DP-300 Plan and implement data platform resources Practice Question
You are managing an Azure SQL Database that hosts a customer relationship management (CRM) application. The database has a table named 'Contacts' with columns: ContactID (int, primary key), Name (nvarchar(100)), Email (nvarchar(200)), Phone (nvarchar(20)), and CreditLimit (decimal(18,2)). The compliance team requires that the CreditLimit column be encrypted so that only authorized users can view it. The application must be able to search for exact matches on CreditLimit values. You need to implement encryption without changing the application code significantly. Which encryption method should you use?
⚠ Common exam trap
It's easy for candidates to confuse Dynamic Data Masking with encryption, thinking masking satisfies compliance requirements, but masking is a presentation-layer feature that does not protect data from privileged users or direct database access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted with deterministic encryption
Always Encrypted with deterministic encryption is correct because it encrypts the CreditLimit column at the client driver level, ensuring data remains encrypted at rest and in transit, while still allowing exact-match searches (e.g., WHERE CreditLimit = 5000) since deterministic encryption always produces the same ciphertext for a given plaintext. This meets the compliance requirement without requiring significant application code changes, as the Azure SQL Database driver handles encryption and decryption transparently for authorized users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Always Encrypted with randomized encryption
Why it's wrong here
Randomized encryption prevents equality comparisons, so exact-match searches on CreditLimit fail; deterministic encryption is required for that. It tempts because randomized encryption hides patterns and suits columns never queried by value, such as free-text notes or card numbers retrieved only by primary key.
- ✓
Always Encrypted with deterministic encryption
Why this is correct
Deterministic encryption produces the same ciphertext for identical plaintext, enabling equality searches on CreditLimit through the Always Encrypted-enabled driver. Randomised encryption would block exact-match queries, and application code changes stay minimal since the driver handles encryption transparently.
- ✗
Transparent Data Encryption
Why it's wrong here
Transparent Data Encryption encrypts data and log files at rest, but the column remains plaintext to any query, so it cannot restrict CreditLimit visibility to authorised users. TDE suits protecting backups and files from media theft, not column-level access control.
- ✗
Dynamic Data Masking
Why it's wrong here
Dynamic Data Masking only obfuscates values in query results for unprivileged users; the underlying data stays plaintext, so it cannot satisfy a compliance requirement for encryption at rest, and masked columns still permit exact-match searches only on the unmasked value. It is intended for limiting incidental exposure in application UIs, not protecting stored data.
Go deeper
Related to this question
Learn chapter
Managing Identity and Access for Azure SQL
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
One of 574 original DP-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.