. It also does not integrate with Azure Key Vault for encryption key management. This option does not meet the encryption requirement.
- ✓
Enable Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.
Why this is correct
TDE with customer-managed keys allows you to use your own key stored in Azure Key Vault. You can configure automatic key rotation by setting up a key rotation policy in Key Vault and enabling the TDE protector to automatically use the latest key version. This meets both encryption and key management requirements.
- ✗
Enable Always Encrypted with column master keys in Azure Key Vault.
Why it's wrong here
Always Encrypted is designed to protect sensitive data in use and in motion, but it encrypts data at the column level and requires application changes. It does not encrypt the entire database at rest, and it is not a substitute for TDE. The requirement is for encryption at rest of the database files, which TDE provides.
Go deeper
Related to this question
Learn chapter
Securing Data at Rest and in Transit
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
Key term
Transparent Data Encryption
Transparent Data Encryption is a security feature that automatically encrypts data written to a database and decrypts it when read, without requiring any changes to the application.
About these practice questions
Courseiva writes every DP-300 question from scratch — 574 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.