AZ-204 Implement Azure security Practice Question
A company uses Azure SQL Database and needs to encrypt sensitive columns (e.g., credit card numbers) at rest and in transit, with the ability to allow specific applications to decrypt. They want to manage encryption keys centrally in Azure Key Vault and avoid managing certificates. Which technology should they use?
⚠ Common exam trap
Many exam-takers confuse Transparent Data Encryption (TDE) with column-level encryption, assuming TDE's integration with Azure Key Vault provides the same granular control and in-transit protection as Always Encrypted, but TDE only protects data at rest and does not support client-side decryption control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted with column master key in Azure Key Vault.
Always Encrypted with a column master key stored in Azure Key Vault is the correct choice because it encrypts sensitive columns (like credit card numbers) at rest and in transit, ensuring data remains encrypted throughout the entire pipeline, including during query processing. The column master key in Azure Key Vault allows centralized key management without handling certificates, and only applications with access to the corresponding column encryption key can decrypt the data, meeting the requirement for application-specific decryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Always Encrypted with column master key in Azure Key Vault.
Why this is correct
Always Encrypted is a client-side encryption technology designed to protect sensitive data, ensuring it is encrypted before leaving the client application and remains encrypted while stored in the database. It uses column encryption keys, protected by a column master key stored securely in Azure Key Vault, to encrypt specific database columns. This approach ensures that sensitive data is never exposed in plaintext to the SQL Database engine or privileged users like database administrators, only being decrypted by authorized client applications.
- ✗
Transparent Data Encryption (TDE) with Azure Key Vault.
Why it's wrong here
Transparent Data Encryption (TDE) encrypts the entire database, including data files and log files, at rest on storage. While it protects against unauthorized access to the physical database files, the data is decrypted in memory for any user with database access. TDE does not provide column-level encryption, nor does it protect data in transit or from privileged users within the database system itself, making it unsuitable for protecting specific sensitive columns from database administrators.
- ✗
Dynamic Data Masking (DDM) with Azure Key Vault.
Why it's wrong here
Dynamic Data Masking (DDM) is a security feature that limits the exposure of sensitive data by masking it to non-privileged users without altering the data in the database. It presents a masked version of the data in the query results, but the underlying data remains unencrypted and fully visible to privileged users, such as database administrators. DDM is a presentation layer control, not an encryption mechanism, and therefore does not protect the actual sensitive data from being read or exfiltrated.
- ✗
Row-Level Security (RLS) with Azure Key Vault.
Why it's wrong here
Row-Level Security (RLS) enables customers to control access to rows in a database table based on the executing user's characteristics or context. It filters which rows a user can see, providing fine-grained access control. However, RLS does not encrypt the data itself; it merely restricts visibility to certain rows. If a user is authorized to see a row, they will see the plaintext data, meaning it does not address the requirement for encrypting sensitive data at rest or in transit.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.