AZ-500 Question 186
Single answerA financial services company stores customer credit card information in Azure SQL Database. Due to strict compliance requirements, database administrators should not be able to view the card data in plain text, yet they still must manage the database for performance and maintenance. Which solution should you recommend to meet this need?
- A
Enable Transparent Data Encryption (TDE) on the Azure SQL Database
- B
Implement Azure Defender for SQL to monitor suspicious activities
- C
Use Azure SQL Database Always Encrypted with client-side key management
- D
Apply firewall rules to block access for the database administrators
Show answer and explanation
Correct answer: C
Explanation
Azure SQL Database Always Encrypted is specifically designed to protect highly sensitive data, ensuring the data remains encrypted not only at rest but also in use. The keys reside on the client side, preventing even privileged SQL Server logins from accessing the data in plaintext. For more information, refer to Microsoft’s documentation: https://learn.microsoft.com/azure/azure-sql/database/always-encrypted-azure-sql-database.
- A. Incorrect.
Option 1 is incorrect. Transparent Data Encryption (TDE) only protects data at rest and does not prevent privileged database users from viewing the data in plain text. It encrypts the physical files but does not encrypt data in queries or during runtime.
- B. Incorrect.
Option 2 is incorrect. Azure Defender for SQL provides threat detection and alerts for suspicious activities. While it's valuable for security monitoring, it does not itself encrypt data to prevent administrators from viewing sensitive information in plaintext.
- C. Correct.
Option 3 is correct. Azure SQL Database Always Encrypted with client-side key management ensures that sensitive data is encrypted both at rest and in transit, and the encryption keys never leave the client environment. This design prevents even high-privilege database administrators from viewing sensitive data in plain text.
- D. Incorrect.
Option 4 is incorrect. Restricting database administrators with firewall rules is not a suitable solution for day-to-day management requirements; administrators still need access to perform essential tasks. Moreover, blocking them entirely does not address the need to manage the database securely.