A reviewer claims Transparent Data Encryption stops the lock-lab DBA from reading operator Social Security numbers with SELECT. Why is that claim wrong?
Select an answer to reveal the explanation.
Short Explanation
TDE is a lock on the disk platter, not a blindfold on the DBA. If you can query as an authorized user, you still see Social Security numbers in clear text—stolen drives are the nightmare TDE is built for.
Full Explanation
Transparent Data Encryption protects database files, transaction logs, and backups at rest. It does not prevent authorized principals, including DBAs, from reading plaintext through normal queries. Threats such as lost backup media or stolen storage are in scope for TDE; confidentiality from high-privilege query users requires controls such as Always Encrypted (and appropriate permissions). ADE on VM disks and TLS in transit are separate technologies.