nerdexam
Microsoft

DP-300 · Question #282

Drag and Drop Question You have an Azure key vault named Vault1 and a SQL server on Azure Virtual Machines instance named SQL1. SQL1 hosts a database named DB1. You need to configure Transparent…

The correct answer is Create an Azure AD service principal and grant the service principal permissions for Vault1.; On SQL1, create an asymmetric key.; On SQL1, create a cryptographic provider and a Microsoft SQL Server credential.; On SQL1, create a login from the asymmetric key. To configure TDE on a SQL Server VM using Azure Key Vault, you must first create an Azure AD service principal and grant it permissions to Vault1 so SQL Server can authenticate to the vault. Next, you configure SQL1 with a cryptographic provider (using the SQL Server Connector…

Submitted by priya_blr· Mar 6, 2026Implement and manage data security - Configure encryption for data at rest using customer-managed keys and Azure Key Vault integration with SQL Server on Azure Virtual Machines

Question

Drag and Drop Question You have an Azure key vault named Vault1 and a SQL server on Azure Virtual Machines instance named SQL1. SQL1 hosts a database named DB1. You need to configure Transparent Data Encryption (TDE) on DB1 to use a key in Vault1. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibit

DP-300 question #282 exhibit

Answer Area

Drag items

On SQL1, create a cryptographic provider and a Microsoft SQL Server credential.On SQL1, create a symmetric key.On SQL1, create a login from the asymmetric key.On SQL1, create a login from the symmetric key.Create an Azure AD service principal and grant the service principal permissions for Vault1.On SQL1, create an asymmetric key.

Correct arrangement

  • Create an Azure AD service principal and grant the service principal permissions for Vault1.
  • On SQL1, create an asymmetric key.
  • On SQL1, create a cryptographic provider and a Microsoft SQL Server credential.
  • On SQL1, create a login from the asymmetric key.

Explanation

To configure TDE on a SQL Server VM using Azure Key Vault, you must first create an Azure AD service principal and grant it permissions to Vault1 so SQL Server can authenticate to the vault. Next, you configure SQL1 with a cryptographic provider (using the SQL Server Connector for Azure Key Vault) and a credential that uses the service principal's credentials. Then you create an asymmetric key in SQL Server that references the key stored in Vault1, followed by creating a login from that asymmetric key, which is then used to enable TDE on DB1. This sequence follows the official Microsoft EKM (Extensible Key Management) pattern for SQL Server on Azure VMs.

Topics

#Transparent Data Encryption#Azure Key Vault#SQL Server EKM#Azure AD Service Principal

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DP-300 Practice