Using Azure SQL Database with Intel SGX enclaves (Always Encrypted) for sensitive data

Design solutions for securing an organization's data

Answer Correct answer: D — Azure SQL Database with Intel SGX enclaves gives hardware-based encryption, attestation, and enclave computations while hiding data from DBAs.

You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database solution that meets the following requirements: • Minimizes the risks of malware that uses elevated privileges to access sensitive data • Prevents database administrators from accessing sensitive data • Enables pattern matching for server-side database operations • Supports Microsoft Azure Attestation • Uses hardware-based encryption What should you include in the recommendation?

SQL Server on Azure Virtual Machines with virtualization-based security (VBS) enclaves
Azure SQL Database with virtualization-based security (VBS) enclaves
Azure SQL Managed Instance that has Always Encrypted configured
Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves Correct Answer

azure sql intel sgx enclaves always encrypted secure enclaves azure attestation dba cannot see data

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Intel SGX enclaves provide hardware-based encryption, support Azure Attestation, allow rich computations (pattern matching) inside the enclave, and keep data invisible to DBAs; VBS enclaves do not meet the attestation/pattern-matching requirements the same way.

To migrate the SQL database with hardware-based encryption, prevent DBAs from seeing sensitive data, allow server-side pattern matching, and support Azure Attestation, use Azure SQL Database with Intel SGX enclaves (Always Encrypted with secure enclaves).

Choosing Always Encrypted without enclaves (C) — that blocks server-side pattern matching, which the scenario requires; SGX enclaves enable both.

Community Discussion (4 comments)

RoboCock 👍 1 Selected: D

To meet these requirements, I recommend using Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves. This solution provides hardware-based encryption and supports Microsoft Azure Attestation. It also enables secure enclaves for server-side operations, such as pattern matching, while ensuring that sensitive data remains inaccessible to database administrators. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/configure-always-encrypted-enclaves?view=sql-server-ver16&viewFallbackFrom=azuresql

sweetykaur 👍 1 Selected: D

C. Azure SQL Managed Instance that has Always Encrypted configured Here's why: Minimizes the risks of malware: Always Encrypted ensures that sensitive data is encrypted both in transit and at rest, reducing the risk of unauthorized access. Prevents database administrators from accessing sensitive data: With Always Encrypted, even database administrators cannot access the plaintext data. Enables pattern matching for server-side database operations: Always Encrypted with secure enclaves supports rich queries, including pattern matching. Supports Microsoft Azure Attestation: Azure SQL Managed Instance supports Always Encrypted with secure enclaves, which can be attested using Microsoft Azure Attestation. Uses hardware-based encryption: Always Encrypted can use Intel Software Guard Extensions (Intel SGX) for hardware-based encryption

Ali96 👍 1 Selected: D

D. Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves

Mick2024 👍 2 Selected: D

Wasn't familiar with this one before but it looks correct. https://learn.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-enclaves-plan?view=azuresql

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Azure SQL Database with Intel SGX (software guard extensions) enclaves implements Always Encrypted with secure enclaves: the data is encrypted with hardware-based protection, database administrators cannot see plaintext, server-side operations such as pattern matching can run inside the enclave, and it supports Microsoft Azure Attestation — satisfying every requirement.

Why the Other Options Are Wrong

SQL Server on Azure VMs with VBS enclaves (A) and Azure SQL Database with VBS enclaves (B) use virtualization-based security enclaves, which do not provide the same Azure Attestation and pattern-matching characteristics the question specifies. Azure SQL Managed Instance with Always Encrypted but without enclaves (C) cannot perform server-side pattern matching.

Community Comment Notes

The community favored D (100 votes). Comments cite the Always Encrypted enclaves planning doc confirming SGX enclaves support Azure Attestation and enclave computations while hiding data from DBAs.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-enclaves-plan?view=azuresql

Related Analysis

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide