Question 539 of 820
DP-900 Practice Question: Identify considerations for relational data on Azure
A company is migrating an on-premises SQL Server database to Azure. They want to ensure that database administrators (DBAs) can perform administrative tasks but cannot view sensitive customer data in query results. Which Azure SQL feature should they implement?
⚠ Common exam trap
It's easy for candidates to confuse Dynamic Data Masking with Always Encrypted, assuming masking prevents DBAs from seeing data, when in fact masking can be overridden by users with higher permissions, whereas Always Encrypted cryptographically prevents any server-side access to plaintext.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted
Always Encrypted ensures that sensitive data is encrypted at all times, including during query processing, and that the encryption keys are never revealed to the database engine. This allows DBAs to perform administrative tasks (e.g., backups, index maintenance) while being unable to view the plaintext data in query results, because the decryption occurs only on the client side.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic Data Masking
Why it's wrong here
Dynamic Data Masking is wrong because it merely obfuscates query results for non-privileged users, such as those without the UNMASK permission. A DBA in the db_owner role or one explicitly granted UNMASK can query the table and see the original values in full. Since masking does not encrypt the underlying data and is trivially bypassed by privileged users, it does not prevent a DBA from viewing sensitive information.
When this WOULD be correct
A company wants to limit exposure of sensitive data to non-privileged users (e.g., support staff) while allowing DBAs to see the full data. Dynamic Data Masking would be correct because it masks data at the application layer without changing the underlying database, and DBAs can still access the original data.
- ✓
Always Encrypted
Why this is correct
Always Encrypted is correct because it encrypts sensitive data client-side, meaning the plaintext values are never transmitted to or stored in the SQL database. The database engine and DBAs only see ciphertext; the column master key that would permit decryption is held outside the database, typically in Azure Key Vault or the client's key store. Without that key, even a DBA with full server privileges cannot read the original data, which directly satisfies the requirement.
- ✗
Transparent Data Encryption
Why it's wrong here
Transparent Data Encryption (TDE) is wrong because it only encrypts the database files at rest, including backups and transaction logs, protecting against theft of the physical storage media. When a DBA connects to the database and executes a SELECT query, the SQL engine transparently decrypts the data in memory and returns plaintext results. TDE provides no access control or encryption of data in transit, so a DBA with read permission can still view all sensitive data.
When this WOULD be correct
A company needs to protect an Azure SQL database against theft of physical media or backup files by encrypting the database files at rest. The question would specify that the concern is about unauthorized access to storage, not about DBAs viewing data.
- ✗
Row-Level Security
Why it's wrong here
Row-Level Security (RLS) is wrong because it applies a security predicate that filters rows based on the caller's user context, but it does not encrypt or hide column values from someone who can alter the policy. A DBA with CONTROL permission on the schema or ALTER ANY SECURITY POLICY can modify, disable, or bypass the predicate, and a database owner can simply query with privileges that ignore the filter. Thus, RLS limits row access for ordinary users but is not effective against a DBA's administrative authority.
When this WOULD be correct
A scenario where you need to restrict users to see only their own data (e.g., customers seeing only their orders) without requiring encryption or masking, and where the DBA is not a concern (e.g., the DBA is trusted or not part of the threat model).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The DP-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Always EncryptedCorrect answer▾
Why this is correct
Always Encrypted is correct because it encrypts sensitive data client-side, meaning the plaintext values are never transmitted to or stored in the SQL database. The database engine and DBAs only see ciphertext; the column master key that would permit decryption is held outside the database, typically in Azure Key Vault or the client's key store. Without that key, even a DBA with full server privileges cannot read the original data, which directly satisfies the requirement.
✗Dynamic Data MaskingWrong answer — click to see why▾
Why this is wrong here
Dynamic Data Masking obfuscates data in query results but does not prevent DBAs from viewing the actual data; they can still access the unmasked data by altering permissions or using queries that bypass the mask. The requirement is to prevent DBAs from viewing sensitive data entirely, which Dynamic Data Masking cannot guarantee.
★ When this WOULD be the correct answer
A company wants to limit exposure of sensitive data to non-privileged users (e.g., support staff) while allowing DBAs to see the full data. Dynamic Data Masking would be correct because it masks data at the application layer without changing the underlying database, and DBAs can still access the original data.
Why candidates choose this
Candidates may confuse masking with encryption, thinking that masking prevents DBAs from seeing data, but masking is a presentation-layer feature that does not secure data from users with elevated permissions.
✗Transparent Data EncryptionWrong answer — click to see why▾
Why this is wrong here
Transparent Data Encryption (TDE) encrypts data at rest but does not prevent DBAs from viewing sensitive data in query results; it protects against unauthorized access to the physical storage, not from authorized users querying the database.
★ When this WOULD be the correct answer
A company needs to protect an Azure SQL database against theft of physical media or backup files by encrypting the database files at rest. The question would specify that the concern is about unauthorized access to storage, not about DBAs viewing data.
Why candidates choose this
Candidates may confuse encryption at rest (TDE) with encryption in use (Always Encrypted), or assume that any encryption prevents DBAs from seeing data, overlooking that TDE does not control access at the query level.
✗Row-Level SecurityWrong answer — click to see why▾
Why this is wrong here
Row-Level Security (RLS) restricts access to rows based on user predicates, but it does not prevent DBAs from viewing sensitive data in query results because DBAs typically have elevated permissions that bypass RLS policies.
★ When this WOULD be the correct answer
A scenario where you need to restrict users to see only their own data (e.g., customers seeing only their orders) without requiring encryption or masking, and where the DBA is not a concern (e.g., the DBA is trusted or not part of the threat model).
Why candidates choose this
Candidates may confuse RLS with data protection features, thinking it can hide sensitive columns from administrators, but RLS is row-based and does not protect against users with high privileges like db_owner.
Analysis generated from the official DP-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.