DP-300 Practice Question: Monitor, configure, and optimize database resources
Your company plans to migrate a large on-premises SQL Server database to Azure SQL Managed Instance. The database uses Transparent Data Encryption (TDE) with a certificate stored in the local machine store. How should you manage the TDE protector after migration to ensure minimal administrative overhead and high availability?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault to store the TDE protector
Using Azure Key Vault to store the TDE protector provides centralized management, automatic key rotation, and high availability without manual intervention. Option B is incorrect because service-managed keys offer less control and are not recommended for scenarios requiring bring your own key (BYOK) compliance. Option C is incorrect because SQL Managed Instance does not support storing TDE certificates directly in the instance; instead, you can use Azure Key Vault to bring your own key. Option D is incorrect because TDE cannot be disabled after migration without decrypting the database, and Always Encrypted is a different feature for column-level encryption, not a replacement for TDE.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure Key Vault to store the TDE protector
Why this is correct
Azure Key Vault provides centralized, secure, and highly available key management for TDE.
- ✗
Use the service-managed TDE key provided by Azure
Why it's wrong here
Service-managed keys are available but offer less control; however, the question asks for minimal administrative overhead and high availability, which Key Vault also provides with more control.
- ✗
Bring your own certificate and store it in the managed instance
Why it's wrong here
Managed instance does not support storing certificates for TDE; it uses Azure Key Vault or service-managed keys.
- ✗
Disable TDE after migration and use Always Encrypted instead
Why it's wrong here
Always Encrypted is a different technology; disabling TDE may not meet compliance requirements.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Transparent Data Encryption
Transparent Data Encryption is a security feature that automatically encrypts data written to a database and decrypts it when read, without requiring any changes to the application.
Key term
Azure SQL Managed Instance
Azure SQL Managed Instance is a fully managed cloud database service that gives you nearly all the features of Microsoft SQL Server on your own server, without you having to manage the hardware or operating system.
About these practice questions
Courseiva writes every DP-300 question from scratch — 906 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.