DP-900 Practice Question: Identify considerations for relational data on Azure

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Firewall rules

  Why it's wrong here

  Firewall rules in Azure SQL Database are network-layer access controls that determine which IP addresses or Azure virtual networks can establish connections to the server. They block or allow traffic at the gateway level, but they have no effect on the state of data stored on disk. While they are a critical component of a layered security posture, they address network segmentation, not data-at-rest encryption, and thus cannot fulfill the requirement in the question.

• ✗

  Dynamic data masking

  Why it's wrong here

  Dynamic data masking is a feature that hides sensitive data from query results for users without permission by applying masking rules at query execution time. The underlying data in the database files remains stored in its original, unencrypted form, and masking only alters the output displayed to the client. Because it does not encrypt the data at rest or on disk, it is not an encryption feature and therefore does not satisfy the stated requirement.

• ✓

  Transparent data encryption (TDE)

  Why this is correct

  Transparent data encryption (TDE) encrypts the actual database files (data and log files) at rest by performing real-time I/O encryption and decryption of pages as they are written to and read from disk. The encryption uses a database encryption key that is protected by a certificate or asymmetric key stored either in Azure Key Vault or managed by the service. This operation is transparent to applications, requiring no changes to application code or queries, and explicitly provides the data-at-rest encryption that the question is asking about.

• ✗

  Azure AD authentication

  Why it's wrong here

  Azure AD authentication is a mechanism that allows users to connect to Azure SQL Database using identities from Azure Active Directory, enabling centralized identity management and conditional access policies. It does not encrypt the data stored in the database; it only authenticates and authorizes principals at connection time. Encryption at rest is about protecting data when it is stored, not about whom you allow to connect, so this option does not address the specific security feature required.

• ✓

  Always Encrypted

  Why this is correct

  Always Encrypted is a client-side encryption feature that encrypts sensitive columns in the client driver before sending data to the database, ensuring the database server never sees plaintext values. The encryption keys are held by the client application or user, and the data remains encrypted both at rest and during transit, providing strong protection for sensitive data against database administrators or unauthorized access. Because it directly encrypts data at rest and in transit, it qualifies as a valid answer for this question.

Go deeper

Related to this question