thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Data & Analytics · Advanced

Always Encrypted

A SQL Server and Azure SQL feature that encrypts sensitive columns on the client so the database engine and DBAs never see plaintext.

Definition

Keys stay with the client application (column master keys in Azure Key Vault or a certificate store). Deterministic encryption allows equality lookups, and randomized encryption is stronger but limits queries. Secure enclaves allow richer operations on encrypted data.

Exam tip

If DBAs or cloud operators must not be able to read the data, choose Always Encrypted rather than TDE.

Related terms