Practice Test
True or False: Azure SQL Database supports transparent data encryption (TDE) for database encryption.
- True
- False
Answer: True.
Explanation: TDE is a feature provided by Azure SQL Database for encrypting data at rest, which helps protect against the threat of malicious activity.
What type of keys are used for encryption and decryption in transparent data encryption (TDE) in Azure SQL Database?
- a) By default, a service-managed certificate
- b) User-managed keys only
- c) Both a and b
- d) None of the above
Answer: c) Both a and b
Explanation: TDE uses either a service-managed certificate or user-managed keys, located in Azure Key Vault for encryption and decryption operations.
True or False: It is possible to rotate the TDE protector manually.
- True
- False
Answer: True.
Explanation: The rotation of TDE protector could be manual or automatic and it can be managed by Azure Key Vault for user-managed keys.
Which of the following is NOT a benefit of implementing database encryption for Azure SQL Database?
- a) Protects data at rest
- b) Assures data integrity
- c) Prevents unauthorized access
- d) Removes the need for compliance with industry regulations
Answer: d) Removes the need for compliance with industry regulations
Explanation: Implementing database encryption does not remove the need for compliance. It rather helps in achieving the compliance with industry regulations.
_______________is used by Azure SQL Database to perform real-time encryption and decryption of the database, associated backups, and transaction log files at rest.
- a) Transparent Data Encryption
- b) Azure Key Vault
- c) Advanced Threat Protection
- d) SSL/TLS
Answer: a) Transparent Data Encryption
Explanation: Transparent Data Encryption performs real-time I/O encryption and decryption of the data and log files, which protect data at rest.
Azure SQL Database supports which types of data encryption?
- a) Transparency Data Encryption
- b) Always Encrypted
- c) Both a and b
- d) None of the above
Answer: c) Both a and b
Explanation: Azure supports both Transparency Data Encryption (TDE) and Always Encrypted for SQL Database to ensure data security and privacy.
True or false: You can use your own key for Transparent Data Encryption in Azure SQL Database.
- True
- False
Answer: True.
Explanation: You can bring your own key (BYOK) for use with TDE, storing it in Azure Key Vault.
Always Encrypted feature in Azure SQL Database is designed to protect sensitive data against which of the following?
- a) Malware on client computers
- b) Malicious insiders
- c) Unauthorized access from Database Administrators
- d) All of the above
Answer: d) All of the above
Explanation: Always Encrypted feature is set up on the client side to protect sensitive data from malicious insiders as well as against malware threats.
Disabling encryption on your Azure SQL Database…
- a) Can be done immediately
- b) Requires a few hours to reflect
- c) Can never be done
- d) Takes a few days to reflect
Answer: b) Requires a few hours to reflect
Explanation: If you choose to disable encryption on a database it will take a few hours for the changes to take effect.
True or False: Column-level encryption and Transparent Data Encryption (TDE) can be used simultaneously on Azure SQL Database.
- True
- False
Answer: True.
Explanation: Column-level encryption (Always Encrypted) and TDE can be used simultaneously for more granular data protection, where TDE would encrypt the database at rest and Always Encrypted would encrypt specific sensitive columns.
Interview Questions
What is Transparent Data Encryption (TDE) in Azure SQL Database?
Transparent Data Encryption (TDE) is a feature available in Azure SQL Database that encrypts the storage of an entire database by using industry-standard AES-256 symmetric keys.
How is the encryption and decryption performed in TDE?
TDE performs real-time I/O encryption and decryption of data and log files, ensuring a seamless user experience. The encryption uses a database encryption key (DEK) stored in the database boot record for accessibility during recovery.
How is the database encryption key protected in Azure SQL Database?
The database encryption key (DEK) is protected by a server certificate, which is stored in the server’s master database.
Can you disable Transparent Data Encryption once enabled?
Yes, Transparent Data Encryption (TDE) can be disabled after it is enabled. However, it’s highly recommended to keep TDE enabled for data security purposes.
How is TDE enabled for Azure SQL Database?
TDE is enabled by default on all new Azure SQL Databases. However, for existing databases, it can be turned on through the Azure portal, via the Azure REST API, Azure CLI or PowerShell.
Can I move the data while Transparent Data Encryption is active?
Yes, the TDE encrypted data can be moved without the need to decrypt it. The move operation is transparent to the TDE encryption.
Is there any overhead associated with enabling TDE?
Yes, enabling TDE can increase CPU usage by up to 5%. However, this overhead is generally not noticeable to most applications because of its multi-threaded processing routine.
What happens when a TDE encrypted database is exported?
When a TDE encrypted database is exported as data-tier application (DAC) package, the package itself is not encrypted. Hence proper access control should be used when dealing with exported data.
Can row-level security be used with TDE enabled?
Yes, row-level security can be used in conjunction with Transparent Data Encryption (TDE).
Do we need to handle keys and certificates when using TDE within Azure SQL Database?
No. Azure SQL Database automatically creates a certificate, used to protect the database encryption key (DEK). It also handles the rotation of these certificates every 90 days without user intervention.
Can Azure Key Vault be used for storing keys for Azure SQL Database Encryption?
Yes, Microsoft provides the option to use Azure Key Vault to protect the Transparent Data Encryption (TDE) certificate that’s associated with the database.
Does enabling TDE affect database backups of Azure SQL Database?
Yes, enabling TDE encrypts database backups. The restore operation, however, is seamless whether TDE is turned ON or OFF.
What happens when the TDE certificate is lost in Azure SQL Database?
Azure SQL Database automatically manages TDE certificates. Users cannot manually delete these certificates, thus ensuring no loss of encrypted data due to certificate loss.
What is Always Encrypted in Azure SQL Database?
Always Encrypted is a feature in Azure SQL Database that helps protect sensitive data at rest on the server, and while it’s in use during query processing, ensuring encryption without affecting application performance.
Which cryptographic algorithms are supported in Always Encrypted in Azure SQL Database?
The cryptographic algorithms supported by Always Encrypted are Deterministic Encryption (AES_256_CBC) and Randomized Encryption (RSA_OAEP).
extutorials.com