SC-100 - Design Security Solutions for Applications and Data (23% of the exam) - Section 4.3

Design solutions for securing an organization's data, including classification, encryption, and database protection.

Design a data security solution that begins with data discovery and classification, then applies encryption at rest and in transit using Azure Key Vault and infrastructure encryption to protect sensitive assets. Configure Microsoft Defender for Storage and Microsoft Defender for Databases to detect threats across Azure SQL, Azure Synapse Analytics, and Azure Cosmos DB.

data discovery and classificationencryption at rest and in transitAzure Key Vault and infrastructure encryptionMicrosoft Defender for StorageMicrosoft Defender for DatabasesAzure SQL, Azure Synapse Analytics, and Azure Cosmos DB security

Practice question for this objective

Free sampleDesign Security Solutions for Applications and Datahard

A bank already uses Transparent Data Encryption on its Azure SQL Database to encrypt the whole database at rest, but a regulator now requires that the bank hold and rotate the encryption key itself in a key store under its own control, so it can revoke the key and render the database unreadable independently of Microsoft. Which design satisfies this requirement while keeping Transparent Data Encryption in place?

ALeave Transparent Data Encryption on its service-managed key but enable an additional layer of infrastructure encryption, so the database is wrapped twice by Microsoft-controlled keys at the platform.
BReplace Transparent Data Encryption with Always Encrypted on the sensitive columns, holding the column master key in Azure Key Vault so the bank controls that key.
CMove the database behind a private endpoint and enforce a minimum TLS version, so the key material can never be intercepted in transit by any party other than the bank.
DConfigure Transparent Data Encryption with a customer-managed key stored in Azure Key Vault, so the database encryption key is protected by a key the bank generates, rotates, and can revoke. Correct

Transparent Data Encryption with a customer-managed key in Azure Key Vault gives an organisation independent hold, rotation, and revocation of the at-rest database key. Transparent Data Encryption protects the entire database at rest, and switching its protector to a customer-managed key in Azure Key Vault means the customer's key wraps the database encryption key, so revoking that key makes the database unreadable without Microsoft involvement.

Why A is wrong: Infrastructure encryption adds a second platform layer and is tempting for a stronger-encryption framing, but both layers stay under Microsoft-managed keys, so it does not give the bank the hold and revoke control the regulator demands.

Why B is wrong: Always Encrypted does protect column data with a client-held key and is tempting because the key sits in Key Vault, but it encrypts only chosen columns rather than the whole database at rest and abandons the Transparent Data Encryption design the requirement says to keep.

Why C is wrong: Private endpoints and minimum TLS protect data in transit and network exposure, which is tempting as a control-tightening move, but they do nothing about who holds the at-rest encryption key, leaving the revoke-independently requirement unmet.

Why D is correct: Transparent Data Encryption with a customer-managed key in Azure Key Vault hands the bank control of the key that wraps the database encryption key, satisfying the hold, rotate, and revoke requirement while leaving Transparent Data Encryption operating.

See more SC-100 practice questions, answers explained.

Exam traps in Design Security Solutions for Applications and Data

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-100 bank for this domain.

Microsoft Defender for Servers, to add endpoint detection and response and vulnerability assessment to the virtual machines that host the storage gateway and the database engine.
Why it is wrong: Microsoft Defender for Servers protects virtual machine workloads with endpoint detection and vulnerability assessment, which is tempting because servers underpin the services, but it does not scan blobs or databases as data services, so it leaves both stated data-protection needs unmet.
Rely on the existing Microsoft Defender for Azure SQL plan, since it already monitors the company's relational databases and therefore covers the PostgreSQL servers too.
Why it is wrong: The Defender for Azure SQL plan is tempting because it already protects relational databases, but its coverage is limited to Azure SQL and SQL on virtual machines and does not extend to open-source engines, so PostgreSQL would remain unmonitored.
Microsoft Defender for Storage, to scan objects for malware on upload and alert on anomalous access to the storage accounts that back the data services.
Why it is wrong: Microsoft Defender for Storage covers blob and file storage accounts with malware scanning and access-anomaly alerting, which is tempting because it is a data-service plan, but neither Cosmos DB nor PostgreSQL is a storage account, so it protects the wrong service and leaves both stated databases uncovered.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.