easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Protect sensitive data in their Azure SQL…
A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?
⚠ Common exam trap
Watch out — candidates often confuse Azure Information Protection (a classification tool) with database encryption, or think Azure Key Vault alone provides encryption, when in fact TDE is the specific feature that encrypts the database files at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transparent Data Encryption (TDE)
Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest in Azure SQL Database. This directly addresses the requirement to prevent unauthorized access to the underlying storage files, as TDE ensures that data cannot be read if the physical media is compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Information Protection
Why it's wrong here
Azure Information Protection (AIP) classifies and labels documents and emails, applying persistent metadata and rights-management policies that travel with the file. Its encryption acts on content such as Office documents, not on the physical database files or tables of Azure SQL Database. Since AIP does not integrate with the SQL engine to encrypt data at rest, it leaves sensitive data within the database unprotected.
- ✓
Transparent Data Encryption (TDE)
Why this is correct
Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of Azure SQL Database data and transaction log files, protecting data at rest without requiring changes to the application. The database engine writes encrypted pages to disk and decrypts them when they are read into memory, making the process completely transparent to clients. This is the only option listed that directly secures the database's stored sensitive data.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is a cloud service for securely storing and managing cryptographic keys, secrets, and certificates, but it does not independently encrypt database files. In an Azure SQL environment, Key Vault can supply keys to TDE to enable bring-your-own-key (BYOK) scenarios, yet without TDE, Key Vault alone leaves data in the database unencrypted. Thus Key Vault serves as a key-management aid, not the primary data-protection mechanism.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed network security service that filters and logs traffic based on rules at the network layer, blocking malicious inbound and outbound connections. It cannot encrypt the contents of Azure SQL Database or alter how data is stored on disk, and it does not prevent authorized users from reading sensitive data. Therefore, while it helps secure the network perimeter, it fails to address the requirement for protecting data at rest inside the database.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.