You have an Azure SQL database. You implement Always Encrypted. You need to ensure that application developers can retrieve and decrypt data in the database. Which two pieces of information should…

Question

Options

• Aa stored access policy
• Ba shared access signature (SAS)
• Cthe column encryption key
• Duser credentials
• Ethe column master key

• A
  8% (4)
• B
  14% (7)
• C
  75% (38)
• D
  4% (2)

Explanation

Always Encrypted: Key Information for Developers

Always Encrypted uses a two-key hierarchy: the Column Master Key (CMK) acts as the top-level key that protects the Column Encryption Key (CEK), while the Column Encryption Key (CEK) is the key that actually encrypts the column data - developers need both to decrypt data in their applications, making C and E correct. The CMK is typically stored in a trusted key store (like Azure Key Vault or Windows Certificate Store), and the CEK is stored encrypted within the database itself; without access to both, the client-side driver cannot perform decryption transparently.

Why the distractors are wrong:

• A (Stored access policy) and B (SAS token) are Azure Blob Storage/Queue concepts used for resource access authorization, not relevant to Always Encrypted decryption
• D (User credentials) control database access (authentication/authorization) but do not enable data decryption - Always Encrypted decryption happens client-side, independent of SQL credentials

Memory Tip: Think of Always Encrypted like a locked safe inside a locked room - the CMK is the room key (master protection) and the CEK is the safe key (actual data lock). Developers need both keys to get to the data, not just login credentials or storage tokens.

No community discussion yet for this question.