CompTIA Data+ DA0-002 (V2) Practice Question

The most suitable technique is transparent data encryption (TDE) with keys stored in the cloud provider's key-management service. TDE encrypts every database and log file on disk as well as backups, so the data are protected at rest. Because the encryption and decryption happen automatically at the storage layer, applications continue to run the same SQL statements, and industry tests show only a small (roughly 2-4 %) performance impact, meeting the "minimal overhead" constraint.

Hashing primary keys safeguards only one column and is not reversible, leaving most sensitive data-and the database files themselves-in plaintext. Encrypting nightly CSV exports protects archival copies but leaves the live database files unencrypted, so it does not meet the requirement for continual encryption at rest. Requiring TLS 1.3 secures data in transit between clients and the database server but offers no protection for data stored on disk. Therefore, TDE is the only option that satisfies all stated goals.