A data architect is designing a new database for a global application that stores customer contact information. Due to compliance requirements, all sensitive customer data, including names and email addresses, must be encrypted at rest within the Azure SQL Database. The architect needs to ensure that the encryption is managed by the service and does not require application-level changes or extensive key management by the customer. Which encryption feature should be used?

Why the other options are wrong

• A. Always Encrypted provides client-side encryption, meaning data is encrypted by the client driver before it leaves the application. This requires application changes and client-side key management, which contradicts the 'does not require application-level changes' requirement.
• B. Cell-level encryption (or column-level encryption) is an older method that requires explicit function calls in queries for encryption/decryption, requiring significant application changes and not managed transparently by the service.
• C. Azure Key Vault integration with customer-managed keys (CMK for TDE) allows customers to manage their own encryption keys. While a valid TDE option, the requirement states 'does not require ... extensive key management by the customer', implying service-managed keys are preferred, making basic TDE the better fit.