Question

A healthcare application stores patient Social Security numbers and salary values in an Azure SQL Database. Compliance requires that these columns remain encrypted at all times, including in memory during query processing, and that the database engine never has access to the plaintext encryption keys. However, analysts must run range queries (for example, WHERE Salary BETWEEN 50000 AND 90000) directly against the encrypted salary column without decrypting the data on the client first. Which configuration meets all of these requirements?

Accepted Answer

Enable Always Encrypted with secure enclaves (VBS enclaves) using randomized encryption, and configure enclave-enabled column encryption keys.

Answer

Enable Always Encrypted with randomized encryption on both columns and perform filtering in the client application after decryption.

Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.

Answer

Enable Always Encrypted with deterministic encryption on both columns to allow equality and range comparisons.