AZ-305 Question 72
Select 2Contoso hosts a mission-critical SQL Server database on an Azure Virtual Machine. They need to ensure that the database is backed up daily to recover from accidental data deletion or corruption. They also want the data to be encrypted at rest using customer-managed keys. Which two solutions should you recommend to meet these requirements?
- A
Use Azure Backup to schedule daily backups of the Azure VM hosting the SQL Server database
- B
Implement Transparent Data Encryption (TDE) for the SQL database with customer-managed keys stored in Azure Key Vault
- C
Replicate the Azure VM to a different region using Azure Site Recovery to encrypt data at rest
- D
Enable Azure Storage Service Encryption with Microsoft-managed keys for all backup data
Show answer and explanation
Correct answers: A, B
Explanation
To protect the data and ensure compliance with Contoso’s requirements, you need both a reliable backup solution and an encryption mechanism with customer-managed keys. Azure Backup can schedule daily backups to guard against data corruption and accidental deletions, while Transparent Data Encryption with keys in Azure Key Vault provides data-at-rest encryption under Contoso’s direct control. For more information, refer to Azure Backup documentation (https://docs.microsoft.com/azure/backup/) and Transparent Data Encryption guidance (https://docs.microsoft.com/azure/azure-sql/database/transparent-data-encryption-azure-sql).
- A. Correct.
Option 1 is correct. Azure Backup allows scheduling daily backups of the entire VM (including the SQL database) and provides point-in-time restore capabilities. This directly addresses the requirement for backing up the database to recover from accidental deletion or corruption.
- B. Correct.
Option 2 is correct. Transparent Data Encryption (TDE) encrypts the SQL database at rest. By configuring TDE with keys stored in Azure Key Vault, you meet the requirement of using customer-managed keys for security compliance and fine-grained control over key rotation.
- C. Incorrect.
Option 3 is incorrect. Azure Site Recovery replicates workloads to another region for disaster recovery, which helps achieve regional resilience. However, it’s not primarily used for encryption at rest or daily backups, so it doesn’t meet the stated encryption and backup requirements in this scenario.
- D. Incorrect.
Option 4 is incorrect. While Azure Storage Service Encryption does encrypt data at rest, Microsoft-managed keys do not fulfill the customer-managed key requirement. Contoso specifically wants to manage their own keys, making this option unsuitable.