StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Data classification encryption databases and storage

Practice question 470 of 498 · medium

An administrator manages Azure SQL but must not see selected column plaintext without separately controlled application keys. Which feature should be evaluated?

Choose the single best answer.

  1. A.TDE as the sole control
  2. B.Always Encrypted with appropriate client-side key separation
  3. C.Row-level security as a replacement for client-side column encryption
  4. D.Dynamic masking as the sole adversarial boundary
Show the answer and explanation

✓ Correct answer

  • Always Encrypted with appropriate client-side key separation

Always Encrypted separates supported column plaintext from the engine through client keys. TDE protects stored files. Masking does not provide a complete adversarial encryption boundary. Row-level security controls rows rather than keeping selected plaintext outside the engine.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.