SC-100 Practice Question 4014
Exam: SC-100
Domain: Design security solutions for applications and data
Difficulty: medium
An architect needs to secure cryptographic keys used for transparent data encryption (TDE) in Azure SQL. Compliance mandates that the organization must retain sole custody of the root keys inside dedicated, hardware-isolated FIPS 140-2 Level 3 HSMs. What should you architect?
Answer Options
A
Azure Key Vault Managed HSM with Customer-Managed Keys (CMK)
B
Storing private keys in a plain text file on the database root drive
C
Service-managed keys stored in public GitHub repositories
D
Printing cryptographic keys onto paper certificates
Correct Answer
A: Azure Key Vault Managed HSM with Customer-Managed Keys (CMK)
Explanation
Deploy Azure Key Vault Managed HSM (Hardware Security Module) to store customer-managed keys (CMK) for Transparent Data Encryption.