Exam AZ-304 topic 10 question 1 discussion

Seems correct, as randomized encryption would not allow for grouping/joining of data https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver15#selecting--deterministic-or-randomized-encryption

It is correct. and speedminer is got the right link: "Deterministic encryption always generates the same encrypted value for any given plain text value. Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns. However, it may also allow unauthorized users to guess information about encrypted values by examining patterns in the encrypted column, especially if there's a small set of possible encrypted values, such as True/False, or North/South/East/West region. Deterministic encryption must use a column collation with a binary2 sort order for character columns. Randomized encryption uses a method that encrypts data in a less predictable manner. Randomized encryption is more secure, but prevents searching, grouping, indexing, and joining on encrypted columns."

A is correct. https://www.azureblue.io/always-encrypted-deterministic-vs-randomized/

came in Exam March-2022 passed w 883

https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver15#selecting--deterministic-or-randomized-encryption Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns. A is the answer

came in exam on 20-sep-21, I passed, I choose given one

Correct https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver15

Correct Answer A "Use deterministic encryption for columns that will be used as search or grouping parameters. For example, a government ID number. Use randomized encryption for data such as confidential investigation comments, which aren't grouped with other records and aren't used to join tables. " https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver15

Correct Requirement: "Payment processing system must be able to use grouping and joining tables on encrypted columns." Deterministic Encryption: I think that the deterministic encryption type is somewhat similar to the way hashing algorithms work. This method always generates the same encrypted value for any given plaintext value. This means if we would encrypt a boolean column holding only true values the encrypted payload would be the same for each of the values. This method allows grouping, filtering by equality and joining tables based on encrypted values, but could also allow a malicious user to guess information by examining patterns and then deduce the plain-text value. https://www.azureblue.io/always-encrypted-deterministic-vs-randomized/

Correct

TDE does not encrypt data on transit

from: "Only the front-end and middle-tier components must be able to access the encryption keys that protect the data store." and the ask to minimize the changes to the middle tier & backend tier , would trend to TDE with BYOC : https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview

I believe it a correct Answer.