Microsoft
AZ-305 · Question #287
You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1. You plan to migrate DB1 to an Azure SQL managed instance. You need to enable customer managed Transparent D
The correct answer is A. RSA 3072. Requirements for configuring TDE protector TDE protector can only be an asymmetric, RSA, or RSA HSM key. The supported key lengths are 2048 bytes and 3072 bytes. https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok- overview?view=azuresql
Submitted by deeparc· Mar 6, 2026Design data storage solutions
Question
You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1. You plan to migrate DB1 to an Azure SQL managed instance. You need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must maximize encryption strength. Which type of encryption algorithm and key length should you use for the TDE protector?
Options
- ARSA 3072
- BAES 256
- CRSA 4096
- DRSA 2048
How the community answered
(26 responses)- A81% (21)
- B8% (2)
- C4% (1)
- D8% (2)
Explanation
Requirements for configuring TDE protector TDE protector can only be an asymmetric, RSA, or RSA HSM key. The supported key lengths are 2048 bytes and 3072 bytes. https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok- overview?view=azuresql
Topics
#Transparent Data Encryption#customer-managed keys#RSA encryption#Azure SQL Managed Instance
Community Discussion
No community discussion yet for this question.