SQL Server – Is Individual Column and Row-Level Encryption Possible

TDE will add a little extra CPU cost to the server but that's marginal on current CPUs. It will however only protect the data at rest, but that's including backups of the databases.

It's fully compatible with failover clustering and AlwaysOn but you have to make sure that all nodes in AlwaysOn are configured correctly (https://curah.microsoft.com/282935/how-to-configure-always-on-for-a-sql-server-tde-database)

I would say that it's more practical than trying to use Bitlocker or similar techonologies.

There are five types of keys in the heirarchy of any SQL Server column encryption. They are service master key, database master key, asymmetric key, certificate and symmetric key. SQL Server contains commands to back up the service master key, database master key and the certificate with the private key to separate password protected files. If you want to have something to preserve an asymmetric key, you can create one from a strong named key file (.snk) that already contains the key pair and save that. For the symmetric key, you will need to create it from a command, specify the key_source and identity_value and save those two values in your Vault. IF you create symmetric and asymmetric keys without saving the inputs, then you will not be able to export them. If you want to learn more about another method of securing the keys, I suggest reading about Extensible Key Management systems, which is a SQL Server enterprise edition feature. An EKM is a separate piece of hardware designed to hold the keys and perform the encryption and decryption functions.