Selected SQL columns must remain encrypted from the perspective of the database engine, with decryption by authorized clients. Which capability should be evaluated?

1. Always Encrypted
2. A firewall rule alone
3. Dynamic data masking as equivalent cryptographic protection
4. TDE alone as the same client-side boundary