DP-300 Certification Practice Question #102

Question

You have an Azure key vault named Vault1 and a SQL server on Azure Virtual Machines instance named SQL1. SQL1 hosts a database named DB1.

You need to configure Transparent Data Encryption (TDE) on DB1 to use a key in Vault1.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Accepted Answer

Configuring Transparent Data Encryption (TDE) with Extensible Key Management (EKM) using Azure Key Vault on SQL Server on an Azure VM follows a strict order. First, a service principal must be created in Entra ID and granted Key Vault permissions to access the vault. Second, we configure SQL Server to interact with the vault by creating the cryptographic provider (pointing to the SQL Server Connector DLL) and SQL Server credentials. Third, we create the asymmetric key in SQL Server that is mapped to the Key Vault key. Fourth, we create a SQL Server login from that asymmetric key to enable authorization. Symmetric keys are not used for EKM TDE Key Vault integration.

More DP-300 practice questions