Which statement is true about MySQL Enterprise Transparent Data Encryption (TDE)?

Question

Options

• AMySQL TDE uses an appropriate keyring plugin to store the keys in a centralized location.
• BBoth MyISAM and InnoDB tables can be encrypted by setting the keyring_engine = ALL variable in
• CLost tablespace encryption keys can be regenerated only if the master database key is known or
• DTDE can encrypt InnoDB and MyISAM tables only when the tables are stored in the SYSTEM

• A
  18% (10)
• B
  4% (2)
• C
  71% (39)
• D
  7% (4)

Explanation

Option C is correct because MySQL TDE relies on a two-tier key architecture: each InnoDB tablespace is encrypted with its own tablespace key, and that tablespace key is itself encrypted by a master database key. If a tablespace key is lost, it can only be recovered or regenerated by leveraging the master key - without the master key, the encrypted data is permanently inaccessible.

Why the distractors are wrong:

• A is misleading because keyring plugins do not all use a "centralized" location - keyring_file stores keys in a local file on the server, which is not centralized. Only enterprise plugins like keyring_okv (Oracle Key Vault) provide true centralized key management.
• B is doubly wrong: the variable keyring_engine = ALL does not exist, and MyISAM tables do not support TDE - only InnoDB tablespace encryption is supported.
• D is wrong because InnoDB TDE works for file-per-table tablespaces and general tablespaces, not just the system tablespace. MyISAM is also incorrectly included here.

Memory tip: Think of TDE as a "key inside a key" - the tablespace key is locked inside an envelope sealed by the master key. Lose the envelope, and only someone who knows the master key can re-seal it. No master key = no recovery.

No community discussion yet for this question.