DP-900 Practice Question: Identify considerations for relational data on Azure
You are designing a relational database for a multi-tenant SaaS application. Each tenant's data must be isolated for security and compliance. Which design approach best ensures data isolation while keeping cost manageable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a separate database per tenant
A separate database per tenant provides strong isolation, ensuring each tenant's data is completely separate for security and compliance, while keeping costs manageable through elastic pools or other cost-effective deployment models. Option A is incorrect because Azure Synapse Analytics is a data warehousing and analytics service, not designed for OLTP multi-tenant isolation. Option C is incorrect because row-level security can help but does not provide the same level of isolation as separate databases. Option D is incorrect because separate schemas within a single database do not provide full data isolation; they share the same database and resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Synapse Analytics with workload isolation
Why it's wrong here
Azure Synapse Analytics is a distributed query and data warehousing service optimized for large-scale analytical workloads, not for transactional processing. Its workload isolation features, such as workload classification and resource management, are designed to govern query performance in a shared analytics engine, not to enforce tenant data separation. Using it for a multi-tenant OLTP application would introduce unnecessary latency and cost, and it still offers no native mechanism to keep each tenant's data physically or logically isolated.
- ✓
Use a separate database per tenant
Why this is correct
A dedicated database per tenant, often called the silo model, provides the strongest possible isolation because each tenant's data resides in its own independent database with its own security credentials, backup schedule, and performance tier. This eliminates the risk of cross-tenant data leakage from application errors or misconfigured queries, and it allows you to restore, scale, or upgrade a single tenant without affecting any other tenant. It also simplifies compliance and audit because data is physically separated at the server level, making it the clear choice for strict multi-tenant isolation requirements.
- ✗
Use a single database with a TenantID column and row-level security
Why it's wrong here
Using a single database with a TenantID column and row-level security (RLS) can enforce tenant separation, but the isolation is only as strong as the security predicates and permissions you configure. If a predicate is miswritten, an admin gains elevated privileges, or a schema change inadvertently breaks the filter, the RLS layer can be bypassed, exposing other tenants' rows. Furthermore, all tenants share the same database instance, so a resource-heavy tenant can degrade performance for everyone, and you cannot perform a point-in-time restore for just one tenant without affecting the entire shared database.
- ✗
Use a single database with separate schemas per tenant
Why it's wrong here
Separate schemas within a single database group objects into namespaces, but a schema is not a security boundary in Azure SQL Database. While you can grant per-schema permissions, that is still a discretionary access control implementation rather than inherent isolation, and it does not prevent an administrator or a compromised login from reading across schemas. Because all tenants share the same database, resources are not isolated, and operations like backup, restore, or scaling apply to the whole database, not to individual tenant schemas, making this option unsuitable for strong tenant isolation.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Azure Synapse Analytics
Azure Synapse Analytics is a cloud-based data integration, warehousing, and analytics service that brings together big data and data warehouse capabilities under one platform.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
This DP-900 question is part of Courseiva's 820-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.