Microsoft Azure Data FundamentalsDescribe how to work with relational data on AzureHard
A company is designing a new database in Azure SQL Database to store highly sensitive customer credit card information. They need to ensure that specific columns containing this data are encrypted within the database and that only authorized applications or users can decrypt and access the plaintext data. This encryption should prevent even database administrators from seeing the sensitive data. Which encryption technology should be chosen?
- ADynamic Data Masking
- BCell-level Encryption
- CTransparent Data Encryption (TDE)
- DAlways Encrypted
Show answer & explanationAnswer & explanation
Correct answer: D. Always Encrypted
Always Encrypted ensures that sensitive data is encrypted on the client side before being sent to the database and remains encrypted at rest and in memory on the server. Only client applications with access to the encryption key can decrypt the data, protecting it from database administrators.
Why the other options are wrong
- A. Dynamic Data Masking obfuscates data for display but does not encrypt the underlying data at rest or in memory, so it does not prevent DBAs from accessing the raw data.
- B. Cell-level encryption encrypts specific columns but typically involves server-side keys, which can be accessible to DBAs, and requires more complex management.
- C. TDE encrypts the entire database at rest, but data is decrypted in memory on the server, making it accessible to database administrators with proper permissions.
Always Encrypted
Always Encrypted is a SQL Server and Azure SQL Database feature that protects sensitive data inside the database from unauthorized access, even from database administrators.
- Client-side encryption, keys never leave client.
- Data encrypted at rest, in transit, and in memory.
- Protects against high-privileged users (DBAs).
Memory trick: Always Encrypted: Always Protected, Even from Admins.