How do you implement envelope encryption for a database column using Key Vault?

1. A Store plaintext in Key Vault and reference it
2. ✓ B Store a data encryption key (DEK) encrypted by a Key Vault key (KEK); use DEK locally for encryption (correct answer)
3. C Store the database connection string as a secret
4. D Use Key Vault's built-in column encryption feature

Shortcut: Envelope encryption: generate a DEK locally, encrypt the DEK with a Key Vault key (KEK), store encrypted DEK. For encryption, decrypt DEK using Key Vault, then use DEK locally. Minimizes Key Vault calls.