Quick Answer
The answer is Always Encrypted with secure enclaves. This feature is the correct choice because it encrypts sensitive columns like SSN both at rest and in memory, ensuring that decryption occurs exclusively on the client side using keys that the database engine never sees, so only authorized users with the proper keys can decrypt data at query time. On the DP-203 exam, this scenario tests your understanding of column-level encryption versus other options like Transparent Data Encryption or dynamic data masking; a common trap is choosing TDE, which encrypts the entire database but does not protect data from database administrators or during query processing. Remember the key distinction: Always Encrypted keeps encryption keys away from the database engine entirely, while secure enclaves allow richer computations on encrypted data. A useful memory tip is “client-side keys, column-level control”—if the requirement specifies per-column protection with client-managed keys, Always Encrypted is your answer.
This DP-203 practice question tests your understanding of design and implement data storage. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A healthcare organization stores patient data in Azure SQL Database. They need to encrypt sensitive columns (e.g., SSN) such that only authorized users can decrypt the data at query time. Which feature should they use?
Transparent Data Encryption (TDE)
Why wrong: Encrypts entire database, not column-level.
Azure Information Protection labels
Why wrong: Classification, not encryption at column level.
Always Encrypted (with secure enclaves)
Column-level encryption, decrypted on the client.
Dynamic Data Masking
Why wrong: Masks data but does not encrypt; can be bypassed.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Always Encrypted (with secure enclaves)
Always Encrypted with secure enclaves is the correct choice because it allows sensitive columns (e.g., SSN) to be encrypted at rest and in memory, with decryption occurring only on the client side using keys that are never exposed to the database engine. This ensures that only authorized users with the proper encryption keys can decrypt the data at query time, meeting the requirement for column-level encryption with client-side key management.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Transparent Data Encryption (TDE)
Why it's wrong here
Encrypts entire database, not column-level.
Azure Information Protection labels
Why it's wrong here
Classification, not encryption at column level.
Always Encrypted (with secure enclaves)
Why this is correct
Column-level encryption, decrypted on the client.
Related concept
Read the scenario before looking for a memorised answer.
Dynamic Data Masking
Why it's wrong here
Masks data but does not encrypt; can be bypassed.
Common exam traps
The trap here is that candidates often confuse Transparent Data Encryption (TDE) with column-level encryption, mistakenly thinking TDE protects individual columns at query time, when in fact TDE only encrypts data at rest and does not control who can decrypt data during queries.
Detailed technical explanation
Always Encrypted with secure enclaves leverages hardware-based trusted execution environments (e.g., Intel SGX) to perform computations on encrypted data inside the enclave, enabling richer operations like pattern matching and sorting without exposing plaintext to the database engine. The encryption keys are stored in Azure Key Vault or Windows Certificate Store, and the client driver (e.g., .NET Framework 4.6+) handles encryption/decryption transparently. A real-world scenario is a healthcare application where a doctor needs to query patient SSNs; the database never sees the plaintext SSN, and the enclave ensures that even the database administrator cannot access the sensitive data.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design and implement data storage — study guide chapter
Learn the concepts, then practise the questions
Design and implement data storage practice questions
Targeted practice on this topic area only
All DP-203 questions
846 questions across all exam domains
Microsoft Azure Data Engineer Associate DP-203 study guide
Full concept coverage aligned to exam objectives
DP-203 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise DP-203 questions linked to Secure, monitor, and optimize data storage and data processing.
Practise DP-203 questions linked to Design and develop data processing.
Practise DP-203 questions linked to Design and implement data security.
Practise DP-203 questions linked to Monitor and optimize data storage and processing.
Practise DP-203 questions linked to Design and implement data storage.
Practise DP-203 questions linked to Develop data processing.
Practise DP-203 questions linked to DP-203 fundamentals.
Practise DP-203 questions linked to DP-203 scenario.
Practise DP-203 questions linked to DP-203 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Design and implement data storage — This question tests Design and implement data storage — Read the scenario before looking for a memorised answer..
The correct answer is: Always Encrypted (with secure enclaves) — Always Encrypted with secure enclaves is the correct choice because it allows sensitive columns (e.g., SSN) to be encrypted at rest and in memory, with decryption occurring only on the client side using keys that are never exposed to the database engine. This ensures that only authorized users with the proper encryption keys can decrypt the data at query time, meeting the requirement for column-level encryption with client-side key management.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.