You have an Azure virtual machine that hosts a Microsoft SQL Server 2022 database named DB1. You need to enable Transparent Data Encryption (TDE) for DB1. What should you create first?

Question

Options

• Aa database scoped credential
• Ba database encryption key (DEK)
• Can X.509 certificate
• Da database master key (DMK)

• A
  6% (1)
• B
  6% (1)
• C
  17% (3)
• D
  72% (13)

Explanation

Transparent Data Encryption (TDE) Setup Order

Creating a Database Master Key (DMK) must come first because it is the foundational encryption object in SQL Server's key hierarchy - it encrypts and protects all other keys and certificates within the database, including those used for TDE. Without the DMK existing in the master database, SQL Server cannot create or store the certificate that will ultimately protect the Database Encryption Key.

Why the distractors are wrong:

• Option A (Database Scoped Credential): This is used for external authentication (e.g., accessing Azure Blob Storage), not for TDE setup.
• Option B (Database Encryption Key/DEK): The DEK is required for TDE, but it cannot be created until after both the DMK and a certificate exist - it comes last in the chain.
• Option C (X.509 Certificate): A certificate is the second step and is used to protect the DEK, but it depends on the DMK already being in place before it can be created.

The correct order is: DMK → Certificate → DEK → Enable TDE.

Memory Tip: Think of it as building a house - the DMB is the foundation, the certificate is the walls, and the DEK is the roof. You can't build the roof without laying the foundation first!

No community discussion yet for this question.