Implement a secure environment →hardMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.

{
  "properties": {
    "serverKeyType": "AzureKeyVault",
    "uri": "https://myvault.vault.azure.net/keys/mykey/123456",
    "serverKeyName": "mykey",
    "kind": "azurekeyvault"
  },
  "id": "/subscriptions/sub-id/resourceGroups/rg/providers/Microsoft.Sql/servers/myserver/encryptionProtector/current",
  "name": "current",
  "type": "Microsoft.Sql/servers/encryptionProtector"
}

You are reviewing the encryption protector for an Azure SQL Server as shown in the exhibit. The server hosts multiple databases. You need to ensure that the databases are encrypted using the customer-managed key from Azure Key Vault. However, you find that the databases are not using this key. What is the most likely reason?

⚠ Common exam trap

Many exam-takers assume setting the server-level encryption protector automatically applies to all existing databases, but Azure SQL Database requires explicit per-database updates to change the protector.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The databases still have the service-managed key as protector and need to be updated.

The exhibit shows that the server's encryption protector is set to a customer-managed key from Azure Key Vault, but this setting only applies to newly created databases. Existing databases retain their original encryption protector, which is typically the service-managed key. To enforce the customer-managed key on existing databases, you must manually update each database's encryption protector using the ALTER DATABASE ENCRYPTION KEY statement or through the Azure portal. Option C correctly identifies that the databases still have the service-managed key as protector and need to be updated.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The key version '123456' is incorrect.
Why it's wrong here
The version appears valid.
✗
The key vault is in a different subscription and not accessible.
Why it's wrong here
The URI indicates the vault is accessible.
✓
The databases still have the service-managed key as protector and need to be updated.
Why this is correct
Existing databases may not automatically switch to CMK.
✗
The 'serverKeyName' property is not set correctly.
Why it's wrong here
The key name is present.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question