Exam DP-300 topic 2 question 35 discussion

Always Encrypted with secure enclaves addresses these limitations by allowing some computations on plaintext data inside a secure enclave on the server side. A secure enclave is a protected region of memory within the Database Engine process. The secure enclave appears as an opaque box to the rest of the Database Engine and other processes on the hosting machine. There's no way to view any data or code inside the enclave from the outside, even with a debugger. These properties make the secure enclave a trusted execution environment that can safely access cryptographic keys and sensitive data in plaintext, without compromising data confidentiality.

Always Encrypted supports deterministic only for operator comparisons. AE with secure enclaves addresses this limitation. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-enclaves?view=sql-server-ver16

The correct answer is A. Always Encrypted with secure enclaves. Transparent Data Encryption (TDE) is a feature that encrypts data at rest, specifically the physical files that store the data. It does not encrypt data in motion or provide randomized encryption. TDE also does not support comparison operators on encrypted data. Therefore, it does not meet all the requirements stated in your question.