Correct Answer: Configure TDE with Customer-Managed Keys (CMK) stored in Azure Key Vault Managed HSM
Azure SQL TDE with Customer-Managed Keys (Bring Your Own Key — BYOK) allows the organization to control the TDE protector key. Storing this key in Azure Key Vault Managed HSM provi...
Correct Answer
Configure TDE with Customer-Managed Keys (CMK) stored in Azure Key Vault Managed HSM
Why This Answer Is Correct
Azure SQL TDE with Customer-Managed Keys (Bring Your Own Key — BYOK) allows the organization to control the TDE protector key. Storing this key in Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 validated hardware security module protection, satisfying both the customer-control and HSM requirements.
This question evaluates your knowledge of Azure Key Vault — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding Azure Key Vault is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
A solutions architect needs to store application connection strings and API keys securely. Which service should they use?
What is the difference between a 'Secret' and a 'Key' in Azure Key Vault?
An administrator wants to manage access to a Key Vault using Azure RBAC (Role-Based Access Control) instead of legacy Access Policies. Is this possible?
What is the 'Soft Delete' feature in Azure Key Vault for?