When establishing transparent data encryption, you used a certificate stored in SQL Server and a database encryption key created using this certificate. How should this certificate and key be handled as part of the regular backup process?

When establishing transparent data encryption, you used a certificate stored in SQL Server and a database encryption key created using this certificate. How should this certificate and key be handled as part of the regular backup process?


Answer: -  Export the certificate and key to a file and store this certificate and key backup in a separate highly secure location.

(While the certificate and the database encryption key are stored within SQL Server and thus backed up within SQL Server, restoring a backup to a replacement server requires the certificate and key to be installed first. This means that the certificate and the encryption key must be stored outside of the regular database backups. Storing these files with the backups defeats the purpose of TDE so these files should be stored separately.)