Lock-operator national IDs and card numbers must stay hidden from DBAs and from the SQL engine itself, and TDE is already enabled. What should you recommend?
Select an answer to reveal the explanation.
Short Explanation
When even the DBA and the engine shouldn’t see the real national ID, that’s Always Encrypted territory. Keep TDE for the files; add Always Encrypted for the columns that must stay client-side secrets.
Full Explanation
Always Encrypted is recommended when column values must remain confidential from high-privilege server users and from the database engine, with encryption and decryption performed in a supporting client driver. It layers with TDE rather than replacing it. Dynamic data masking does not stop privileged users with UNMASK or dbo from seeing plaintext. Secure enclaves extend Always Encrypted when richer computations must occur inside a trusted enclave.