AZ-500 Secure compute, storage, and databases Practice Question
Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?
⚠ Common exam trap
A common mix-up: candidates confuse Transparent Data Encryption (TDE) with Always Encrypted; TDE protects at rest but not from database administrators or during query processing, whereas Always Encrypted provides client-side encryption that prevents even the database engine from seeing plaintext data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Always Encrypted and store the column encryption key in Azure Key Vault
Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted at rest and remains encrypted throughout its lifecycle, including during query processing. By storing the column encryption key in Azure Key Vault, you separate key management from the database, preventing even database administrators from accessing plaintext data. Only authorized applications with access to the key can decrypt the data at the application layer, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault
Why it's wrong here
Transparent Data Encryption encrypts the database files, backups, and transaction logs at rest, but decryption happens automatically when data is read into memory, so every query executed by a principal with SELECT permission—including database administrators—returns plaintext. Storing the TDE protector in Azure Key Vault only centralizes key lifecycle management; it does not restrict who can read decrypted data inside the database. Therefore, TDE cannot prevent privileged database administrators from viewing sensitive column values.
- ✗
Use Dynamic Data Masking to mask the credit card column for non-privileged users
Why it's wrong here
Dynamic Data Masking is a presentation-layer feature that obfuscates column values in query results for non-privileged principals, but the underlying data remains stored as plaintext in data files and transaction logs. A user with the UNMASK permission or a sysadmin can issue a SELECT and still see the full credit card numbers. Because it is not a cryptographic control, Dynamic Data Masking does not prevent database administrators from accessing sensitive data at rest or in memory.
- ✗
Implement Azure SQL Database's Always Encrypted with enclaves
Why it's wrong here
Always Encrypted with secure enclaves extends Always Encrypted to allow the Azure SQL Database engine to perform computations such as pattern matching and comparison on encrypted columns. For enclave operations, the server's secure enclave receives the column encryption key and decrypts data inside enclave memory, meaning plaintext is no longer confined to the client application. It also still depends on client-side key management, but the decryption used for computations happens on the server. Therefore, if the requirement is application-layer decryption with the server never seeing plaintext, enclaves do not meet that requirement.
- ✓
Implement Always Encrypted and store the column encryption key in Azure Key Vault
Why this is correct
Always Encrypted is a client-side encryption technology that encrypts sensitive column data before it is sent to Azure SQL Database, so the database engine and its administrators never see plaintext. The application's driver uses the column encryption key (CEK) to encrypt and decrypt, while the CEK is wrapped by a column master key (CMK); storing the CMK in Azure Key Vault provides centralized, audited key management without exposing the CEK to the database server. Because only client applications possessing the necessary key material can decrypt the credit card values, database administrators and cloud operators are prevented from viewing the data.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.