nerdexam
Microsoft

DP-300 · Question #375

Hotspot Question You have an on-premises Microsoft SQL Server database named DB1. You have an Azure subscription. You need to migrate DB1 to an Azure SQL service that meets the following…

The correct answer is Azure SQL service:: The Azure SQL Database vCore purchasing model; Attestation service:: Microsoft Azure Attestation. This question tests knowledge of Azure SQL services that support Always Encrypted with Secure Enclaves, which provides hardware-based encryption protecting data from privileged users while enabling rich computations like pattern matching on encrypted data.

Submitted by yousef_jo· Mar 6, 2026Implement a secure environment

Question

Hotspot Question You have an on-premises Microsoft SQL Server database named DB1. You have an Azure subscription. You need to migrate DB1 to an Azure SQL service that meets the following requirements: - Protects the confidentiality of sensitive data from malware and high- privileged unauthorized database administrators - Supports pattern matching for server-side database operations - Uses a hardware-based encryption technology Which Azure SQL service and attestation service should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

DP-300 question #375 exhibit

Answer Area

  • Azure SQL service:The Azure SQL Database vCore purchasing model
    Azure SQL Managed InstanceThe Azure SQL Database DTU purchasing modelThe Azure SQL Database vCore purchasing model
  • Attestation service:Microsoft Azure Attestation
    Host Guardian Service (HGS)Microsoft Azure AttestationNo attestation

Explanation

This question tests knowledge of Azure SQL services that support Always Encrypted with Secure Enclaves, which provides hardware-based encryption protecting data from privileged users while enabling rich computations like pattern matching on encrypted data.

Approach. The correct Azure SQL service is Azure SQL Managed Instance (or Azure SQL Database) configured with Always Encrypted with Secure Enclaves using Virtualization-Based Security (VBS) enclaves or Intel SGX enclaves. The requirement for hardware-based encryption technology points to Intel SGX (Software Guard Extensions), which is supported by Azure SQL Database on DC-series hardware. The attestation service required is Microsoft Azure Attestation (MAA), which verifies the integrity and trustworthiness of the secure enclave before sensitive data is processed within it. Always Encrypted with Secure Enclaves protects data from high-privileged DBAs and malware, while the enclave allows server-side operations like LIKE pattern matching on encrypted columns - satisfying all three requirements: confidentiality protection, pattern matching support, and hardware-based encryption via Intel SGX.

Concept tested. Always Encrypted with Secure Enclaves in Azure SQL Database/Managed Instance, Intel SGX hardware-based encryption, and Microsoft Azure Attestation (MAA) as the attestation provider for enclave verification.

Reference. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-enclaves

Topics

#Azure SQL Database#Always Encrypted#secure enclaves#Microsoft Azure Attestation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DP-300 Practice