Quick Answer
The answer is Transparent Data Encryption (TDE). TDE performs real-time I/O encryption and decryption of the data and log files at the page level, protecting Azure SQL Database data at rest by ensuring that the underlying physical files cannot be read if the storage media is compromised. On the Microsoft Cybersecurity Architect exam, this concept tests your understanding of data-at-rest controls within the “Protect data at rest” domain, often appearing as a straightforward scenario where a company needs to secure database files from offline access. A common trap is confusing TDE with column-level encryption or Always Encrypted—remember that TDE encrypts the entire database at the storage layer, not individual columns. For a memory tip, think “TDE = Total Database Encryption,” meaning the whole database file is encrypted transparently to the application, requiring no changes to queries or schema.
This SC-100 practice question tests your understanding of recommend security best practices and priorities. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?
Azure Information Protection
Why wrong: AIP classifies and protects documents, not databases.
Transparent Data Encryption (TDE)
TDE encrypts SQL Server data files.
Azure Key Vault
Why wrong: Key Vault securely stores encryption keys but does not encrypt the database.
Azure Firewall
Why wrong: Firewall protects network traffic, not data at rest.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Transparent Data Encryption (TDE)
Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest in Azure SQL Database. This directly addresses the requirement to prevent unauthorized access to the underlying storage files, as TDE ensures that data cannot be read if the physical media is compromised.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Azure Information Protection
Why it's wrong here
AIP classifies and protects documents, not databases.
Transparent Data Encryption (TDE)
Why this is correct
TDE encrypts SQL Server data files.
Related concept
Read the scenario before looking for a memorised answer.
Azure Key Vault
Why it's wrong here
Key Vault securely stores encryption keys but does not encrypt the database.
Azure Firewall
Common exam traps
The trap here is that candidates often confuse Azure Information Protection (a classification tool) with database encryption, or think Azure Key Vault alone provides encryption, when in fact TDE is the specific feature that encrypts the database files at rest.
Detailed technical explanation
TDE in Azure SQL Database uses an AES-256 encryption algorithm to encrypt data at the page level as it is written to disk and decrypts it when read into memory, with the database encryption key (DEK) stored in the database boot record. The DEK is protected by a server-level certificate or asymmetric key, which in Azure SQL Database is automatically managed or can be stored in Azure Key Vault for bring-your-own-key (BYOK) scenarios. A real-world scenario where TDE is critical is meeting compliance requirements like PCI DSS or HIPAA, which mandate encryption of data at rest to protect against physical theft of storage media.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Recommend security best practices and priorities — study guide chapter
Learn the concepts, then practise the questions
Recommend security best practices and priorities practice questions
Targeted practice on this topic area only
All SC-100 questions
969 questions across all exam domains
Microsoft Cybersecurity Architect study guide
Full concept coverage aligned to exam objectives
SC-100 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SC-100 questions linked to Design solutions that align with security best practices and priorities.
Practise SC-100 questions linked to Design security operations, identity, and compliance capabilities.
Practise SC-100 questions linked to Design security solutions for infrastructure.
Practise SC-100 questions linked to Design a Zero Trust strategy and architecture.
Practise SC-100 questions linked to Design security solutions for applications and data.
Practise SC-100 questions linked to Evaluate GRC and security operations strategies.
Practise SC-100 questions linked to Design security for infrastructure.
Practise SC-100 questions linked to Design a strategy for data and applications.
Practise SC-100 questions linked to Recommend security best practices and priorities.
Practise SC-100 questions linked to SC-100 fundamentals.
Practise SC-100 questions linked to SC-100 scenario.
Practise SC-100 questions linked to SC-100 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Recommend security best practices and priorities — This question tests Recommend security best practices and priorities — Read the scenario before looking for a memorised answer..
The correct answer is: Transparent Data Encryption (TDE) — Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest in Azure SQL Database. This directly addresses the requirement to prevent unauthorized access to the underlying storage files, as TDE ensures that data cannot be read if the physical media is compromised.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.