DP-900 Describe core data concepts Practice Question
A company uses Azure SQL Database and wants to implement row-level security so that sales managers can only see data for their own region. Which feature should they use?
⚠ Common exam trap
Candidates often confuse Dynamic Data Masking (which hides data in results) with Row-level security (which filters rows), leading them to choose option A when the requirement is about restricting row visibility, not masking column values.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Row-level security (RLS)
Row-level security (RLS) is the correct feature because it allows you to control access to rows in a database table based on the characteristics of the user executing a query. In this scenario, RLS can be implemented using a security policy and a predicate function that filters rows based on the sales manager's region, ensuring they only see data for their own region.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic Data Masking
Why it's wrong here
Dynamic Data Masking is a column-level security feature in Azure SQL Database that obfuscates sensitive values in query results for non-privileged users (e.g., replacing an email with a masked pattern). It does not filter or exclude rows from the result set; every row returned by the query remains visible, but certain fields appear masked. Since the requirement is to restrict which rows users can access, DDM fails to address the core need.
- ✓
Row-level security (RLS)
Why this is correct
Row-level security (RLS) in Azure SQL Database uses an inline table-valued function that defines an access predicate, which is then bound to a target table via a security policy. RLS transparently filters rows at query execution time based on the logged-in user's SUSER_SNAME or a value set through SESSION_CONTEXT, so users only see rows permitted by the predicate. This directly satisfies the row-restriction requirement and works even when clients query the table directly, rather than through a filtered view.
- ✗
Transparent Data Encryption (TDE)
Why it's wrong here
Transparent Data Encryption (TDE) performs real-time encryption and decryption of the database's data and log files at rest, using a database encryption key stored in the database boot record. TDE protects the physical files from unauthorized access by someone who steals the backup or disk, but it does not affect what data a logged-in user can query. A user with normal read permissions sees all rows in a table, so TDE has no impact on row-level access control.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a governance and compliance solution that provides data cataloging, data classification, sensitivity labels, and data loss prevention policies across an organization's data estate. It does not enforce row-level restrictions within an Azure SQL database; it helps discover and govern data but lacks the execution-time predicate mechanism needed to filter rows for a specific user. Thus, while valuable for compliance, Purview is irrelevant for implementing row-level access control in Azure SQL.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.