Microsoft Certified: Fabric Analytics Engineer AssociateGovern and administer Fabric (10-15%)Easy
A company is migrating its entire data estate to Microsoft Fabric. As part of their data governance strategy, they require that all data accessed by Fabric items (e.g., Lakehouses, Data Warehouses, Dataflows) must be encrypted both at rest and in transit. Which security feature is inherently provided by Microsoft Fabric to meet these encryption requirements without additional configuration by the user?
- AMicrosoft-managed encryption keys with TLS 1.2+ for in-transit data
- BCustomer-managed keys (CMK) for data encryption
- CAzure Key Vault integration for secrets management
- DAlways Encrypted for SQL endpoints
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft-managed encryption keys with TLS 1.2+ for in-transit data
Microsoft Fabric inherently encrypts all data at rest using Microsoft-managed keys (often leveraging Azure Storage Encryption) and encrypts all data in transit using industry-standard protocols like TLS 1.2 or higher. This is a baseline security feature provided by the service.
Why the other options are wrong
- B. Customer-managed keys (CMK) are an *optional* advanced feature for enhanced control, not the default inherent encryption.
- C. Azure Key Vault integration is for managing secrets and connection strings, not the inherent encryption of data at rest or in transit.
- D. Always Encrypted is a specific SQL Server feature for client-side encryption, not the general inherent encryption for all Fabric items.
Fabric Inherent Encryption
Microsoft Fabric provides inherent, baseline encryption for all data at rest and in transit, utilizing Microsoft-managed keys for storage and industry-standard protocols like TLS for network communication.
- Data at rest is encrypted by default (Microsoft-managed keys).
- Data in transit is encrypted by default (TLS 1.2+).
- No user configuration required for baseline encryption.
- CMK is an optional, advanced feature.
Memory trick: Fabric encrypts your data automatically, like a secure courier and a locked vault.