Northern Trail Outfitters (NTO) has recently purchased Marketing Cloud and wants to secure PII data...

Field-Level Encryption protects sensitive PII (such as SSNs, payment details, or other regulated data) by encrypting it at rest within the data extension field, but this security benefit comes with a documented functional trade-off: because the data is stored in encrypted form, it cannot be used as a condition in SQL Query Activities, Data Filters, or Decision Splits — encrypted fields cannot be segmented, filtered, or queried against. This is the critical architectural limitation a consultant must surface before recommending encryption for any field the business also intends to use for personalization logic or audience segmentation, since doing both on the same field is mutually exclusive. Option B is inaccurate; Field-Level Encryption is not restricted to list-based sending and applies at the data-extension field level regardless of the sending method used downstream. Option C incorrectly implies encryption keys are managed per business unit as a hard requirement — key management is an account-level consideration, not something mandated per BU by the feature itself. Option D is also incorrect; encrypted fields remain encrypted and masked in standard reporting and data views precisely because the encryption is meant to protect the data from unauthorized visibility, not selectively expose it in reports. Reference: Marketing Cloud Field-Level Encryption.