AZ-500 Question 184
Single answerA financial services company needs to store personally identifiable information (PII) in Azure SQL Database. They must ensure that no one, including high-privileged database administrators, can see the plaintext data. They also need to perform equality searches on encrypted columns. Which approach best meets these requirements?
- A
Use Transparent Data Encryption (TDE) to encrypt data at rest
- B
Enable Always Encrypted with Deterministic Encryption on the sensitive columns
- C
Implement database-level firewall rules and rely on row-level security
- D
Use Always Encrypted with Randomized Encryption for all customer data
Show answer and explanation
Correct answer: B
Explanation
Always Encrypted in Azure SQL Database is designed to protect sensitive data from unauthorized access, including high-privileged users such as DBAs. Deterministic encryption allows equality comparisons and indexing, making it suitable for queries while ensuring that only the client application can decrypt the data. For more details and best practices, refer to Microsoft’s documentation on Always Encrypted in Azure SQL Database: https://learn.microsoft.com/azure/azure-sql/database/always-encrypted-azure-sql-database.
- A. Incorrect.
Incorrect. TDE encrypts data at rest but does not prevent high-privileged users (like DBAs) from viewing unencrypted data when running queries. TDE only covers data on disk and backups, not the data in use.
- B. Correct.
Correct. Always Encrypted with Deterministic Encryption ensures that data remains encrypted in-flight and at rest, and is only decrypted on the client side. It also allows for equality searches because the encrypted values remain consistent, enabling indexed lookups.
- C. Incorrect.
Incorrect. Database-level firewall rules and row-level security can help limit access, but they do not ensure that the data remains encrypted to protect against curious or rogue DBAs. This approach doesn't meet the requirement of preventing plaintext access to privileged roles.
- D. Incorrect.
Incorrect. Randomized Encryption provides a higher level of security but does not support equality searches. Since the organization needs to perform lookups on encrypted columns, deterministic encryption is more suitable.