hardMultiple SelectObjective-mapped
Implementing Column-Level Security in Azure Synapse Dedicated SQL Pool
A company uses Azure Synapse Analytics with a dedicated SQL pool. Data engineers need to implement column-level security so that only users with the 'Manager' role can see salary columns. Which TWO actions should they take?
Quick Answer
The stored procedure approach works because Azure Synapse dedicated SQL pool has no native mechanism for restricting access to individual columns, so there is no equivalent of granting SELECT on a single column the way some other database engines allow. Because that native path does not exist, security has to be built at the application layer instead: a stored procedure can check the calling user's role and then decide, in its own logic, which columns to include in the result set it returns. Anyone without the Manager role simply never receives the salary column in the output, even though the underlying table still contains it. This distinguishes the correct approach from what looks like the obvious answer, issuing a GRANT SELECT on a specific column, which will actually fail with an error in dedicated SQL pool because that granularity of permission is not supported there. It is also worth separating this from row-level security, which controls which rows a user can see rather than which columns are visible; the two solve different problems using different mechanisms. When you see a Synapse dedicated SQL pool question asking how to hide specific columns from certain roles, remember that the platform pushes you toward procedural, application-level enforcement rather than a built-in column permission grant.
⚠ Common exam trap
Candidates often confuse column-level security with row-level security. Column-level security in Azure Synapse dedicated SQL pool can be implemented via stored procedures (Option A), while security policies with filter predicates are for row-level security. GRANT on columns is not a valid approach in dedicated SQL pool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a stored procedure that checks the user's role and returns the appropriate columns.
To implement column-level security in Azure Synapse Analytics dedicated SQL pool, a valid approach is to create a stored procedure that checks the user's role and returns only permitted columns, as dedicated SQL pool does not support column-level GRANT permissions or native column-level security. GRANT SELECT on a specific column (Option E) is not supported in dedicated SQL pool and will result in an error. Options C and D describe components of row-level security, not column-level security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a stored procedure that checks the user's role and returns the appropriate columns.
Why this is correct
Correct. Creating a stored procedure that checks the user's role and returns only the allowed columns is a valid way to implement column-level security at the application level.
- ✗
Grant the 'Manager' role SELECT permission on the security policy.
Why it's wrong here
Incorrect. Granting SELECT permission on a security policy is not applicable; security policies are used for row-level security, not column-level.
- ✗
Create a security policy with a filter predicate on the salary column using the function, and set the state to ON with BLOCK predicate.
Why it's wrong here
Incorrect. This describes row-level security using a security policy with a filter predicate, which filters rows, not columns.
- ✗
Create an inline table-valued function that returns 1 if the user is a member of the 'Manager' role, else 0.
Why it's wrong here
Incorrect. This describes the predicate function for row-level security, not column-level security.
- ✗
Use GRANT SELECT ON OBJECT::[dbo].[Employee](Salary) TO [Manager] to grant access to the salary column.
Why it's wrong here
GRANT SELECT on a specific column is not supported in Azure Synapse dedicated SQL pool.
Go deeper
Related to this question
Learn chapter
Introduction to Azure Data Engineering
Key term
Azure Synapse Analytics
Azure Synapse Analytics is a cloud-based data integration, warehousing, and analytics service that brings together big data and data warehouse capabilities under one platform.
Key term
Column-Level Security
Column-Level Security is a database feature that restricts access to specific columns in a table, allowing only authorized users to see sensitive data within those columns.
About these practice questions
Courseiva writes every DP-203 question from scratch — 760 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-203
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Azure Synapse Analytics with dedicated SQL pools. They need to allow a data scientist to read all tables in the 'sales' schema but prevent access to columns containing personally identifiable information (PII). Which feature should be used?
medium- A.Dynamic data masking
- B.Row-level security
- ✓ C.Column-level security
- D.Azure Active Directory authentication
Why C: Column-level security (C) is the correct choice because it allows you to restrict access to specific columns in a table, such as PII columns, while granting read access to all other columns in the 'sales' schema. This is achieved by defining a GRANT SELECT statement on the table with a column list, or by using a security policy with a filter predicate that blocks access to sensitive columns. Unlike Dynamic Data Masking, which obfuscates data at query time but does not prevent the user from seeing the masked values in certain scenarios, Column-level security actually denies access to the specified columns entirely.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.