Design security operations, identity, and compliance capabilities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your company is deploying a new line-of-business application in Azure that must comply with PCI DSS. The application uses Azure SQL Database. You need to design a solution to encrypt sensitive data at rest and in transit, and to audit access to sensitive columns. Which combination of Microsoft security capabilities should you recommend?
⚠ Common exam trap
Many exam-takers confuse Dynamic Data Masking with encryption, but masking does not protect data at rest or in transit and can be bypassed by privileged users, whereas Always Encrypted and TDE provide true encryption required by PCI DSS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing
Transparent Data Encryption (TDE) encrypts the SQL database at rest, Always Encrypted protects sensitive columns in transit and at rest by ensuring encryption keys are never exposed to the database engine, and Azure SQL Auditing logs all access to sensitive columns for compliance with PCI DSS requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic Data Masking and Azure SQL Firewall rules
Why it's wrong here
Dynamic Data Masking (DDM) obfuscates sensitive data in query results for non-privileged users, but it leaves the underlying data physically unencrypted in storage and in the transaction log. Azure SQL Firewall rules restrict network access to the logical server, preventing unauthorized connections, yet they do nothing to safeguard data at rest or in transit beyond TCP/IP filtering. Together, these controls address access and visibility but fail to provide the encryption of data at rest required by compliance mandates like GDPR or PCI DSS, so this combination is insufficient for a security posture demanding encryption.
- ✓
Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing
Why this is correct
Transparent Data Encryption (TDE) encrypts entire database files, backups, and transaction logs at rest using a database encryption key, protecting data at the storage layer. Always Encrypted goes further by encrypting sensitive columns with client-side keys so that database administrators and cloud operators see only ciphertext, ensuring data remains confidential even during queries. Azure SQL Auditing captures a trace of database events and queries, enabling compliance monitoring and forensic analysis of access to sensitive data. Together, these three technologies deliver encryption at rest, column-level encryption with key separation, and a clear audit trail, fully addressing typical enterprise data protection and compliance requirements.
- ✗
Azure Policy and Microsoft Defender for Cloud
Why it's wrong here
Azure Policy is a governance service that evaluates and enforces compliance rules on Azure resources, but it cannot actually encrypt data; it can only audit whether databases are configured to use encryption or deploy settings that rely on another feature. Microsoft Defender for Cloud provides threat detection, vulnerability assessment, and security posture management, yet it never transforms data at rest or in transit—it identifies weaknesses rather than remediating them cryptographically. While useful for monitoring and compliance oversight, this pairing lacks any mechanism to encrypt the database or its sensitive columns, so it does not satisfy the encryption requirement.
- ✗
Azure Storage Service Encryption and Azure Key Vault
Why it's wrong here
Azure Storage Service Encryption (SSE) automatically encrypts data before persisting to Azure Blob, File, Queue, or managed disk storage, but Azure SQL Database is a managed relational service that does not rely on standard Azure Storage accounts for its data files; SSE simply does not apply. Azure Key Vault is a centralized key management service that can securely store encryption keys, such as those for TDE or Always Encrypted, but by itself it performs no data encryption—it is a supporting actor, not the encryption mechanism. Using Key Vault alongside SSE would leave the SQL database unencrypted, as neither component directly protects the database engine's data files.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.