A design must prevent the database engine administrator from seeing selected plaintext columns during ordinary processing, with decryption handled by authorized clients. Which capability should be evaluated?

1. Dynamic masking alone
2. TDE alone
3. Always Encrypted with appropriate client and key management
4. A database index