A reviewer treats dynamic data masking, Transparent Data Encryption, and Always Encrypted as interchangeable “SQL encryption.” Which distinction should you apply for the lock-lab database?
Select an answer to reveal the explanation.
Short Explanation
Three different tools, three jobs: masking hides what you see, TDE locks the files on disk, Always Encrypted keeps the column secret even from the engine. Don’t stir them into one “encryption” soup—and don’t mask a column you’re Already Encrypted.
Full Explanation
Treat the three controls as separate tools with separate threat models. Dynamic data masking obfuscates result sets for non-privileged callers; it does not encrypt files or backups. Transparent Data Encryption protects data files, log files, and backups at rest against stolen media and offline reads; authorized query principals still see plaintext. Always Encrypted keeps selected column values encrypted so the database engine (and typically DBAs without client keys) never sees plaintext; crypto runs in the client driver (or secure enclave scenarios for richer queries). Do not apply dynamic masking and Always Encrypted on the same column—the combination is unsupported or nonsensical for the exam’s teaching point. Using only masking because it supposedly “encrypts everything” confuses obfuscation with encryption. Replacing TDE with masking whenever auditors say “encryption at rest” fails the at-rest requirement. Exam caveat: you often need TDE plus selective Always Encrypted plus careful RBAC—stack by layer, not by renaming one feature as another. Operational check: for a pilot national-ID column, confirm TDE is on, enable Always Encrypted without a mask on that column, verify non-enclave unauthorized sessions cannot read plaintext, and keep masking only on other non-encrypted display fields such as email.