A database administrator wants to clone an SQL database that has Transparent Data Encryption (TDE)...

When cloning an SQL database with Transparent Data Encryption (TDE) enabled in NDB, the target server must handle the encryption keys to ensure the cloned database remains functional and secure. TDE uses a keystore (e.g., a bundle file containing the master key and certificate) to encrypt data. Two steps are required: (1) The administrator must back up the keystore bundle file from the source database server VM and transfer it to the target server, ensuring the clone can decrypt the data. (2) After the clone is created, the administrator must run the post-clone command script, which configures the TDE keys on the target server, completes the encryption setup, and activates the cloned database.

Option A (Backup the .cer and .pvk files from the source database server VM) is incorrect because TDE in SQL Server typically uses a keystore bundle, not separate .cer and .pvk files.

Option B (Backup the keystore bundle file from the source database server VM) is correct as it ensures the encryption keys are available on the target.

Option C (Run the pre-clone command script) is incorrect because pre-clone scripts are for preparation, not TDE-specific post-clone setup.

Option D (Run the post-clone command script) is correct as it finalizes the TDE configuration on the target server.

These steps ensure a successful TDE-enabled clone.

References

Nutanix Database Service (NDB) User Guide, Chapter 5: Configuring Time Machines, Section: Cloning TDE-Enabled Databases

Nutanix Support & Insights, Knowledge Base Article: "Cloning SQL Server with TDE in NDB"

Nutanix Certified Professional - Database Automation (NCP-DB) v6.5 Blueprint, Section 5: Protect Databases Using Time Machine