SC-100 Practice Question: A company uses Azure App Service to host a web…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.

  Why it's wrong here

  Cell-level encryption with keys stored in Azure Key Vault and manual 90-day rotation is operationally heavy and error-prone: each rotation requires re-encrypting the column data, updating key versions in the application configuration, and coordinating with a change window. Unlike TDE with customer-managed keys, there is no built-in automatic rotation schedule in Azure Key Vault for cell-level schemes, so the rotation is driven entirely by custom scripts or manual processes. This approach also adds application complexity because encryption/decryption must be explicitly handled at the field level, and it does not scale well across multiple tables or environments.

• ✗

  Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.

  Why it's wrong here

  Transparent Data Encryption with service-managed keys is technically automatic, but the rotation is controlled entirely by Microsoft and cannot be aligned to a specific 90-day compliance policy. Service-managed keys are rotated on Azure's own schedule, which customers cannot view, modify, or trigger on demand. This lack of customer control means an organization cannot prove to an auditor that keys are rotated exactly every 90 days, making this option unsuitable when a fixed rotation cadence is a hard requirement.

• ✓

  Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.

  Why this is correct

  Enabling TDE with customer-managed keys in Azure Key Vault is the correct choice because it gives the organization explicit control over the key lifecycle while keeping encryption transparent to the application. You can configure a Key Vault key rotation policy to automatically rotate the TDE protector every 90 days, and Azure SQL Database will automatically use the new key version for new encryption operations without downtime or application changes. This satisfies the rotation requirement with a fully managed, auditable process that is aligned to Azure's native capabilities.

• ✗

  Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.

  Why it's wrong here

  Always Encrypted with column master keys stored in Azure Key Vault encrypts data client-side, meaning the application must be designed to handle the encryption and decryption at every query. Configuring key rotation in application code is not automatic; it requires custom logic to create a new key version, update the column master key metadata, and potentially re-encrypt the column data. This introduces significant development and maintenance overhead, and unlike TDE with customer-managed keys, there is no built-in Azure policy that performs the rotation on a schedule without code changes.

Go deeper

Related to this question