AZ-500 Question 169
Select 2Your organization is migrating a mission-critical dataset containing sensitive personally identifiable information (PII) to Azure SQL Database. The security team requires that no unauthorized party, including database administrators, should be able to view the data in plaintext, and all database access must be controlled through modern authentication methods. Which two actions should you implement to meet these requirements?
- A
A. Enable Always Encrypted on columns containing PII and store the column encryption key in Azure Key Vault
- B
B. Disable Transparent Data Encryption (TDE) to prevent key sharing between multiple databases
- C
C. Use Azure Active Directory (Azure AD) authentication for all database access instead of SQL authentication
- D
D. Configure a Virtual Network Service Endpoint only, relying on network isolation to secure the data
- E
E. Rely on the default encryption in transit (TLS/SSL) feature to ensure data in use is not visible to administrators
Show answer and explanation
Correct answers: A, C
Explanation
In Azure SQL Database, Transparent Data Encryption (TDE) is enabled by default to protect data at rest. However, TDE alone does not prevent authorized administrators from viewing data in plaintext. Always Encrypted, on the other hand, keeps data encrypted during use by storing the keys externally, such as in Azure Key Vault. Meanwhile, Azure AD authentication allows for centralized identity and access management, enhancing overall security. For reference, see Microsoft’s documentation on Always Encrypted (https://learn.microsoft.com/azure/azure-sql/database/always-encrypted-overview) and Azure AD authentication (https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview).
- A. Correct.
A. Correct. Always Encrypted protects data from being viewed in plaintext by unauthorized parties, including database administrators. Storing the keys externally in Azure Key Vault means only users or applications with appropriate permissions can decrypt the data, satisfying strict compliance and data privacy requirements.
- B. Incorrect.
B. Incorrect. Disabling TDE does not improve security. TDE provides at-rest encryption automatically for Azure SQL Database. Disabling it could expose your data on disk and does nothing to limit administrative access.
- C. Correct.
C. Correct. Azure AD authentication centralizes identity management and supports advanced security features like conditional access. Using Azure AD instead of SQL authentication helps enforce strict access controls and eliminates shared credentials.
- D. Incorrect.
D. Incorrect. A Virtual Network Service Endpoint helps restrict network-based access, but it does not protect data from being viewed in plaintext by privileged users or administrators. Network isolation alone does not encrypt underlying data or manage user identities.
- E. Incorrect.
E. Incorrect. TLS/SSL in transit only encrypts data as it travels over the network. It does not address encryption of data at rest or in use, and administrators with sufficient privileges could still see sensitive data if it’s not encrypted in the database itself (as with Always Encrypted).