DP-900 Practice Question: Identify considerations for relational data on Azure

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Row-Level Security (RLS) and Transparent Data Encryption (TDE)

  Why it's wrong here

  Row-Level Security (RLS) restricts which rows a query returns by evaluating a security predicate against the current user or session, so it governs read access but performs no cryptographic transformation of the data. TDE encrypts the database files, backups, and logs at rest, yet decryption is done automatically by the SQL Server engine for any connection that has database permissions. Thus, although TDE protects physical file theft, RLS does nothing to encrypt the sensitive data or to limit decryption by authorized applications, so the combination fails to meet a requirement for all-layer encryption.

• ✗

  Azure SQL Database Auditing and Transparent Data Encryption (TDE)

  Why it's wrong here

  Azure SQL Database Auditing is a detective control that records schema changes and data access attempts in an audit log, but it cannot prevent an application that authenticates successfully from reading clear text. TDE provides at-rest encryption of storage and backup files, but the database engine transparently decrypts data on every valid query; therefore an application with legitimate credentials sees plaintext values in normal operations. This pairing monitors activity and protects files but offers no client-side or in-transit encryption control, so sensitive customer data remains exposed to malicious code running inside a compromised application.

• ✓

  Transparent Data Encryption (TDE) and Always Encrypted

  Why this is correct

  TDE encrypts the underlying database file, transaction log, and backups so data at rest cannot be read if the physical media is stolen, but it does not protect data from users who have valid access to the database. Always Encrypted elevates protection by keeping encryption keys entirely on the client side, so for selected columns SQL Server only stores and processes ciphertext; only the authorized client application can decrypt the values, and even high-privilege database admins cannot see the plaintext. Together, TDE secures the entire database at rest while Always Encrypted provides column-level confidentiality and controlled decryption by the application, making this the correct pair for end-to-end encryption of sensitive customer data.

• ✗

  Dynamic Data Masking and Always Encrypted

  Why it's wrong here

  Dynamic Data Masking obfuscates column values in query results for non-privileged users, but the data is still stored unencrypted and masking rules can be bypassed by elevated database roles or by querying other paths. Always Encrypted does protect selected columns by keeping encryption keys off the server, but it only encrypts the columns explicitly configured with a column encryption key. Because this combination leaves the rest of the database without at-rest encryption and DDM adds no cryptographic protection, the solution does not match the thorough coverage provided by TDE combined with Always Encrypted.

Go deeper

Related to this question