SC-100 Certification Practice Question #227

Question

You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1.

You plan to migrate DB1 to Azure.

You need to recommend an encrypted Azure database solution that meets the following requirements:

•	Minimizes the risks of malware that uses elevated privileges to access sensitive data
•	Prevents database administrators from accessing sensitive data
•	Enables pattern matching for server-side database operations
•	Supports Microsoft Azure Attestation
•	Uses hardware-based encryption

What should you include in the recommendation?

Accepted Answer

The five requirements are an exact fingerprint of Always Encrypted with **Intel SGX** secure enclaves on Azure SQL Database: hardware-based trusted execution environment (hardware encryption), enclaves let the engine compute on plaintext inside the protected enclave so rich queries including LIKE/pattern matching work server-side, the keys never leave the client so DBAs and elevated-privilege malware can't see plaintext, and SGX in DC-series databases makes Microsoft Azure Attestation mandatory. VBS enclaves (options A and B) are software-only with no special hardware and explicitly do not support attestation, so they fail the "hardware-based encryption" and "Supports Microsoft Azure Attestation" requirements. Option C (Managed Instance with Always Encrypted but no enclaves) cannot do server-side pattern matching. Suggested Answer, Most Voted (8), and MS Learn all converge on D.

More SC-100 practice questions