Q: 17
DRAG DROP You need to configure an Azure policy to ensure that the Azure SQL databases have TDE enabled. The solution must meet the security and compliance requirements. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. 
Drag & Drop
Discussion
Create an Azure policy definition that uses the deployIfNotExists effect, then create an assignment, then invoke a remediation task. There's a trap in picking managed identity but that's auto during assignment. Seen similar in practice sets.
Create policy definition with deployIfNotExists, assign it, then remediation. Saw similar order in official practice labs.
Create an Azure policy definition with deployIfNotExists, then assign the policy, finally invoke a remediation task. That's the order since you have to define the rule, apply it, and then remediate. Pretty sure this matches how policy enforcement flows in Azure.
Create policy definition with deployIfNotExists effect, assign it, then invoke remediation. I think that's how you'd push TDE at scale.
Create Azure policy definition (deployIfNotExists) → assign the policy → invoke remediation task. You define what compliant looks like, apply it to your resources, then fix any non-compliant DBs. I think that's the right flow for enforcing TDE on both new and existing databases. Open to corrections if anyone sees it differently.
Be respectful. No spam.
