CompTIA DataSys+ (DS0-001)Database DeploymentMedium
A database administrator is planning to migrate an existing on-premises SQL Server database to Azure SQL Database. The database contains highly sensitive personal identifiable information (PII) that must remain encrypted throughout its lifecycle, including while in use by the application. Which SQL Server feature, when migrated, provides this 'always encrypted' capability in Azure SQL Database?
- AAzure Disk Encryption
- BTransparent Data Encryption (TDE)
- CColumn-level Encryption
- DAlways Encrypted
Show answer & explanationAnswer & explanation
Correct answer: D. Always Encrypted
Always Encrypted is a SQL Server and Azure SQL Database feature designed to protect sensitive data, ensuring that data is encrypted at rest, in motion, and even during processing in the database, with decryption only available to the client application.
Why the other options are wrong
- A. Azure Disk Encryption encrypts the underlying virtual machine disks, but data within the database itself is decrypted when the database engine processes it, similar to TDE.
- B. TDE encrypts the entire database data and log files at rest, but data is decrypted in memory during use, making it vulnerable to privileged users.
- C. Column-level encryption is a general concept; Always Encrypted is the specific SQL Server feature that implements this with the 'always encrypted' guarantee.
Always Encrypted
A data encryption feature in SQL Server and Azure SQL Database that protects sensitive data, ensuring it remains encrypted in the database, in transit, and at rest, with decryption only at the client application.
- Data remains encrypted while in use by the database engine.
- Encryption keys are stored outside the database, typically in a Key Vault.
- Requires client-side driver support for decryption/encryption.
Memory trick: Always Encrypted for always protected PII.