Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Always Encrypted encrypts selected columns with keys that are never revealed to the database engine. Because encryption and decryption occur only inside the client application, high-privilege roles such as Azure SQL Database administrators, VM administrators, or anyone with direct access to the database files or memory can see only ciphertext. Transparent Data Encryption protects data at rest but allows the engine (and privileged users) to view plaintext while queries run. Dynamic Data Masking hides data only in query results and is easily bypassed by privileged accounts. Row-level security restricts which rows a user can read but does not encrypt the data. Therefore, Always Encrypted is the only feature that satisfies the stated requirement.