AZ-500 Question 182
Select 2You manage an Azure SQL Database that has Transparent Data Encryption (TDE) enabled with a Microsoft-managed key. The security team now requires a customer-managed key stored in Azure Key Vault. You want to migrate TDE to the customer-managed key with minimal downtime. Which two steps must you perform to properly configure TDE with your custom key?
- A
Grant the Azure SQL Database server's managed identity the 'Wrap Key', 'Unwrap Key', and 'Get Key' permissions in the Key Vault, then set the TDE protector to the custom key.
- B
Use the Azure portal or PowerShell to change the TDE protector from the default Microsoft-managed key to the custom key stored in the Key Vault.
- C
Disable TDE on the database, wait for it to decrypt, then re-enable TDE using your custom key to ensure key switching works correctly.
- D
Rely on default Azure Key Vault settings, since TDE automatically handles necessary permissions for the managed identity.
Show answer and explanation
Correct answers: A, B
Explanation
To implement TDE with a customer-managed key in Azure SQL Database, you must place your key in Azure Key Vault and give your Azure SQL server identity the necessary access to this key, such as the 'Wrap Key' and 'Unwrap Key' permissions. Then, update your database’s TDE protector to reference the custom key. For more details, see Microsoft's documentation on configuring TDE with customer-managed keys in Azure SQL Database: https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-azure-sql.
- A. Correct.
Correct. When using a customer-managed key from Key Vault, the Azure SQL Database server’s managed identity needs permission to use (wrap/unwrap) and access (get) the key. After granting permissions, you must explicitly configure the TDE protector to reference your custom key.
- B. Correct.
Correct. You can use either the Azure portal or PowerShell to set the TDE protector to your custom key. This step shifts TDE from the built-in service-managed key to the specified Key Vault key without requiring significant downtime.
- C. Incorrect.
Incorrect. It is not necessary to completely disable TDE and wait for the database to decrypt before switching keys. Azure SQL Database supports directly rotating from a Microsoft-managed key to a customer-managed key, reducing downtime and complexity.
- D. Incorrect.
Incorrect. You must configure an access policy or use role-based access control (RBAC) in Key Vault to grant the necessary permissions to Azure SQL Database’s managed identity. TDE does not automatically manage these permissions on its own.