easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: A company uses Azure SQL Database and needs to…
A company uses Azure SQL Database and needs to implement column-level encryption for a column containing social security numbers (SSNs). The encryption must use a customer-managed key stored in Azure Key Vault. The application queries this column using parameterized queries. Which technology should be used?
⚠ Common exam trap
Watch out — candidates often confuse Transparent Data Encryption (TDE) with column-level encryption, mistakenly believing TDE protects data from the database engine or privileged users, whereas TDE only protects data at rest on disk and does not prevent in-memory exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted with secure enclaves
Always Encrypted with secure enclaves is the correct choice because it enables client-side encryption of specific columns (like SSNs) using a customer-managed key stored in Azure Key Vault, while still allowing rich computations (e.g., equality, pattern matching) on the encrypted data within a secure enclave. This meets the requirement for column-level encryption with customer-managed keys and supports parameterized queries without exposing plaintext to the database engine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic Data Masking (DDM)
Why it's wrong here
Dynamic Data Masking (DDM) is a presentation-layer security feature that obfuscates sensitive data in query result sets based on a masking rule, but it does not alter or encrypt the underlying stored data. Because the original values remain in plaintext within database files, DDM provides no cryptographic protection against storage theft or memory dumps. Additionally, an authorized user with elevated permissions can often bypass masking or infer original values from patterns, so it cannot fulfill a column-level encryption requirement.
- ✗
Row-Level Security (RLS)
Why it's wrong here
Row-Level Security (RLS) filters the rows a given user can access at query execution time by evaluating a security predicate, but it does not encrypt individual column values. The data in restricted columns remains fully readable as plaintext to anyone who executes queries, and it lies unprotected in database backups and secondary replicas. RLS addresses authorization scope, not data confidentiality of specific columns, making it unsuitable for column-level encryption requirements.
- ✗
Transparent Data Encryption (TDE) with customer-managed keys
Why it's wrong here
Transparent Data Encryption (TDE) with customer-managed keys encrypts the entire database, transaction log, and backup files at rest, typically using AES-256, with the database encryption key protected by an asymmetric key stored in Azure Key Vault. However, TDE automatically decrypts data in memory for queries and protects only offline storage, not column-level confidentiality within a live database. Therefore it cannot satisfy a column-specific encryption requirement, even with customer-managed keys.
- ✓
Always Encrypted with secure enclaves
Why this is correct
Always Encrypted with secure enclaves is the correct solution because it provides true column-level encryption where plaintext values are never exposed to the Azure SQL Database engine. Client-side drivers encrypt data before transmission, and the database only sees ciphertext; secure enclaves (based on Intel SGX or Windows Virtualization-Based Security) enable confidential computing operations such as equality and pattern matching on encrypted columns without revealing plaintext to the engine. This accomplishes both at-rest and in-use column protection, which is exactly what the requirement asks for.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.