DP-300 Implement a secure environment Practice Question
Your organization is migrating a legacy on-premises SQL Server database to Azure SQL Managed Instance. The database contains sensitive financial data. You need to implement column-level encryption so that even database administrators cannot view the plaintext data. The encryption keys must be stored in Azure Key Vault, and the application must be able to encrypt and decrypt data transparently. The application currently uses Entity Framework Core and runs on Azure App Service. You have the following requirements: - Use a solution that provides the strongest security by ensuring the database never has access to the plaintext. - Minimize changes to the application code. - The application must be able to perform equality searches on encrypted columns.
What should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Always Encrypted with deterministic encryption and store column master key in Azure Key Vault.
Always Encrypted with deterministic encryption provides column-level encryption, stores the column master key in Azure Key Vault, and ensures the database never sees plaintext. The client-side driver in Entity Framework Core handles encryption transparently, and deterministic encryption allows equality searches. Option A is incorrect because randomized encryption does not support equality searches; secure enclaves could enable that but add complexity. Option B is incorrect because dynamic data masking does not encrypt data; it only hides it from unauthorized users at query time, and the database still has access to plaintext. Option C is incorrect because Transparent Data Encryption (TDE) encrypts the entire database at rest, not individual columns, and does not prevent the database from seeing plaintext during operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Always Encrypted with secure enclaves and randomized encryption.
Why it's wrong here
Secure enclaves allow computations on encrypted data but require additional setup; randomized encryption does not support equality searches.
- ✗
Use dynamic data masking to hide the data from unauthorized users.
Why it's wrong here
Data masking does not encrypt data; it only obfuscates it in query results.
- ✗
Use Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.
Why it's wrong here
TDE encrypts at rest, but database administrators can still access plaintext when connected.
- ✓
Use Always Encrypted with deterministic encryption and store column master key in Azure Key Vault.
Why this is correct
Deterministic encryption enables equality joins and lookups, and the database cannot decrypt the data.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Transparent Data Encryption
Transparent Data Encryption is a security feature that automatically encrypts data written to a database and decrypts it when read, without requiring any changes to the application.
Key term
Azure SQL Managed Instance
Azure SQL Managed Instance is a fully managed cloud database service that gives you nearly all the features of Microsoft SQL Server on your own server, without you having to manage the hardware or operating system.
About these practice questions
One of 906 original DP-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.