Implement a secure environment →hardMultiple Choice

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.

{
  "type": "Microsoft.Sql/servers/databases/transparentDataEncryption",
  "apiVersion": "2022-05-01-preview",
  "name": "current",
  "properties": {
    "state": "Enabled"
  }
}

You are reviewing an ARM template for Azure SQL Database. The exhibit shows a resource definition for Transparent Data Encryption (TDE). You need to ensure that the database uses customer-managed keys (CMK) stored in Azure Key Vault instead of service-managed keys. What additional configuration is required?

⚠ Common exam trap

The trap here is that candidates mistakenly think TDE key configuration is a property of the database resource (like a 'keyVaultUri' property) or that toggling TDE state is required, when in fact the encryption protector is a separate server-level resource that must be explicitly defined in the ARM template.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.

To use customer-managed keys (CMK) for Transparent Data Encryption (TDE) in Azure SQL Database, you must configure an encryption protector that points to the key in Azure Key Vault. This is done by adding a resource of type 'Microsoft.Sql/servers/encryptionProtector' to the ARM template, which sets the server-level encryption protector to use the specified key vault key. Option D correctly identifies this required resource, as TDE with CMK is managed at the server level, not directly on the database resource.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Modify the database resource to include a 'keyVaultUri' property.
Why it's wrong here
Azure SQL Database ARM templates expose the Key Vault key through the server's encryption protector (serverKeyType AzureKeyVault plus key URI), not a keyVaultUri property on the database resource. It is tempting because Key Vault integration is required, but that property belongs to other resource types.
✗
Enable Always Encrypted on the database.
Why it's wrong here
Always Encrypted protects individual columns with client-side keys and leaves TDE using service-managed keys, so the CMK requirement is unmet. It is tempting because both features involve Key Vault, but Always Encrypted is correct when column-level encryption with client-held keys is required.
✗
Set the TDE state to 'Disabled' and then re-enable with a customer key.
Why it's wrong here
Disabling and re-enabling TDE merely returns the database to a service-managed key; the key source is set through the encryption protector, not the state toggle. It is tempting because TDE must be enabled for CMK, but disabling it removes protection rather than configuring a Key Vault key.
✓
Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.
Why this is correct
The encryptionProtector resource binds the server to a specific Key Vault key, switching TDE from service-managed to customer-managed. Without it, the database resource alone cannot reference the key vault key, so service-managed keys remain in effect.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question