AZ-500 Question 185
Single answerAn e-commerce company plans to store customer credit card information in Azure SQL Database. They must comply with regulations that require protecting sensitive data from all unauthorized access, including high-privilege database administrators. They can modify their application to handle encryption tasks, and they want to ensure the credit card data is kept encrypted at rest, in transit, and when queried by administrators. Which feature should you recommend to meet these requirements?
- A
Use Azure SQL Database Transparent Data Encryption (TDE)
- B
Implement Azure SQL Database Always Encrypted
- C
Enable Dynamic Data Masking for sensitive columns
- D
Encrypt data only in transit using SSL/TLS connections
Show answer and explanation
Correct answer: B
Explanation
Azure SQL Database Always Encrypted enables client-side encryption, ensuring that sensitive data is encrypted at rest, in transit, and remains encrypted to high-privilege database administrators. TDE protects data only at rest, while Dynamic Data Masking and TLS in transit alone do not prevent administrators from reading the data in plaintext. To learn more, refer to Microsoft documentation on Always Encrypted at https://learn.microsoft.com/azure/azure-sql/database/always-encrypted-overview.
- A. Incorrect.
Option 1: Azure SQL Database Transparent Data Encryption (TDE) only encrypts data at rest, but database administrators can still view the data in plaintext when querying the database. It does not meet the requirement to hide sensitive data from privileged users.
- B. Correct.
Option 2: Azure SQL Database Always Encrypted encrypts data inside the client application before sending it to the database, meaning the database never sees the data in plaintext. This prevents high-privilege users, including DBAs, from viewing sensitive information, aligning with the company's requirements.
- C. Incorrect.
Option 3: Dynamic Data Masking obfuscates data for users without appropriate permissions, but privileged database administrators can still access the underlying plaintext. It is not sufficient to protect data from all unauthorized access.
- D. Incorrect.
Option 4: SSL/TLS only encrypts data in transit, but does not provide encryption for data in the database or prevent administrators from viewing plaintext data once stored. It does not fulfill the organization's need to protect sensitive data from all access levels.