Exam AZ-305 topic 2 question 19 discussion

Correct, Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview?view=azuresql#:~:text=TDE%20protector%20can%20only%20be%20an%20asymmetric%2C%20RSA%2C%20or%20RSA%20HSM%20key.%20The%20supported%20key%20lengths%20are%202048%20bits%20and%203072%20bits.

Per following contents in https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview?view=azuresql#requirements-for-configuring-tde-protector To provide Azure SQL customers with two layers of encryption of data at rest, infrastructure encryption (using AES-256 encryption algorithm) with platform managed keys is being rolled out. This provides an addition layer of encryption at rest along with TDE with customer-managed keys, which is already available. ASE is platform managed key, this question is asking for customer managed keys, for now only RSA is qualified.

Check link he is right

The information provided is not accurate. Transparent Data Encryption (TDE) in Azure SQL Managed Instance uses the Advanced Encryption Standard (AES) algorithm to encrypt the data stored in the database and its backups. AES algorithm is a symmetric encryption algorithm, it supports key lengths of 128, 192, and 256 bits. Among these, AES 256 provides the highest encryption strength and is considered the most secure option for TDE. RSA is not used for TDE. RSA is an asymmetric encryption algorithm, it is used in many different encryption scenarios, not just for TDE. Therefore, you should use AES 256 for the TDE protector.