DP-300 Plan and implement data platform resources Practice Question
You are planning to deploy a new Azure SQL Database. The database will store sensitive financial data and must be encrypted at rest using a key that your organization manages and rotates independently. You need to implement this encryption with minimal administrative overhead. What should you do?
⚠ Common exam trap
It's easy for candidates to confuse Always Encrypted, which protects specific columns and requires application changes, with TDE, which encrypts the entire database at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Transparent Data Encryption (TDE) with customer-managed keys stored in Azure Key Vault.
Transparent Data Encryption with customer-managed keys in Azure Key Vault provides encryption at rest while allowing your organization to manage and rotate the encryption key. This meets the requirement for independent key management with minimal overhead, as Azure SQL Database handles the encryption and decryption transparently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Always Encrypted with column encryption keys stored in Azure Key Vault.
Why it's wrong here
Always Encrypted protects data in use and in motion by encrypting specific columns, but it does not encrypt the entire database at rest. It requires application changes and is designed for client-side encryption. While it uses customer-managed keys, it does not satisfy the requirement for encrypting all data at rest with a single key managed by the organization.
- ✓
Enable Transparent Data Encryption (TDE) with customer-managed keys stored in Azure Key Vault.
Why this is correct
TDE with customer-managed keys allows you to use your own key stored in Azure Key Vault, giving you full control over key lifecycle, including rotation and revocation. It encrypts data at rest and is the standard method for meeting regulatory requirements for independent key management. This approach also integrates with Azure Key Vault for centralized key management.
- ✗
Enable Azure Disk Encryption on the underlying virtual machines hosting the database.
Why it's wrong here
Azure Disk Encryption is used for IaaS virtual machines, not for PaaS Azure SQL Database. Azure SQL Database abstracts the underlying storage, so you cannot apply disk encryption directly. This option is not applicable and would not provide the required encryption for the database service.
- ✗
Enable Transparent Data Encryption (TDE) with service-managed keys.
Why it's wrong here
Service-managed keys are managed by Microsoft and cannot be independently rotated or controlled by your organization. While TDE with service-managed keys encrypts data at rest, it does not meet the requirement for customer-managed keys. This option would not give you control over key rotation or revocation, failing the security and compliance needs.
Go deeper
Related to this question
Learn chapter
Securing Data at Rest and in Transit
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
Key term
Transparent Data Encryption
Transparent Data Encryption is a security feature that automatically encrypts data written to a database and decrypts it when read, without requiring any changes to the application.
About these practice questions
Courseiva writes every DP-300 question from scratch — 574 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.