DP-900 Practice Question: Identify considerations for relational data on Azure
A healthcare organization uses Azure SQL Database to store patient records. To comply with HIPAA regulations, they need to encrypt sensitive columns (e.g., Social Security numbers) at rest and control access to the encryption keys. Which feature should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted
Always Encrypted. Always Encrypted is a feature designed to protect sensitive data, such as Social Security numbers, by encrypting it at rest and in transit, with the encryption keys stored outside of Azure SQL Database, providing client-side key management. This satisfies the HIPAA requirement for encrypting sensitive columns and controlling access to keys. Option A: Dynamic Data Masking obfuscates data from non-privileged users but does not encrypt the data; it can be reversed by privileged users. Option B: Row-Level Security restricts access to rows based on user characteristics but does not encrypt columns. Option D: Transparent Data Encryption (TDE) encrypts the entire database at rest but does not provide column-level encryption or client-side key control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic Data Masking
Why it's wrong here
Dynamic Data Masking (DDM) hides sensitive data from non-privileged users by applying masking rules at query time, such as showing only the last four digits of a credit card. However, DDM does not encrypt the underlying data; the full value remains stored in plaintext in the database, and privileged users or direct queries against the underlying tables can still retrieve it. Because masking is a presentation-layer control, it cannot protect data at rest or prevent data exfiltration if an attacker gains read access to database files.
- ✗
Row-Level Security
Why it's wrong here
Row-Level Security (RLS) restricts which rows a user can see by evaluating a security predicate in the query engine, effectively limiting access to certain records based on user context. But RLS filters rows only; it does not encrypt or obfuscate individual columns, so any user allowed to view a row can see all columns in that row in clear text. It also has no effect on data at rest, audit logs, or backups, and it is not designed to protect sensitive fields from users who legitimately need other columns in the same row.
- ✓
Always Encrypted
Why this is correct
Always Encrypted is the only option here that provides true client-side encryption at the column level. The client driver encrypts data before sending it to Azure SQL Database, and the server never sees the plaintext value; decryption keys are held by the client application or Azure Key Vault, not by the database. This protects sensitive columns even from database administrators and system administrators, and it also encrypts data in transit, at rest, and during client operations. However, it introduces limitations on query operations, such as equality comparisons only for deterministic encryption.
- ✗
Transparent Data Encryption (TDE)
Why it's wrong here
Transparent Data Encryption (TDE) encrypts the entire database at rest, including data files, transaction log files, and backups, by performing real-time I/O encryption and decryption without requiring application changes. While this protects against physical theft of files, TDE is transparent to clients and does not encrypt data in transit or prevent users with valid credentials from reading sensitive columns. Moreover, the database encryption key is managed by the platform and is not scoped to individual columns, so you cannot control access to specific sensitive fields or keep key control client-side.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Column
A column is a vertical set of values in a database table that stores one specific type of attribute for every row.
Key term
Row
A row is a horizontal record in a database table that contains all the information about a single entity, like one customer or one product.
About these practice questions
Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.