Question 810
An encryption team rotates a column master key but app clients still use outdated metadata. Which technical property or constraint MOST directly matters here?
Explanation
Correct Answer
Column key hierarchy and client metadata must agree for encrypted column access. This explains why the corrective action is to perform supported key rotation and client configuration changes as a coordinated migration. Confirm the diagnosis when authorized clients read/write after rotation and revoked keys no longer work.
Incorrect Answers
Randomized encryption does not support general plaintext pattern matching inside the engine. The actual technical constraint is that column key hierarchy and client metadata must agree for encrypted column access.
DDM changes what unauthorized queries display; it is not data encryption. The actual technical constraint is that column key hierarchy and client metadata must agree for encrypted column access.
Dynamic masking is evaluated at query output rather than permanently altering storage. The actual technical constraint is that column key hierarchy and client metadata must agree for encrypted column access.