A reviewer treats dynamic data masking, Transparent Data Encryption, and Always Encrypted as interchangeable “SQL encryption.” Which distinction should you apply for the lock-lab database?
Select an answer to reveal the explanation.
Short Explanation
Three different tools, three jobs: masking hides what you see, TDE locks the files on disk, Always Encrypted keeps the column secret even from the engine. Don’t stir them into one “encryption” soup—and don’t mask a column you’re Already Encrypted.
Full Explanation
Dynamic data masking obfuscates displayed results. Transparent Data Encryption protects data files, logs, and backups at rest while authorized queries still return plaintext. Always Encrypted keeps column plaintext in the client driver so the database engine and many high-privilege users never see it. Official guidance is not to combine dynamic masking with Always Encrypted on the same column. Choosing among these controls is an AZ-500 data-protection skill, not interchangeable branding.