nerdexam
Microsoft

SC-100 · Question #119

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

The correct answer is B. No. The answer is No. Transparent Data Encryption (TDE) with Microsoft-managed keys encrypts Azure SQL data at rest using AES-256, but Microsoft controls and rotates those keys on its own internal schedule. You cannot configure or enforce a monthly rotation policy when using…

Design security solutions for applications and data

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing the encryption standards for data at rest for an Azure resource. You need to provide recommendations to ensure that the data at rest is encrypted by using AES- 256 keys. The solution must support rotating the encryption keys monthly. Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses Microsoft-managed keys. Does this meet the goal?

Options

  • AYes
  • BNo

How the community answered

(28 responses)
  • A
    29% (8)
  • B
    71% (20)

Explanation

The answer is No. Transparent Data Encryption (TDE) with Microsoft-managed keys encrypts Azure SQL data at rest using AES-256, but Microsoft controls and rotates those keys on its own internal schedule. You cannot configure or enforce a monthly rotation policy when using Microsoft-managed keys. To meet the requirement of rotating encryption keys monthly, you must configure TDE with customer-managed keys (BYOK) stored in Azure Key Vault, where you can set up an automated key rotation policy with a custom interval such as 30 days.

Topics

#Data at rest encryption#Azure SQL Database#Transparent Data Encryption (TDE)#Key management#Key rotation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-100 Practice