Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Always Encrypted encrypts designated columns in the client driver before the data reaches Azure SQL Database. Because the encryption keys never leave the client application, the database engine, administrators, and Microsoft personnel cannot view the plaintext data. Using deterministic encryption allows the service to evaluate equality predicates, so existing queries such as WHERE Column = @value continue to work with little or no code change. Transparent Data Encryption protects files and backups on disk only, leaving data visible to anyone who can query the database. Dynamic Data Masking merely obfuscates query results and can be bypassed by privileged users. Row-level security restricts which rows a user can access but does not encrypt the data. Therefore, Always Encrypted with deterministic encryption is the only feature that meets every requirement.