Hotspot Question You have an Azure subscription. You need to deploy a logical SQL server by using PowerShell. The solution must ensure that the logical SQL server can create Azure AD users and…

Question

Exhibit

Answer Area

• Parameter 1-assignidentity
  -assignidentity-federatedclientID-keyid
• Parameter 2-keyid
  -assignidentity-federatedclientID-keyid

Explanation

This question tests knowledge of deploying an Azure SQL logical server via PowerShell (New-AzSqlServer) with Azure AD admin support and customer-managed TDE key configuration.

Approach. To deploy a logical SQL server with Azure AD authentication support, you use 'New-AzSqlServer' with '-AssignIdentity' to assign a system-managed identity (required for the server to access Azure Key Vault for customer-managed TDE keys). The '-ExternalAdminName' (or '-ExternalAdministratorLogin') and '-ExternalAdminSID' parameters are used to set an Azure AD administrator, enabling Azure AD user creation. For TDE with a customer-managed key, the server must have a managed identity so it can be granted access to the Azure Key Vault where the key is stored; you then use 'Set-AzSqlServerTransparentDataEncryptionProtector' with '-Type AzureKeyVault' and specify the key vault key URI. The complete flow requires: 1) New-AzSqlServer with -AssignIdentity and Azure AD admin parameters, 2) granting the server identity Key Vault permissions, and 3) setting the TDE protector to the customer-managed key.

Concept tested. Deploying an Azure SQL logical server using PowerShell (New-AzSqlServer) with system-assigned managed identity (-AssignIdentity), Azure Active Directory admin configuration for Azure AD user creation, and Transparent Data Encryption (TDE) using a customer-managed key stored in Azure Key Vault.

Reference. https://learn.microsoft.com/en-us/powershell/module/az.sql/new-azsqlserver | https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-configure

No community discussion yet for this question.