AZ-500 Question 181
Single answerYou manage an Azure SQL Database that stores sensitive personal information. Because this database was created before TDE was enabled by default, TDE is currently disabled. Your compliance requirements state that you must configure TDE using a customer-managed key (CMK). You have already created an Azure Key Vault and generated an RSA key named 'MyKey.' You also granted the Azure SQL Server resource the necessary permissions to access the key vault. Which step do you need to perform in the Azure Portal to finalize TDE with your customer-managed key?
- A
Under the Azure SQL Database 'Transparent data encryption' blade, select 'Customer-managed key,' choose the key from the key vault, and apply the configuration.
- B
Under 'Advanced Data Security' within the Azure SQL Database, enable Data Discovery & Classification to activate TDE with a custom key.
- C
In Azure Key Vault, enable soft delete and purge protection, which automatically applies the key for TDE in the database.
- D
Create a secret for your private key in Azure Key Vault and configure TDE within the Key Vault 'Secrets Management' blade.
Show answer and explanation
Correct answer: A
Explanation
To implement TDE with a customer-managed key, you must first create and store the key in Azure Key Vault and grant the Azure SQL Server resource access to that key. The final step is to go into the SQL Database's 'Transparent data encryption' blade (in the Azure Portal), select 'Customer-managed key,' choose the key from the vault, and enable encryption. Refer to Microsoft Docs on 'Use customer-managed keys with Azure SQL Database' for further details.
- A. Correct.
Correct. In the Azure Portal for the SQL Database, you must go to 'Transparent data encryption,' choose 'Customer-managed key,' and select your key from the key vault. This action enables TDE with your CMK.
- B. Incorrect.
Incorrect. While Advanced Data Security deals with features like vulnerability assessments and threat detection, it does not control TDE configuration or customer-managed keys.
- C. Incorrect.
Incorrect. Although enabling Key Vault soft delete and purge protection is a best practice, it does not on its own finalize TDE. You still need to choose the key explicitly under the TDE settings.
- D. Incorrect.
Incorrect. TDE with a customer-managed key requires linking an RSA key in Azure Key Vault (not simply a secret). You configure TDE in the SQL Database settings, not in the Key Vault 'Secrets Management' blade.