Microsoft Azure Data FundamentalsDescribe how to work with relational data on AzureMedium
A data architect is designing a new relational database in Azure. They need to ensure that specific columns in a table, such as 'SocialSecurityNumber' or 'CreditCardNumber', are encrypted at all times, even when the data is in use by the application. Which Azure SQL Database security feature should they implement?
- ADynamic Data Masking
- BAzure Key Vault integration
- CTransparent Data Encryption (TDE)
- DAlways Encrypted
Show answer & explanationAnswer & explanation
Correct answer: D. Always Encrypted
Always Encrypted protects sensitive data by encrypting it at the column level within the database and decrypting it only within the client application. This ensures data remains encrypted even during processing by the database engine.
Why the other options are wrong
- A. Dynamic Data Masking obfuscates sensitive data for non-privileged users but does not encrypt it.
- B. Azure Key Vault is used to store and manage encryption keys, but it is not the encryption mechanism itself for 'in-use' data.
- C. TDE encrypts the entire database at rest, but data is decrypted in memory for processing.
Always Encrypted
Always Encrypted is a feature in Azure SQL Database that protects sensitive data, such as credit card numbers or national identification numbers, stored in Azure SQL Database or SQL Server databases. It allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the database engine.
- Data encrypted at the client side.
- Data remains encrypted in transit, at rest, and even during processing by the database engine.
- Protects against unauthorized access by database administrators and cloud operators.
- Requires client-side application changes to handle encryption/decryption.
Memory trick: Always keep sensitive data encrypted, even when SQL is analyzing it.