Selected columns should be decrypted only by authorized clients rather than exposed as plaintext to the ordinary database engine path. Which capability fits?

1. TDE alone as identical client-only decryption
2. A nonclustered index
3. Always Encrypted
4. A query timeout