City finance uses Always Encrypted on grant disbursement identifiers and needs to understand what remains protected when backups leave the primary region. Which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Always Encrypted stays locked in the suitcase—even when the backup flies to another region—until a trusted client brings the keys. The engine never unpacks those columns for you.
Full Explanation
Always Encrypted column values remain ciphertext in backups; plaintext requires authorized client-side keys outside the engine. For city finance grant disbursement identifiers protected with Always Encrypted, geo-replicated or regional backups copy the encrypted column data as stored—ciphertext—along with metadata. Restoring or failing over the database engine does not magically unwrap those values for a DBA; decryption still demands the column master/column encryption key material available to an authorized client driver. That is the durable protection model the stem asks you to recognize when backups leave the primary region.
Claiming geo-replicated backups automatically decrypt Always Encrypted columns for any DBA without client keys fails by concept and would defeat the control. Asserting that Transparent Data Encryption alone removes the need for Always Encrypted client trust confuses storage encryption with client-side column encryption; TDE keys unlock pages for the engine, not Always Encrypted cell values for arbitrary DBAs. Claiming that restoring to another server always reveals Always Encrypted values as plaintext nvarchar is incorrect—without client keys, authorized tools still see ciphertext.
Exam caveat: Protect both the database backup and the key store. If column master keys in Azure Key Vault or a certificate store are replicated or accessible too broadly, ciphertext in a remote backup can still be decrypted by an over-privileged client. Conversely, losing key access makes data unrestorable to plaintext for apps. Deterministic vs randomized encryption choices still apply after restore.
Operational check: Backup or geo-restore the finance database to a secondary environment without provisioning CEK access to DBAs; query disbursement identifier columns and confirm ciphertext. Then configure an authorized finance client with key access and confirm correct decryption. Document key custody across regions, restrict Key Vault RBAC, and include Always Encrypted key availability in disaster-recovery runbooks—not only database file restores.