Design solutions for securing an organization's data, including classification, encryption, and database protection.

A bank already uses Transparent Data Encryption on its Azure SQL Database to encrypt the whole database at rest, but a regulator now requires that the bank hold and rotate the encryption key itself in a key store under its own control, so it can revoke the key and render the database unreadable independently of Microsoft. Which design satisfies this requirement while keeping Transparent Data Encryption in place?

• ALeave Transparent Data Encryption on its service-managed key but enable an additional layer of infrastructure encryption, so the database is wrapped twice by Microsoft-controlled keys at the platform.
• BReplace Transparent Data Encryption with Always Encrypted on the sensitive columns, holding the column master key in Azure Key Vault so the bank controls that key.
• CMove the database behind a private endpoint and enforce a minimum TLS version, so the key material can never be intercepted in transit by any party other than the bank.
• DConfigure Transparent Data Encryption with a customer-managed key stored in Azure Key Vault, so the database encryption key is protected by a key the bank generates, rotates, and can revoke.check_circle Correct

Why A is wrong: Infrastructure encryption adds a second platform layer and is tempting for a stronger-encryption framing, but both layers stay under Microsoft-managed keys, so it does not give the bank the hold and revoke control the regulator demands.

Why B is wrong: Always Encrypted does protect column data with a client-held key and is tempting because the key sits in Key Vault, but it encrypts only chosen columns rather than the whole database at rest and abandons the Transparent Data Encryption design the requirement says to keep.

Why C is wrong: Private endpoints and minimum TLS protect data in transit and network exposure, which is tempting as a control-tightening move, but they do nothing about who holds the at-rest encryption key, leaving the revoke-independently requirement unmet.

Why D is correct: Transparent Data Encryption with a customer-managed key in Azure Key Vault hands the bank control of the key that wraps the database encryption key, satisfying the hold, rotate, and revoke requirement while leaving Transparent Data Encryption operating.