How is the Database Encryption Key for SQL Server TDE linked to the certificate?
"Create a database encryption key and protect it by the certificate". What does protect mean?


It means that TDE uses the Database Encryption Key (DEK) to encrypt/decrypt the database BUT the Database Encryption Key REQUIRES the existence of the server certificate in order to do this.  Thus, the Database Encryption Key is 'protected' by its requirement that the server certificate exist.  

This 'requirement' is quite obvious if you back up a TDE database and try to restore or attach it to another Sql Server instance that does not have that server certificate.  You'll get an error similar to this:



My answer to a related question here provides some additional information about TDE requirements.