Exam DP-420 topic 5 question 21 discussion

HOTSPOT -
You have a container named container1 in an Azure Cosmos DB Core (SQL) API account named account1.
You configure container1 to use Always Encrypted by using an encryption policy as shown in the C# and the Java exhibits. (Click the C# tab to view the encryption policy in C#.

Click the Java tab to see the encryption policy in Java.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Suggested Answer:
Box 1: No -
The creditcard property uses randomized encryption.
Randomized encryption is more secure, but prevents queries from filtering on encrypted properties.

Box 2: Yes -
The SSN property uses deterministic encryption.
Using deterministic encryption allows queries to perform equality filters on encrypted properties.

Box 3: Yes -
Reading documents when only a subset of properties can be decrypted.
In situations where the client does not have access to all the CMK used to encrypt properties, only a subset of properties can be decrypted when data is read back. For example, if property1 was encrypted with key1 and property2 was encrypted with key2, a client application that only has access to key1 can still read data, but not property2. In such a case, you must read your data through SQL queries and project away the properties that the client can't decrypt: SELECT c.property1, c.property3 FROM c.
Reference:
https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-always-encrypted