Plan and configure a high availability and disaster recovery environment →hardMultiple ChoiceObjective-mapped

DP-300 Practice Question: Plan and configure a high availability and disaster recovery environment

Exhibit

Refer to the exhibit. The following is a snippet of an Azure Policy definition for auditing SQL Server disaster recovery configuration:

{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Sql/servers"
        },
        {
          "field": "Microsoft.Sql/servers/version",
          "equals": "12.0"
        },
        {
          "anyOf": [
            {
              "field": "Microsoft.Sql/servers/encryptionProtector/serverKeyName",
              "exists": "false"
            },
            {
              "field": "Microsoft.Sql/servers/encryptionProtector/serverKeyName",
              "equals": "ServiceManaged"
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "audit"
    }
  }
}

You are reviewing an Azure Policy definition that audits SQL Servers. Based on the exhibit, which condition triggers the audit effect?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The SQL Server uses service-managed TDE or has no encryption protector configured

The policy 'if' condition requires allOf: type is 'Microsoft.Sql/servers', and anyOf: encryption protector does not exist OR encryption protector is 'ServiceManaged'. This audits SQL servers that either use service-managed TDE or have no encryption protector configured. Option B is incorrect because the policy does not trigger when a customer-managed key is used; it specifically targets those without a customer-managed key. Option C is incorrect because the condition checks for absence of encryption protector or service-managed, not the absence of customer-managed key. Option D is incorrect because version 12.0 is checked but it is not the trigger; the trigger is based on encryption protector type.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The SQL Server uses service-managed TDE or has no encryption protector configured
Why this is correct
The anyOf condition catches both cases: missing key or ServiceManaged key.
✗
The SQL Server uses a customer-managed key from Azure Key Vault
Why it's wrong here
This is the compliant state; the policy only audits non-compliant resources.
✗
The SQL Server does not have an encryption protector set to a customer-managed key
Why it's wrong here
The policy audits if the encryption protector is missing or is ServiceManaged; if it is customer-managed, it passes.
✗
The SQL Server is version 12.0 and uses a customer-managed key
Why it's wrong here
The policy checks for non-compliance; customer-managed key is compliant.

Go deeper

DP-300 Practice Question: Plan and configure a high availability and disaster recovery environment

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question