SC-100 · Question #250
You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database…
The correct answer is D. Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves. Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves satisfies all requirements. Intel SGX provides hardware-based trusted execution environments (TEEs), meaning encryption is rooted in silicon, not software - this eliminates the risk of malware using OS…
Question
You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database solution that meets the following requirements:
- Minimizes the risks of malware that uses elevated privileges to
access sensitive data
- Prevents database administrators from accessing sensitive data
- Enables pattern matching for server-side database operations
- Supports Microsoft Azure Attestation
- Uses hardware-based encryption
What should you include in the recommendation?
Options
- ASQL Server on Azure Virtual Machines with virtualization-based security (VBS) enclaves
- BAzure SQL Database with virtualization-based security (VBS) enclaves
- CAzure SQL Managed Instance that has Always Encrypted configured
- DAzure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves
How the community answered
(26 responses)- A4% (1)
- B23% (6)
- C8% (2)
- D65% (17)
Explanation
Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves satisfies all requirements. Intel SGX provides hardware-based trusted execution environments (TEEs), meaning encryption is rooted in silicon, not software - this eliminates the risk of malware using OS or hypervisor-level elevated privileges to access data inside the enclave. Always Encrypted with secure enclaves prevents DBAs from seeing plaintext data because decryption happens only inside the enclave. SGX enclaves support confidential queries including pattern matching (LIKE, range comparisons) directly on encrypted data server-side. Azure Attestation is natively supported for Intel SGX enclaves, allowing clients to cryptographically verify the enclave's integrity before sending keys. Option A and B use VBS (Virtualization-Based Security) enclaves, which are software-based, not hardware-based, and do not support Microsoft Azure Attestation in the same way. Option C (Azure SQL Managed Instance with Always Encrypted) without enclaves does not support server-side pattern matching on encrypted columns.
Topics
Community Discussion
No community discussion yet for this question.