Practice question 423 of 498 · medium
A finance application must prevent database administrators without client keys from reading selected sensitive column values. Which control should be evaluated?
Choose the single best answer.
Show the answer and explanation
✓ Correct answer
- Always Encrypted with properly separated client key access
Always Encrypted addresses supported column plaintext separation from the database engine. TDE protects files at rest, masking is not an adversarial encryption boundary, and a private endpoint limits network paths rather than administrator query rights.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.