Using Azure SQL Database with Intel SGX enclaves (Always Encrypted) for sensitive data

SC-100 By islever Editorial Last updated

Design solutions for securing an organization's data

Short answer

D Azure SQL Database with Intel SGX enclaves gives hardware-based encryption, attestation, and enclave computations while hiding data from DBAs.

Question

You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database solution that meets the following requirements: • Minimizes the risks of malware that uses elevated privileges to access sensitive data • Prevents database administrators from accessing sensitive data • Enables pattern matching for server-side database operations • Supports Microsoft Azure Attestation • Uses hardware-based encryption What should you include in the recommendation?
  1. SQL Server on Azure Virtual Machines with virtualization-based security (VBS) enclaves
  2. Azure SQL Database with virtualization-based security (VBS) enclaves
  3. Azure SQL Managed Instance that has Always Encrypted configured
  4. Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves Correct Answer

Key Takeaways

Intel SGX enclaves provide hardware-based encryption, support Azure Attestation, allow rich computations (pattern matching) inside the enclave, and keep data invisible to DBAs; VBS enclaves do not meet the attestation/pattern-matching requirements the same way.

To migrate the SQL database with hardware-based encryption, prevent DBAs from seeing sensitive data, allow server-side pattern matching, and support Azure Attestation, use Azure SQL Database with Intel SGX enclaves (Always Encrypted with secure enclaves).

Common mistake: Choosing Always Encrypted without enclaves (C) — that blocks server-side pattern matching, which the scenario requires; SGX enclaves enable both.

Expert Analysis

Why the Answer Is Correct

Azure SQL Database with Intel SGX (software guard extensions) enclaves implements Always Encrypted with secure enclaves: the data is encrypted with hardware-based protection, database administrators cannot see plaintext, server-side operations such as pattern matching can run inside the enclave, and it supports Microsoft Azure Attestation — satisfying every requirement.

Why the Other Options Are Wrong

SQL Server on Azure VMs with VBS enclaves (A) and Azure SQL Database with VBS enclaves (B) use virtualization-based security enclaves, which do not provide the same Azure Attestation and pattern-matching characteristics the question specifies. Azure SQL Managed Instance with Always Encrypted but without enclaves (C) cannot perform server-side pattern matching.

Community Comment Notes

The community favored D (100 votes). Comments cite the Always Encrypted enclaves planning doc confirming SGX enclaves support Azure Attestation and enclave computations while hiding data from DBAs.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-enclaves-plan?view=azuresql

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Mick2024 👍 2 Answered D
    Wasn't familiar with this one before but it looks correct. https://learn.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-enclaves-plan?view=azuresql
  2. sweetykaur 👍 1 Answered D
    C. Azure SQL Managed Instance that has Always Encrypted configured Here's why: Minimizes the risks of malware: Always Encrypted ensures that sensitive data is encrypted both in transit and at rest, reducing the risk of unauthorized access. Prevents database administrators from accessing sensitive data: With Always Encrypted, even database administrators cannot access the plaintext data. Enables pattern matching for server-side database operations: Always Encrypted with secure enclaves supports rich queries, including pattern matching. Supports Microsoft Azure Attestation: Azure SQL Managed Instance supports Always Encrypted with secure enclaves, which can be attested using Microsoft Azure Attestation. Uses hardware-based encryption: Always Encrypted can use Intel Software Guard Extensions (Intel SGX) for hardware-based encryption
  3. RoboCock 👍 1 Answered D
    To meet these requirements, I recommend using Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves. This solution provides hardware-based encryption and supports Microsoft Azure Attestation. It also enables secure enclaves for server-side operations, such as pattern matching, while ensuring that sensitive data remains inaccessible to database administrators. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/configure-always-encrypted-enclaves?view=sql-server-ver16&viewFallbackFrom=azuresql
  4. Ali96 👍 1 Answered D
    D. Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide