Environmental Overrides would work for any configuration section as long as you provide design-time support for it since it relies on the ability to load config files using configuration nodes.
On your second question, I tried specifying a ProtectionProvider for the DAAB section and create an environment where I override it. It works fine, although you do need to open the resulting file and specify the ProtectionProvider if you want a specific
section like the DAAB to be encrypted.
Global Technology and Solutions