DP-300 · Question #325
Drag and Drop Question You have an instance of SQL Server on Azure Virtual Machines named SQL1. SQL1 contains a database named DB1. You need to enable Transparent Data Encryption (TDE) for DB1…
The correct answer is a master key in the master database; a certificate in the master database; a database encryption key in DB1. Enabling TDE on SQL Server requires a specific three-step hierarchy: first, a master key must be created in the master database to protect other keys, then a certificate must be created in the master database (protected by that master key) to serve as the TDE protector, and…
Question
Exhibit
Answer Area
Drag items
Correct arrangement
- a master key in the master database
- a certificate in the master database
- a database encryption key in DB1
Explanation
Enabling TDE on SQL Server requires a specific three-step hierarchy: first, a master key must be created in the master database to protect other keys, then a certificate must be created in the master database (protected by that master key) to serve as the TDE protector, and finally a database encryption key (DEK) must be created in DB1 itself, encrypted by the master database certificate. This chain of trust ensures the DEK that encrypts DB1's data pages is itself securely protected. The wrong options fail because: (1) 'a database encryption key in the master database' - the DEK belongs in the user database (DB1), not master; (2) 'a certificate in DB1' - the certificate must live in master, not in the user database, so it can protect encryption across databases; (3) 'a master key in DB1' - the database master key for TDE purposes is created in master, not in the user database; these objects in wrong locations would break the required encryption hierarchy.
Topics
Community Discussion
No community discussion yet for this question.