AZ-500 Question 183
Single answerYou are an Azure administrator for a company that uses Azure SQL Database. The company recently decided that all database encryption keys must be stored in a dedicated Azure Key Vault using a customer-managed key (CMK). You want to enable Transparent Data Encryption (TDE) with a CMK while minimizing downtime. Which step must you take first to ensure TDE can be successfully configured with your custom key?
- A
Create a new secret in Key Vault using a self-signed certificate and assign it as the TDE protector without adjusting permissions.
- B
Grant the Azure SQL Database server’s principal identity the required get/wrapKey/unwrapKey permissions in Key Vault, then configure TDE with the customer-managed key.
- C
Disable TDE in the Azure SQL Database first, then generate a new key in Key Vault to enable TDE with a CMK.
- D
Rotate the service-managed key to a new key version in Key Vault and let Azure automatically update the TDE protector.
Show answer and explanation
Correct answer: B
Explanation
When configuring Transparent Data Encryption (TDE) with a customer-managed key (CMK) stored in Azure Key Vault, the Azure SQL Database needs sufficient permissions to access that key. The most critical initial step is granting the database server (via system-assigned or user-assigned managed identities) get, wrapKey, and unwrapKey permissions on the Key Vault key. This aligns with Microsoft’s documentation on configuring Transparent Data Encryption with customer-managed keys. Once the proper permissions are in place, you can proceed to change the TDE protector from the service-managed key to your CMK without disabling TDE, minimizing downtime.
- A. Incorrect.
Incorrect. Simply placing a self-signed certificate in Key Vault and assigning it as the TDE protector without granting proper access permissions will fail. Azure SQL Database must have explicit permission to use the key.
- B. Correct.
Correct. Before configuring TDE with a customer-managed key, you must ensure the Azure SQL Database server (via its managed identity) has the required get/wrapKey/unwrapKey permissions in Key Vault to access and manage the CMK.
- C. Incorrect.
Incorrect. Disabling TDE is not a requirement when migrating from service-managed keys to customer-managed keys. Doing so might cause unnecessary risk and downtime.
- D. Incorrect.
Incorrect. Rotating a service-managed key version does not switch from service-managed keys to a CMK. You must explicitly configure TDE with a CMK, ensuring the appropriate Key Vault permissions are set.