AZ-500 Secure compute, storage, and databases Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure Dynamic Data Masking (DDM) for the PII columns.

  Why this is correct

  Dynamic Data Masking (DDM) hides sensitive PII from non-privileged users by applying masking rules (e.g., email or credit-card patterns) at query runtime without altering the underlying data. It is a server/database-level security feature that can be enabled on specific columns, and privileged users can still see the full values. DDM does not protect data in transit or at rest—it only addresses unauthorized viewing by presenting masked values to certain principals.

• ✗

  Implement Always Encrypted for the PII columns.

  Why it's wrong here

  Always Encrypted is a client-side encryption feature where the database engine operates on ciphertext but never has the keys; it requires client driver support and can break legacy applications that don't support the feature. It cannot satisfy a server-level encrypt-in-transit requirement because it doesn't control the TLS handshake or connection security. Moreover, it limits queryability (e.g., equality checks only) and is not a substitute for forcing all connections to use TLS 1.2.

• ✓

  Set the 'Minimum TLS Version' to 1.2 on the Azure SQL Server.

  Why this is correct

  Setting Minimum TLS Version to 1.2 on the Azure SQL Server enforces that every client connection must use TLS 1.2 or later, rejecting connections using TLS 1.0 or 1.1. This directly satisfies the encrypt-in-transit requirement at the server level, covering all databases in that logical server. It's a server configuration in the Azure portal or via CLI/ARM, and it prevents legacy clients from establishing insecure plaintext or weaker-encrypted connections.

• ✓

  Enable Transparent Data Encryption (TDE) for the Azure SQL Database.

  Why this is correct

  Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the database data and log files, protecting data at rest using AES-256 encryption. Because it is transparent, no application changes are required; the database engine handles encryption as data is written to storage and decryption as it is read. TDE alone does not encrypt network traffic or mask results, so it must be combined with TLS enforcement and dynamic masking to meet the full set of requirements.

• ✗

  Apply Azure Information Protection labels to the database.

  Why it's wrong here

  Azure Information Protection (AIP) is an information-protection solution that applies classification labels and optional usage restrictions to documents/emails, not to an Azure SQL Database at rest or in transit. It does not change the database's connection security settings, nor does it mask or encrypt T-SQL result-set values. Enabling AIP labels on a database is not a supported mechanism to enforce TLS or protect PII within SQL tables; it merely adds metadata.

Go deeper

Related to this question