Microsoft Cybersecurity Architect (SC-100)Design security for infrastructureHard
A financial services company is designing an Azure environment to host highly sensitive customer data, including credit card numbers and personal financial records. Compliance regulations dictate that this data must be protected against unauthorized access, even by privileged administrators of the cloud provider. The solution must ensure that the data is never exposed in plaintext during processing within the virtual machines. Which advanced security technology should the architect prioritize for this scenario?
- AAzure Key Vault Managed HSM for key storage
- BAlways Encrypted with Secure Enclaves for Azure SQL Database
- CAzure Disk Encryption with Platform-Managed Keys
- DAzure Private Link for network isolation
Show answer & explanationAnswer & explanation
Correct answer: B. Always Encrypted with Secure Enclaves for Azure SQL Database
Always Encrypted with Secure Enclaves specifically addresses the requirement to protect data in use (during processing) from unauthorized access, including by cloud administrators, by performing operations on encrypted data within a hardware-backed secure enclave. This ensures data is never exposed in plaintext in memory.
Why the other options are wrong
- A. Azure Key Vault Managed HSM securely stores encryption keys but does not directly protect data during processing from privileged access.
- C. Azure Disk Encryption protects data at rest but does not protect data from being exposed in plaintext during processing in memory.
- D. Azure Private Link ensures network isolation but does not protect data from privileged administrators or during in-memory processing.
Always Encrypted with Secure Enclaves
A feature in Azure SQL Database that protects sensitive data, both at rest and in memory, from unauthorized users, including database administrators and cloud operators.
- Performs computations on encrypted data within a secure enclave.
- Ensures data is never exposed in plaintext to the database engine or OS.
- Crucial for highly regulated industries requiring strong data-in-use protection.
Memory trick: Enclaves are like a secret vault FOR the CPU.