The lock-lab app must equality-search on a hashed employee ID but must never support grouping on card numbers. Always Encrypted will protect both columns. What should you recommend?
Select an answer to reveal the explanation.
Short Explanation
Deterministic Always Encrypted is the equality-search flavor—same plaintext, same ciphertext, so JOINs work. Randomized is the “don’t even think about searching” flavor for card numbers. And don’t slap dynamic masking on those encrypted columns.
Full Explanation
Deterministic Always Encrypted produces the same ciphertext for the same plaintext and supports equality comparison, joins, and grouping on that basis. Randomized encryption is stronger against inference from ciphertext patterns but does not support those searchable operations. Official guidance advises against combining dynamic data masking with Always Encrypted on the same column. Secure enclaves can enable richer in-engine operations when required, but they do not erase the deterministic-versus-randomized trade-off for standard Always Encrypted.