Designing Encryption for Azure SQL Database with Key Vault
Your company, Fabrikam, is a global financial services firm that handles sensitive customer data. You are designing a security solution for a new customer-facing web application that processes credit card transactions. The application will be deployed on Azure Kubernetes Service (AKS) and will use Azure SQL Database for data storage. Compliance requirements include PCI DSS and GDPR. You need to ensure that data at rest and in transit is encrypted, and that access to the database is tightly controlled. You plan to use Azure Key Vault for managing encryption keys. Which combination of actions should you implement?
Quick Answer
The correct answer is to enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP. This combination ensures encryption at rest and in transit for Azure SQL Database with Key Vault by leveraging Transparent Data Encryption for the entire database, Always Encrypted for column-level protection of sensitive data like credit card numbers, and TLS 1.2 to secure data moving between AKS and the database. On the Microsoft Cybersecurity Architect exam, this scenario tests your ability to layer encryption controls to meet PCI DSS and GDPR compliance, with a common trap being the use of outdated TLS 1.0 or relying solely on application-level encryption. A key memory tip is to think of the three E’s: Entire database (TDE), Essential columns (Always Encrypted), and Every connection (TLS 1.2), all locked down with managed identities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP.
It provides comprehensive encryption: TDE with a customer-managed key in Azure Key Vault encrypts data at rest, Always Encrypted protects sensitive columns (e.g., credit card numbers) with column-level encryption, TLS 1.2 secures data in transit, and Azure AD managed identities with a firewall rule restricted to the AKS cluster's outbound IP ensure secure authentication and access control. This combination meets PCI DSS and GDPR requirements. Option B is incorrect because storing the customer-managed key in the application's configuration file is insecure and violates best practices for key management; keys must be stored in a secure vault like Azure Key Vault. Option C is incorrect because application-level encryption alone does not guarantee data-at-rest encryption within Azure SQL Database, and disabling firewall rules (using no firewall) exposes the database to unauthorized access. Option D is incorrect because it uses a service-managed key (less control), TLS 1.0 (not PCI DSS compliant), and SQL authentication (less secure than Azure AD managed identities).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP.
Why this is correct
This provides encryption at rest (TDE and Always Encrypted), encryption in transit (TLS 1.2), and secure access with managed identities and IP restrictions.
- ✗
Enable TDE with a customer-managed key stored in the application's configuration file, enforce TLS 1.2, and use Azure AD authentication.
Why it's wrong here
Customer-managed keys should be stored in Azure Key Vault, not in configuration files. TDE with CMK requires Key Vault integration.
- ✗
Implement application-level encryption for credit card data, enforce TLS 1.2, and use Azure AD managed identities with no database firewall rules.
Why it's wrong here
Application-level encryption does not protect data at rest in the database. No firewall rules expose the database to broader network access.
- ✗
Enable Transparent Data Encryption (TDE) with a service-managed key, enforce TLS 1.0, and use SQL authentication.
Why it's wrong here
TLS 1.0 is deprecated and not PCI DSS compliant. SQL authentication is less secure than Azure AD managed identities.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO data protection mechanisms should you implement to protect data at rest in Azure SQL Database?
medium- ✓ A.Transparent Data Encryption (TDE)
- B.Azure Policy
- C.Role-Based Access Control (RBAC)
- D.Azure Firewall
- ✓ E.Always Encrypted
Why A: Options A (Transparent Data Encryption) and E (Always Encrypted) are correct. TDE encrypts the database files at rest, while Always Encrypted protects sensitive columns at rest and in use by encrypting them with client-side keys. Option B (Azure Policy) is a governance tool, not an encryption mechanism. Option C (Role-Based Access Control) manages permissions, not encryption. Option D (Azure Firewall) is a network security service and does not protect data at rest.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.