A customer table holds names, addresses, order history, and Social Security numbers. Policy requires that only the SSN values be encrypted so other fields stay searchable for support staff. Which encryption level fits this requirement?

Database encryption can be applied at different granularities. Record- or field-level encryption protects specific values, such as a Social Security number column, so those values remain encrypted inside the database and are decrypted only for authorized queries or application functions. Other fields remain in plaintext and can be indexed and searched normally, satisfying the support team's needs while limiting exposure of the most sensitive data even to administrators or attackers who can query the tables. Full disk encryption protects the server's storage when it is powered off or a drive is removed, but once the system is running, the database engine reads data transparently, so anyone with query access sees SSNs in plaintext. Volume encryption has the same characteristic at the partition level; it protects against physical media theft, not against misuse through the database. Transport encryption protects data in transit between the application and the database server, which is valuable, but values are decrypted on arrival and stored without field-level protection. Exam caveat: the narrower the encryption scope, the more precisely it targets sensitive data, but key management and application changes become more complex. Operational check: confirm the SSN column is stored as ciphertext by querying it with a non-privileged account, verify keys are held outside the database, and log every decryption request.