DP-300 Implement a secure environment Practice Question
You have an Azure SQL Database that stores personally identifiable information (PII). You need to classify and label the sensitive columns using Microsoft Purview. Additionally, you want to automatically mask these columns for a specific application user. Which two actions should you take? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse Dynamic Data Masking with Always Encrypted or TDE, thinking any encryption feature can mask data for specific users, but DDM is the only option that provides user-specific obfuscation without altering the underlying data or requiring application changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply Dynamic Data Masking (DDM) rules to mask the classified columns for the application user.
Dynamic Data Masking (DDM) can be applied to classified columns to obfuscate sensitive data for a specific application user without altering the underlying data. DDM rules are defined at the column level and can be configured to mask data for designated users while allowing full access to others, meeting the requirement to automatically mask PII for the application user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply Dynamic Data Masking (DDM) rules to mask the classified columns for the application user.
Why this is correct
DDM masks data for unauthorized users.
- ✗
Enable Always Encrypted on the classified columns.
Why it's wrong here
Always Encrypted is encryption, not masking.
- ✗
Configure Microsoft Sentinel to monitor access to classified columns.
Why it's wrong here
Sentinel monitors security threats, not classification.
- ✓
Use Microsoft Purview Data Map to scan and classify the database.
Why this is correct
Purview classifies sensitive columns.
- ✗
Enable Transparent Data Encryption (TDE) on the database.
Why it's wrong here
TDE protects data at rest, not masking.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.