AZ-305 Design data storage solutions Practice Question
A company is designing a data lake for analytics. The data includes personally identifiable information (PII) that must be anonymized before analysts access it. Which Azure service should they use to automate the anonymization process?
⚠ Common exam trap
Many exam-takers confuse Azure SQL Database dynamic data masking (Option B) with a general-purpose anonymization solution, but it only works for relational databases, not for data lakes, and does not automate the process across heterogeneous file formats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview data policies
Microsoft Purview data policies allow you to define and enforce data access policies that can automatically anonymize or mask sensitive data, such as PII, when accessed by analysts. This service integrates with Azure data lake storage and provides a centralized way to manage data governance and compliance, making it the correct choice for automating anonymization in a data lake scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy applies governance rules that enforce or deny resource configurations—such as requiring encryption, restricting locations, or tagging resources—across an Azure environment. It does not inspect or transform data content, so it cannot locate sensitive columns in a data lake or apply anonymization or masking to the data itself. While policy can enforce that a classification tool is used, it is not the mechanism that discovers and masks sensitive data.
- ✗
Azure SQL Database dynamic data masking
Why it's wrong here
Azure SQL Database dynamic data masking is a security feature for relational database tables, where masking rules are defined on specific columns and applied transparently to non-privileged users at query time. It requires a structured schema and only works within Azure SQL Database, SQL Managed Instance, or dedicated SQL pools. A data lake typically stores unstructured or semi-structured files (Parquet, JSON, CSV) that do not support column-level masking in this way, so it is unsuitable for masking data across a data lake.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is a centralized cloud service for storing and managing secrets, encryption keys, and certificates used to protect data at rest or in transit. It handles key lifecycle and access control but has no awareness of the data's content or sensitivity—it cannot classify files, redact values, or apply masking to data stored in a data lake. Key Vault is a prerequisite for encryption but not a tool for anonymizing or masking the data itself.
- ✓
Microsoft Purview data policies
Why this is correct
Microsoft Purview data policies, which include data owner policies and Microsoft Purview access policies, can automatically classify sensitive data across sources like Azure Data Lake Storage and then enforce policies such as masking (column-level or file-level) or access control based on that classification. For a data lake, Purview's scanning engines discover sensitive data using built-in or custom classifiers, and data policies can apply masking to read operations or restrict access to certain users. This makes it the correct choice for a unified, policy-driven approach to protecting sensitive data in a data lake analytics scenario.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.