DP-300 Implement a secure environment Practice Question
You are the DBA for a company that uses Azure SQL Database. You need to ensure that only authorized users can view sensitive columns (e.g., salary) in the Employees table. You want to obfuscate the data for certain users but allow full access to HR managers. Which feature should you use?
⚠ Common exam trap
Many candidates confuse Dynamic Data Masking with Always Encrypted, thinking that encryption is needed for obfuscation, but DDM is specifically designed for on-the-fly data masking without changing the underlying storage or requiring client-side changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic Data Masking
Dynamic Data Masking (DDM) is the correct choice because it obfuscates sensitive columns (e.g., salary) in query results for unauthorized users while allowing full visibility for authorized users like HR managers. DDM applies masking rules at the database level without modifying the underlying data, making it ideal for scenarios where you need to limit exposure of sensitive data to certain roles without changing the application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Always Encrypted
Why it's wrong here
Always Encrypted encrypts column data end-to-end so authorised HR managers cannot read plaintext either, and it requires client-side key access rather than role-based obfuscation. It is tempting because it is the correct choice when the requirement is protecting sensitive columns from database administrators and Azure itself.
- ✓
Dynamic Data Masking
Why this is correct
Dynamic Data Masking applies masking rules at query time, returning obfuscated values to unauthorised users while privileged roles such as HR managers see the underlying salary data. It satisfies the requirement to hide sensitive columns without altering stored data or application code.
- ✗
Row-Level Security (RLS)
Why it's wrong here
RLS filters rows, not columns.
- ✗
Transparent Data Encryption (TDE)
Why it's wrong here
TDE encrypts data at rest at the database file level, so every user with SELECT permission still sees plaintext salary values; it cannot obfuscate columns per user. It is tempting because TDE protects against stolen media, which is the right choice when the requirement is encryption at rest rather than column masking.
Go deeper
Related to this question
Learn chapter
Managing Identity and Access for Azure SQL
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
Courseiva writes every DP-300 question from scratch — 574 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.