SC-100 Certification Practice Question #261

Question

You have an Azure subscription that contains an Azure Synapse Analytics workspace named workspace1. workspace1 contains a built-in serverless SQL pool and a dedicated SQL pool named Pool1.

You need to recommend a second layer of data encryption for workspace1.

What should you include in the recommendation for each pool? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The Synapse security white paper distinguishes the first encryption layer from the second for each pool type. For the dedicated pool (Pool1), Azure Storage AES-256 (SSE) is the first layer and "enabling TDE can add a second layer of data encryption for dedicated SQL pools" — so Pool1 → TDE. For the serverless SQL pool there is no managed/permanent storage and TDE is not configurable; SSE is the first layer, and the documented way to add a second layer is "infrastructure encryption," a separate AES-256 pass at the Azure Storage infrastructure level with a separate key — so serverless → Infrastructure encryption. SSE is the base/first layer in both cases and is therefore never the correct "second layer" choice. DaddyHV's well-reasoned comment matches MS Learn exactly. Confidence is held at 86 (not higher) because there is no recorded Suggested Answer and the only voted reply ("B") doesn't map to the two dropdowns, so the resolution rests on MS Learn plus one comment.

More SC-100 practice questions