A city permits office must protect credit-card-on-file payment tokens in Azure SQL without treating full-disk encryption alone as sufficient. What should the developer implement?
Select an answer to reveal the explanation.
Short Explanation
TDE is the building’s locked front door; column-level encryption is the locked drawer for the payment tokens—permits staff still need both when card-on-file data is in play.
Full Explanation
Column-level encryption on payment-token columns, used together with platform encryption at rest, is the right design for a city permits office that refuses to treat full-disk or Transparent Data Encryption as sufficient for credit-card-on-file tokens. TDE or service-managed storage encryption closes the offline media threat, but privileged SQL sessions can still SELECT readable token values unless those columns are encrypted at the column layer—Always Encrypted or comparable column encryption—so the permits database never stores usable card-on-file material in plaintext for DBA or broad application roles.
Depending solely on TDE leaves tokens readable to privileged sessions after pages are unlocked for the engine, so it fails the stem’s “not sufficient alone” criterion by concept. Moving tokens into a public GraphQL field with anonymous access widens exposure to the internet and destroys confidentiality rather than adding a cryptographic control. Hashing tokens with a shared static salt hardcoded on every clerk workstation is weak cryptography, creates irrecoverable or collision-prone token handling for payment workflows, and scatters secrets across endpoints the permits team cannot rotate centrally.
Exam caveat: DP-800 security items often contrast storage encryption with column encryption. Choosing TDE is correct for encrypting data at rest, but wrong when the scenario demands protection from privileged query access. Likewise, hashing is not a substitute for reversible payment-token protection patterns that payment processors and vault integrations expect; if the business must present or refresh a token, irreversible hashing breaks the workflow.
Operational check: Inventory which permits tables hold card-on-file tokens, apply column encryption with keys held outside routine DBA sessions, and verify that a sysadmin query returns ciphertext while the payment client decrypts successfully. Keep TDE or service encryption enabled as defense in depth. Rotate column keys on a defined schedule, remove workstation-embedded salts, and confirm GraphQL or API projections never expose raw tokens to anonymous or overly broad roles.