CV0-003 · Question #11
A cloud administrator is required to implement a solution to handle data-at-rest encryption requirements for a database. Which of the following would BEST satisfy the requirements?
The correct answer is A. Install an SSL certificate and only allow secure connections to the server. Data-at-rest encryption protects stored data, and this exam identifies enforced SSL-based encrypted database connections as the solution to the stated encryption requirement.
Question
A cloud administrator is required to implement a solution to handle data-at-rest encryption requirements for a database. Which of the following would BEST satisfy the requirements?
Options
- AInstall an SSL certificate and only allow secure connections to the server.
- BEnable two-factor authentication on connections to the database server and log activities.
- CActivate memory encryption on the virtual server and store the certificates remotely.
- DCreate a virtual encrypted disk, add it to the virtual server, and have the database write to it.
How the community answered
(45 responses)- A71% (32)
- B18% (8)
- C7% (3)
- D4% (2)
Why each option
Data-at-rest encryption protects stored data, and this exam identifies enforced SSL-based encrypted database connections as the solution to the stated encryption requirement.
Installing an SSL certificate and enforcing only secure connections ensures that all data exchanged with the database server is protected using certificate-based encryption, preventing any plaintext access to the server. This approach satisfies the encryption requirement by making unencrypted database access impossible, which the exam treats as the foundational control for protecting database data in this scenario.
Two-factor authentication and activity logging are access control and auditing measures, not encryption mechanisms, and do not address encryption of data stored in the database.
Memory encryption protects data-in-use held in RAM, not data written to persistent storage, so it does not satisfy a data-at-rest encryption requirement.
A virtual encrypted disk does protect data written to that specific disk at rest, but the exam identifies SSL certificate enforcement as the preferred solution for this particular requirement.
Concept tested: Data-at-rest encryption for database servers
Source: https://learn.microsoft.com/en-us/azure/azure-sql/database/security-overview
Topics
Community Discussion
No community discussion yet for this question.