DP-300 Implement a secure environment Practice Question
You are responsible for securing an Azure SQL Database. You need to implement data masking for a column that contains credit card numbers, ensuring that users with the db_datareader role see a masked version. However, users with the db_owner role should see the unmasked data. What should you configure?
⚠ Common exam trap
Many candidates confuse Dynamic Data Masking with Always Encrypted, thinking both provide role-based visibility, but Always Encrypted requires key management and does not support partial masking or role-based exemption without separate keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply Dynamic Data Masking (DDM) to the credit card column.
Dynamic Data Masking (DDM) is the correct choice because it allows you to obfuscate sensitive data in query results for non-privileged users (like db_datareader) while permitting users with elevated permissions (like db_owner) to see the unmasked data. DDM is applied at the column level and does not modify the underlying data; it simply masks the output based on the user's permissions. The db_owner role is exempt from masking by default, meeting the requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply Dynamic Data Masking (DDM) to the credit card column.
Why this is correct
Dynamic Data Masking applies masking at query time based on the caller's permissions, so db_datareader users receive masked credit card values while db_owner users, who are excluded from masking, still see the full unmasked data. No data is altered at rest.
- ✗
Implement Row-Level Security (RLS) to filter rows based on user role.
Why it's wrong here
Row-Level Security filters which rows a query returns; it cannot substitute masked values within a column while leaving others unmasked. It is tempting because RLS is role-based, but it suits restricting tenants to their own records, whereas Dynamic Data Masking with an UNMASK grant handles this column requirement.
- ✗
Implement Always Encrypted with deterministic encryption.
Why it's wrong here
Always Encrypted with deterministic encryption protects data at rest and in transit by encrypting the column, so db_datareader users would see ciphertext, not a masked format, and db_owner would need the column encryption key to decrypt. Dynamic data masking is the correct feature for role-based masking. Always Encrypted suits scenarios requiring cryptographic separation between database administrators and data owners.
- ✗
Enable Transparent Data Encryption (TDE).
Why it's wrong here
Transparent Data Encryption encrypts data and log files at rest, so authorised queries still return plaintext credit card numbers to any reader. It is tempting as a compliance checkbox, but it suits protecting backups and files from theft, not masking values from db_datareader users.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
Courseiva writes every DP-300 question from scratch — 574 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.