Exam DP-200 topic 3 question 8 discussion

TDE for Azure SQL DB is obvious. However, the Azure storage is a bit tricky. All Azure Storage resources are encrypted by default. However in this question they specify to encrypted by using the company's own key. Hence the answer is customer-provided key in this case "Storage account key". It's not worded properly.

Storage account keys are the keys to access to the storage account content, not to encrypt it. Storage Service Encryption authorize to use user own key to encrypt data

I think the answer for the storage account should be default storage service encryption. It uses Azure managed keys by default, but can be configured to use customer provided keys. see https://docs.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-key-vault?tabs=portal

I believe the question here asks only about the security and not the encryption, hence the answer should be storage account keys for storage, but not sure about TDE

In storage account there is a link for encryption (left hand side). If you click there you can see you can't disable it and there are 2 options -1. MS managed key and 2. Customer managed key. So this is the correct option that is storage default encryption without any doubt

https://docs.microsoft.com/en-us/azure/storage/common/encryption-customer-managed-keys please check the flow diagram which specify Storage Account Encryption Key(AEK)

To use the company's own key with Azure Storage Account, you should use Azure Key Vault which is not part of the options here.

Wording on question really bad, but answers seem to be correct: SQL Transparent Data Encryption = Encryption-at-rest https://docs.microsoft.com/en-us/azure/sql-database/sql-database-security-overview#information-protection-and-encryption SA Data in a new storage account is encrypted with Microsoft-managed keys https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption

There is no such thing as "Storage Account keys". It's either storage Account Access key or Storage Account encryption key. The terminology used in the question created confusion.

The given answer is correct. "You can manage Azure Storage encryption at the level of the storage account with your own keys. " https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption?toc=%2fazure%2fstorage%2fblobs%2ftoc.json

i think that from this source the right answer is the one set on the document: https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption

I think the correct answer is Azure Disk Encryption because Any customer using Azure Infrastructure as a Service (IaaS) features can achieve encryption at rest for their IaaS VMs and disks through Azure Disk Encryption.  Reference: https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest. Incorrect Answer: TLS because ir is not a encryption at rest. Storage account key because it is to access instead to encrypt Default SSE because you want to use your own key.