DP-900 Practice Question: Identify considerations for relational data on Azure
A company has an Azure SQL Database that stores sensitive financial data. They need to ensure that database administrators (DBAs) cannot view the actual data but can still perform administrative tasks. Which feature should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic data masking
Dynamic data masking hides sensitive data from non-privileged users, including DBAs if they are not exempted. Option A is wrong because Azure RBAC controls access but doesn't mask data. Option C is wrong because TDE encrypts at rest but does not hide data from DBAs. Option D is wrong because Azure SQL Database auditing logs actions but doesn't prevent viewing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure role-based access control (RBAC)
Why it's wrong here
Azure role-based access control (RBAC) governs authentication and authorization—determining which principals can connect to the Azure SQL Database and which pre-defined or custom roles they hold, such as SQL DB Contributor or db_datareader. However, RBAC operates at the permission level, not the data value level: once a user is granted SELECT on a table, they retrieve full plaintext column values. Thus RBAC can restrict who reaches the data but cannot obfuscate sensitive values in query results, so it fails the masking requirement.
- ✓
Dynamic data masking
Why this is correct
Dynamic data masking (DDM) is a column-level security feature that applies masking rules (e.g., partial, default, random, email) to specified sensitive columns. For non-privileged users lacking the UNMASK permission, the database engine transforms the query result set to show obfuscated values, while privileged users with UNMASK see the original data. Because DDM operates at query time without altering stored data, it directly addresses the need to hide sensitive information from specific users and is the correct answer.
- ✗
Transparent data encryption (TDE)
Why it's wrong here
Transparent data encryption (TDE) performs real-time I/O encryption of the database's data and log files using a database encryption key protected by a server certificate. When a query is executed, the storage engine automatically decrypts pages as they are read into memory, so any user with SELECT privileges—including DBAs and application accounts—sees decrypted, plaintext data in query results. TDE therefore protects against offline theft of backup files or disks but not against authorized users querying sensitive columns, making it insufficient for masking requirements.
- ✗
Azure SQL Database auditing
Why it's wrong here
Azure SQL Database auditing tracks database events, such as SELECT, INSERT, UPDATE, and schema changes, and writes them to an audit log destination like Azure Storage or Log Analytics. It is a detective control that records when sensitive data was accessed and by whom, but it does not alter or hide the data returned to the user; the query still returns the full sensitive values. Hence auditing can answer 'who saw what' but cannot prevent a user from seeing the data, so it does not satisfy the requirement.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
Key term
View
A view is a saved query in a database that acts like a virtual table, letting you see specific data without storing it separately.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.