Exam DP-203 topic 3 question 6 discussion

I believe this is correct, based on the question: What should you do FIRST? A DF needs to be empty to be encrypted: https://docs.microsoft.com/en-us/azure/data-factory/enable-customer-managed-key#post-factory-creation-in-data-factory-ui So FIRST we need to empty the DF - then we can move on.

Correct answer: A customer-managed key can only be configured on an empty data Factory. The data factory can't contain any resources such as linked services, pipelines and data flows. https://learn.microsoft.com/en-us/azure/data-factory/enable-customer-managed-key#post-factory-creation-in-data-factory-ui

Correct answer should be A. When encrypting Azure Data Factory (ADF) resources using Azure Key Vault (AKV), a private endpoint connection ensures that the communication between the Data Factory and Key Vault happens over a private network rather than a public endpoint. This is required to securely retrieve encryption keys like key1.

is the first step.

Correct

A customer-managed key can only be configured on an empty data Factory. The data factory can't contain any resources such as linked services, pipelines and data flows. https://learn.microsoft.com/en-us/azure/data-factory/enable-customer-managed-key#post-factory-creation-in-data-factory-ui

so you need to encrypt the df, you need to remove the bonded service first , answer is correct

Its C: Your ADF should be empty during encryption process using a KEY

correct answer

You don't need to enable "RBAC", access policies is a default and more simple way to assign permissions, so B option is not necesary, but it is a requirement to delete the linked services to configure customer-managed key. So the correct answer is C - Delete linked services first. https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal https://docs.microsoft.com/en-us/azure/data-factory/enable-customer-managed-key#enable-customer-managed-keys

Correct. "A customer-managed key can only be configured on an empty data Factory. The data factory can't contain any resources such as linked services, pipelines and data flows."

A customer-managed key can only be configured on an empty data Factory. The data factory can’t contain any resources such as linked services, pipelines and data flows. It is recommended to enable customer-managed key right after factory creation. Note: Azure Data Factory encrypts data at rest, including entity definitions and any data cached while runs are in progress. By default, data is encrypted with a randomly generated Microsoft-managed key that is uniquely assigned to your data factory. Reference: https://docs.microsoft.com/en-us/azure/data-factory/enable-customer-managed-key

B should be the correct answer. https://docs.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

Should it be D? https://docs.microsoft.com/en-us/powershell/module/az.datafactory/new-azdatafactoryv2linkedserviceencryptedcredential?view=azps-7.0.0

I thin k it's B. I recently changed a linked service pwf to key vault. I didn't delete the service and just added the managed Identity access to the vault with all the desired rules.

Isn't B Correct ?