The requirement says the stored values and query inputs must both be protected, and users must not be able to infer relationships or repetitions in the data from the encrypted output. Microsoft documents that deterministic encryption always produces the same ciphertext for the same plaintext , which allows equality comparisons but also leaks patterns. By contrast, randomized encryption produces a different encrypted value each time for the same plaintext, which improves security and prevents pattern analysis based on repeated ciphertext values.
That makes randomized encryption the right choice here:
* It protects data at rest and in transit/query parameters under Always Encrypted's client-side encryption model.
* It prevents attackers from learning that the same plaintext value appears repeatedly, because repeated inputs do not produce repeated ciphertext.
Why the other options are wrong:
* A. Always Encrypted with secure enclaves adds richer confidential query support, but the key protection property the question is testing is the encryption type. The requirement to prevent inference from repeated ciphertext points specifically to randomized encryption .
* C. RLS controls row access, not value confidentiality.
* D. Deterministic encryption allows equality-based operations but leaks repetition patterns, which the question explicitly forbids.