Hotspot Question
You have an Azure subscription. The subscription contains two virtual machines named SQL1 and SQL2 that host a Microsoft SQL Server 2019 Always On availability group named AOG1.
You plan to deploy an SAP NetWeaver system that will have a database tier hosted on AOG1.
You need to encrypt the Azure virtual machine disks and the SQL Server database. The solution must meet the following requirements:
- The operating system disk, data disk, and the temporary disk of the
virtual machines must be encrypted.
- SQL Server encryption keys must be stored on-premises.
Which type of encryption should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct select ion is worth one point.

Reveal Solution
Discussion
Correct Answer:

Explanation:
Box 1: Encryption at host
The operating system disk, data disk, and the temporary disk of the virtual machines must be encrypted.
Encryption at host
Encryption at host is a Virtual Machine option that enhances Azure Disk Storage Server-Side Encryption to ensure that all temp disks and disk caches are encrypted at rest and flow encrypted to the Storage clusters.
When you enable encryption at host, data stored on the VM host is encrypted at rest and flows encrypted to the Storage service. Temporary disks and ephemeral OS disks are encrypted at rest with either customer-managed or platform-managed keys, depending on what you select as the disk encryption type for the OS disk. The OS and data disk caches are encrypted at rest with either customer-managed or platform- managed keys, depending on what you select as the disk encryption type.
Box 2: Transparent Data Encryption (TDE)
SQL Server encryption keys must be stored on-premises.
You can enable TDE for SQL Server Always On Availability Groups.
To configure Always Encrypted in your database, follow these steps:
Note: Provision cryptographic keys to protect your data. Always Encrypted uses two types of keys:
Column encryption keys.
Column master keys.
A column encryption key is used to encrypt the data within an encrypted column. A column master key is a key-protecting key that encrypts one or more column encryption keys.
You need to store column master keys in a trusted key store outside of the database system, such as Azure Key Vault, Windows certificate store, or a hardware security module. After this, you should provision column encryption keys and encrypt each with a column master key.