Implement a secure environment →hardMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.

{
  "type": "Microsoft.Sql/servers/databases/transparentDataEncryption",
  "apiVersion": "2022-05-01-preview",
  "name": "current",
  "properties": {
    "state": "Enabled"
  }
}

You are reviewing an ARM template for Azure SQL Database. The exhibit shows a resource definition for Transparent Data Encryption (TDE). You need to ensure that the database uses customer-managed keys (CMK) stored in Azure Key Vault instead of service-managed keys. What additional configuration is required?

⚠ Common exam trap

The trap here is that candidates mistakenly think TDE key configuration is a property of the database resource (like a 'keyVaultUri' property) or that toggling TDE state is required, when in fact the encryption protector is a separate server-level resource that must be explicitly defined in the ARM template.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.

To use customer-managed keys (CMK) for Transparent Data Encryption (TDE) in Azure SQL Database, you must configure an encryption protector that points to the key in Azure Key Vault. This is done by adding a resource of type 'Microsoft.Sql/servers/encryptionProtector' to the ARM template, which sets the server-level encryption protector to use the specified key vault key. Option D correctly identifies this required resource, as TDE with CMK is managed at the server level, not directly on the database resource.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Modify the database resource to include a 'keyVaultUri' property.
Why it's wrong here
The encryption protector is set at the server level, not database.
✗
Enable Always Encrypted on the database.
Why it's wrong here
Always Encrypted is a different feature for column-level encryption.
✗
Set the TDE state to 'Disabled' and then re-enable with a customer key.
Why it's wrong here
TDE must remain enabled; you change the protector.
✓
Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.
Why this is correct
The encryption protector resource specifies the customer-managed key.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question