Match each Azure SQL Database security feature to its purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Encrypts data at rest
Encrypts sensitive data in transit and at rest
Limits exposure of sensitive data by masking it to non-privileged users
Restricts access to rows based on user characteristics
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Transparent Data Encryption (TDE): Encrypts data at rest
TDE protects data at rest by encrypting the database files. Always Encrypted protects data in use by encrypting on the client side. Dynamic Data Masking hides sensitive data in query results from unauthorized users. Common confusions involve mixing up TDE and Always Encrypted.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Transparent Data Encryption (TDE): Encrypts data at rest
Why this is correct
TDE encrypts the database files on disk, protecting data at rest.
Always Encrypted: Encrypts data in use on client side
Why this is correct
Always Encrypted encrypts sensitive data on the client side and never reveals the encryption keys to the database engine.
Dynamic Data Masking: Masks sensitive data in query results
Why this is correct
Dynamic Data Masking obfuscates sensitive data in query results for non-privileged users.
Transparent Data Encryption (TDE): Encrypts data in use on client side
Why it's wrong here
Incorrect — TDE encrypts data at rest, not in use. This definition describes Always Encrypted.
Always Encrypted: Encrypts data at rest
Why it's wrong here
Incorrect — Always Encrypted encrypts data in use on the client side, not at rest. This definition describes TDE.
Go deeper
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
Key term
Transparent Data Encryption
Transparent Data Encryption is a security feature that automatically encrypts data written to a database and decrypts it when read, without requiring any changes to the application.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.