Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Transparent Data Encryption (TDE) encrypts the entire database, its transaction logs, and all backups while the data is at rest. Because encryption and decryption occur transparently at the storage layer, no application or driver changes are required, and database administrators can still query data in plaintext. Always Encrypted would prevent administrators from seeing sensitive data and needs client-side driver changes. Dynamic Data Masking only obscures query results, leaving storage and backups unencrypted. Enforcing TLS protects data in transit but provides no encryption for database files or backups.