Hotspot Question You have an Azure subscription. You plan to implement Azure Synapse Analytics SQL dedicated pools and SQL serverless pools. You need to recommend a solution to provide additional…

Question

Exhibits

Answer Area

Explanation

The solution requires selecting Transparent Data Encryption (TDE) with customer-managed keys for both Azure Synapse Analytics SQL dedicated pools and SQL serverless pools to meet the additional encryption-at-rest security requirement using customer-managed keys whenever possible.

Approach. The question asks to recommend a solution for additional encryption-at-rest security using customer-managed keys (CMK) whenever possible, for both Azure Synapse Analytics SQL dedicated pools and SQL serverless pools. Given the available options:

1. For Dedicated SQL pool: Dedicated SQL pools natively support Transparent Data Encryption (TDE). TDE can be configured to use either Microsoft-managed keys or customer-managed keys (CMK) via integration with Azure Key Vault. Since the requirement is to use CMK whenever possible, 'Transparent Data Encryption (TDE) and customer-managed keys' is the appropriate and supported choice for dedicated SQL pools.

2. For Serverless SQL pool: Serverless SQL pools primarily query data residing in external storage accounts (like Azure Data Lake Storage Gen2). While encryption for the data itself is typically managed at the storage account level (which supports CMK for Azure Storage encryption), serverless SQL pools also have internal metadata and system databases. The available options present 'Transparent Data Encryption (TDE) and customer-managed keys' as a choice. Although current Azure documentation indicates TDE for serverless pool metadata uses Microsoft-managed keys by default and CMK for TDE is primarily for dedicated pools, in the context of this exam question and the given choices, 'Transparent Data Encryption (TDE) and customer-managed keys' is presented as the intended answer for serverless pools to fulfill the 'customer-managed keys whenever possible' requirement, implying a broader application of TDE principles or a specific exam-time understanding for internal components. As it's the only option providing CMK among the TDE choices, and to align with the provided correct answer image, this option is selected.

Common mistakes.

• common_mistake. The common mistake would be to choose options that do not involve customer-managed keys. For both pool types:
• Azure Storage infrastructure encryption and Microsoft-managed keys: This option specifies Microsoft-managed keys, which does not meet the requirement of using customer-managed keys 'whenever possible' for additional security control.
• Transparent Data Encryption (TDE) and Microsoft-managed keys: This option also specifies Microsoft-managed keys, failing to meet the requirement for customer-managed keys. While TDE with Microsoft-managed keys provides encryption, the question specifically asks for CMK when possible. Therefore, any option not explicitly stating 'customer-managed keys' is incorrect if a CMK option is available.

Concept tested. The core concept being tested is the understanding of encryption-at-rest options and key management strategies (specifically Microsoft-managed vs. customer-managed keys) for different types of Azure Synapse Analytics SQL pools (dedicated vs. serverless). It assesses knowledge of Transparent Data Encryption (TDE) and its applicability, as well as the principle of leveraging customer-managed keys for enhanced security and compliance requirements.

No community discussion yet for this question.