SY0-701 Question 37
Single answerA healthcare company stores patient records in a central SQL database. Administrators need to protect highly sensitive fields such as Social Security numbers so that database administrators can still maintain the server and back up the database, but cannot view those specific values in plaintext. The application must also continue to search and update non-sensitive fields efficiently. Which encryption approach best meets this requirement?
- A
Enable full-disk encryption on the database server using AES-256
- B
Use TLS 1.3 with ephemeral key exchange between the application and database server
- C
Implement record- or field-level encryption for the sensitive columns within the database
- D
Encrypt the entire database volume with a symmetric key stored on the same server
Show answer and explanation
Correct answer: C
Explanation
The best answer is to implement record- or field-level encryption for sensitive columns. In real environments, different encryption levels solve different problems. Full-disk, partition, and volume encryption primarily protect data at rest from device loss or offline theft. Transport encryption such as TLS 1.3 protects data in motion using negotiated session keys. However, when the goal is to prevent exposure of specific sensitive values to privileged infrastructure administrators while preserving normal database functionality for other data, granular encryption at the record or field level is the most appropriate control. This aligns with common security architecture practices for protecting regulated data such as PII and PHI. Best-practice guidance from sources such as NIST emphasizes selecting controls based on the threat model: data-at-rest controls for lost media, data-in-transit controls for network interception, and application- or field-level protections for limiting insider access to sensitive content.
- A. Incorrect.
This is incorrect because full-disk encryption protects data at rest if the physical drive is stolen or removed, but once the system is running and the disk is mounted, authorized OS and database processes can read the data normally. A database administrator with access to the live database could still view plaintext records. Full-disk encryption is useful, but it does not provide granular protection for specific fields from privileged insiders.
- B. Incorrect.
This is incorrect because TLS 1.3 protects data in transit between systems by using modern cryptography, typically asymmetric cryptography for authentication and key exchange combined with symmetric session encryption for performance. However, TLS does not protect the data once it is stored in the database. It is an important control for transport security, but it does not solve the requirement to prevent DBAs from viewing specific stored values.
- C. Correct.
This is correct because record- or field-level encryption allows the organization to encrypt only the most sensitive data elements, such as Social Security numbers, while leaving other fields available for normal database operations. This approach supports separation of duties by allowing DBAs to manage the database platform without necessarily having access to application-layer decryption keys. It is the most appropriate choice when only certain records or columns require stronger confidentiality controls.
- D. Incorrect.
This is incorrect because encrypting the entire database volume is similar in effect to storage-level or volume encryption: it protects against offline theft of the storage media, not against authorized access to a running system. Storing the symmetric key on the same server further weakens the control because an attacker or privileged user who compromises that server may be able to access both the encrypted data and the key material.