StudyByteLearn
← AZ-305: Azure Infrastructure Solutions
AZ-305 · Relational data

Practice question 123 of 400 · hard

A security design uses TDE and claims database administrators can never query sensitive column values. Which correction is appropriate?

Choose the single best answer.

  1. A.TDE blocks every authorized SELECT on encrypted files
  2. B.A private endpoint guarantees that any database administrator sees only ciphertext
  3. C.TDE encrypts data at rest; evaluate Always Encrypted and separate client-side key control for the administrator-confidentiality requirement
  4. D.Dynamic masking is a cryptographic replacement for TDE and client-side encryption
Show the answer and explanation

✓ Correct answer

  • TDE encrypts data at rest; evaluate Always Encrypted and separate client-side key control for the administrator-confidentiality requirement

TDE protects stored files/logs/backups, while Always Encrypted can protect eligible values from database-side access with separate keys. Masking changes presentation and is not encryption. Network location does not prevent authorized queries. Source guide: PDF page 24-25.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.