AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?
⚠ Common exam trap
Many candidates confuse Transparent Data Encryption (TDE) with Always Encrypted because both involve encryption, but TDE does not protect data from database administrators or encrypt data in transit, which is the core requirement in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted
Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transparent Data Encryption (TDE)
Why it's wrong here
Transparent Data Encryption (TDE) encrypts the database files and backups at rest by performing real-time page-level I/O encryption, but when a query executes, the Database Engine automatically decrypts the data pages in the buffer pool before processing. Because the server process and any principal with access to the database master key or certificate can read plaintext data, TDE does not protect sensitive columns from database administrators who can connect to the database. It is essentially a safeguard against offline theft of physical files or backups, not against insiders with server-level privileges.
- ✓
Always Encrypted
Why this is correct
Always Encrypted encrypts sensitive columns at the client side, ensuring that the data is never exposed in plaintext to the server or DBAs. Only the client application with the column master key can decrypt the data.
- ✗
Dynamic Data Masking (DDM)
Why it's wrong here
Dynamic Data Masking (DDM) alters query results for unauthorized principals by applying masking functions to designated columns, but the underlying values remain stored as plaintext in database pages and transaction logs. Masking is a presentation-layer control only: users can sometimes infer masked values, perform blind writes, or bypass the masking if they connect using a privileged login or if the application runs with elevated permissions. Because DBAs with unmasking rights can see the actual stored data, DDM cannot protect sensitive columns from administrators.
- ✗
Row-Level Security (RLS)
Why it's wrong here
Row-Level Security (RLS) uses security predicates implemented as inline table-valued functions to filter which rows a principal can view, but it does not encrypt any data or restrict access to the underlying storage. Since the Database Engine enforces the predicate only during normal query execution, a database administrator with ALTER ANY SECURITY POLICY or db_owner can alter or disable the policy and see all rows. RLS is an authorization and row-filtering control, not a data confidentiality or encryption control, so it cannot prevent DBAs from reading sensitive values.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.