DP-300 Implement a secure environment Practice Question
Your organization needs to comply with a regulation that requires data to be encrypted at rest using a customer-managed key stored in Azure Key Vault. You have an Azure SQL Database. What should you configure?
⚠ Common exam trap
Candidates often confuse Always Encrypted (which encrypts specific columns at the application level) with TDE (which encrypts the entire database at rest), leading candidates to choose Option B when the requirement is for full database encryption at rest with a customer-managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Transparent Data Encryption (TDE) and use a customer-managed key in Azure Key Vault as the TDE protector.
Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault meets the requirement for data at rest encryption using a customer-controlled key. TDE encrypts the database files (data and log files) at rest, and by using a customer-managed key as the TDE protector, you retain control over key rotation and revocation, satisfying regulatory compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Policy to enforce encryption at rest.
Why it's wrong here
Azure Policy can audit compliance but does not implement encryption.
- ✗
Enable Always Encrypted and store the column master key in Azure Key Vault.
Why it's wrong here
Always Encrypted is for column-level encryption, not the entire database at rest.
- ✗
Configure Azure Storage Service Encryption for the database files.
Why it's wrong here
Azure SQL Database manages its own storage; Storage Service Encryption is not directly configurable.
- ✓
Enable Transparent Data Encryption (TDE) and use a customer-managed key in Azure Key Vault as the TDE protector.
Why this is correct
TDE with customer-managed key in Key Vault provides encryption at rest with customer control.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
Key term
Transparent Data Encryption
Transparent Data Encryption is a security feature that automatically encrypts data written to a database and decrypts it when read, without requiring any changes to the application.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.