DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DBDemo

Question

You have an Azure subscription containing the resources shown in the following table.

Question Image

You need to create a container in db1 with these attributes:

Name: Container1
Encryption: Client-side encryption with Always Encrypted

Which three actions should you take, in sequence?

Drag & Drop

Create Container1 and include an encryption policy.

Create a data encryption key in db1.

Generate and upload a secret to KV1.

Generate and upload a key to KV1.

Generate and upload a certificate to KV1.

Explanation

Azure Cosmos DB client-side encryption uses an Azure Key Vault key to wrap a data encryption key (DEK). The DEK must be created in the Cosmos DB database before creating the container, and the container’s encryption policy identifies the encrypted paths and associated DEK.

Learn more

Use client-side encryption with Always Encrypted - Azure Cosmos DB

DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DBDemo

AstroTutor

Notes

Readiness

QuestionQ15

Community Discussion