DP-300 Implement a secure environment Practice Question
You are responsible for an Azure SQL Database that stores customer personally identifiable information (PII). You need to ensure that users with the 'CustomerService' role can see only the last four digits of Social Security numbers. Which feature should you use?
⚠ Common exam trap
Many exam-takers confuse Dynamic Data Masking with column-level permissions or Always Encrypted, mistakenly thinking that hiding the column entirely or encrypting it meets the requirement of showing a partial value, when in fact DDM is the only feature designed to expose a masked version of data without altering the underlying storage or access permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic Data Masking with a partial mask function
Dynamic Data Masking (DDM) with a partial mask function is the correct choice because it allows you to obfuscate sensitive data at query time without altering the underlying storage. For a Social Security number, you can apply a mask like 'partial(0, "XXX-XX-", 4)' to expose only the last four digits to users in the 'CustomerService' role, while the full value remains intact in the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Row-Level Security
Why it's wrong here
Controls rows, not columns.
- ✗
Column-level security with DENY permission on the column
Why it's wrong here
Denies access entirely, not partial.
- ✓
Dynamic Data Masking with a partial mask function
Why this is correct
Masks the column to show only last four digits.
- ✗
Always Encrypted with deterministic encryption
Why it's wrong here
Encrypts data, but does not mask partial values.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.