Oracle AI Database@Azure supports two broad TDE master-key management approaches: Oracle-managed keys and customer-managed keys .
With the default Oracle-managed model, the TDE master encryption key is generated and stored in an Oracle Wallet within the database environment. Oracle manages key generation, storage, rotation, backup, and restoration activities associated with this model.
For customer-controlled key management, Oracle supports several external key stores. For Exadata Database Service on Dedicated Infrastructure, these include Azure Key Vault , OCI Vault, and Oracle Key Vault.
Azure Key Vault integration is particularly useful for organizations that want their database encryption-key governance aligned with existing Azure key-management, auditing, and separation-of-duties practices.
AWS KMS and Google Cloud KMS are not native key-management choices for an Oracle AI Database@Azure Exadata deployment.
Therefore, the two correct selections from this answer set are A and D .
Study Guide reference: Secure Oracle AI Database@Azure - Transparent Data Encryption, Oracle Wallet, customer-managed keys and Azure Key Vault.