AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure SQL Database to store customer data, including credit card numbers. The security policy requires that database administrators (DBAs) must not be able to view the credit card numbers in plaintext. The column containing the credit card numbers must be encrypted at rest and in transit, and only a specific application (using a dedicated client library) should be able to decrypt the data. Which technology should they implement?
⚠ Common exam trap
Many exam-takers confuse Dynamic Data Masking (DDM) with encryption, not realizing that DDM only masks output and does not protect the underlying plaintext from privileged users or direct database access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted with a client-side encryption key stored in Azure Key Vault.
Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted on the client side before being sent to Azure SQL Database, and the encryption keys are never revealed to the database engine. This prevents DBAs or any server-side administrators from viewing the plaintext data, as decryption can only occur using the client-side encryption key stored in Azure Key Vault and accessed by the dedicated application library.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.
Why it's wrong here
TDE protects data at rest by encrypting database files, but it is transparent to the database engine: when a query is executed, SQL Server automatically decrypts the data in memory, so DBAs with SELECT access can still read plaintext credit card numbers. Even with a customer-managed key, the key is held by the service for automatic decryption, which does not prevent authorized DBAs from querying the data.
- ✗
Dynamic Data Masking (DDM) for the credit card column.
Why it's wrong here
Dynamic Data Masking is a presentation-layer feature that obscures column values in query results for users without UNMASK permission. However, the underlying credit card data is still stored as plaintext in the database, and any user with the UNMASK permission (including many DBAs) can view the original values. Since DDM does not encrypt the column at rest, it fails to protect sensitive data from users who can alter masking rules or access the storage layer.
- ✓
Always Encrypted with a client-side encryption key stored in Azure Key Vault.
Why this is correct
Correct. Always Encrypted encrypts the data on the client side, so the SQL Database never sees the plaintext. Only the client application with access to the encryption key can decrypt the data, preventing DBAs from viewing sensitive columns.
- ✗
Row-Level Security (RLS) to restrict DBA access to the credit card column.
Why it's wrong here
Row-Level Security restricts which rows a user can see based on a security predicate, but it operates entirely at the row-filtering level and does nothing to protect individual column values. A DBA with permissions to query the table can still see the plaintext credit card column for all rows that pass the predicate, and users with elevated roles like db_owner can often bypass or alter the security policy. RLS provides no encryption or column-level protection, so it cannot stop a DBA from reading the sensitive data.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.