DP-900 Describe core data concepts Practice Question
Your company stores sensitive customer data in Azure SQL Database. You need to implement column-level encryption for the 'SSN' column using a customer-managed key stored in Azure Key Vault. Which feature should you use?
⚠ Common exam trap
Watch out — candidates often confuse Transparent Data Encryption (TDE) with column-level encryption, but TDE only protects data at rest and does not prevent database administrators or the cloud provider from reading the data in memory or during queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted
Always Encrypted is the correct feature because it allows client-side encryption of sensitive columns, such as 'SSN', using a customer-managed key stored in Azure Key Vault. The encryption keys are never exposed to the database engine, ensuring that even database administrators cannot view the plaintext data. This meets the requirement for column-level encryption with customer-managed keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that enforces organizational rules across Azure resources; it can audit deployments, restrict allowed regions, or require auditing/TDE to be enabled, but it never touches the data plane. It cannot encrypt a specific customer column in Azure SQL Database because it operates at the resource/ARM layer, not at the row/column level. For column-level compromise prevention, you need an encryption mechanism such as Always Encrypted.
- ✓
Always Encrypted
Why this is correct
Always Encrypted encrypts selected columns client-side using a column encryption key protected by a column master key held outside Azure SQL Database. The database engine stores and processes only ciphertext, so sensitive data is never exposed to SQL Server administrators or to Azure personnel. With deterministic encryption the server can support equality operations (e.g., WHERE clauses and joins) while randomized encryption avoids leaks. The client application and driver must be compatible, and the application must supply the keys.
- ✗
Transparent Data Encryption (TDE)
Why it's wrong here
Transparent Data Encryption (TDE) encrypts the whole database's data and log files at rest using a symmetric database encryption key; reads are automatically decrypted when the data is loaded into memory. It prevents unauthorized access to stolen backup files or disk copies but does not provide column-level control. Because TDE decrypts data for any querying user with database permissions, it cannot fulfill a requirement for encrypting individual sensitive columns or controlling how the app handles those columns.
- ✗
Dynamic Data Masking
Why it's wrong here
Dynamic Data Masking applies masking rules to query results based on the user's permissions, for example showing 'XXX-XX-1234' instead of the full Social Security number. It does not modify the underlying stored data and is not a cryptographic operation; masked data still travels to the client as plaintext after masking is applied. Since the actual column values remain readable to users with the UNMASK permission, DDM cannot satisfy a strict encryption compliance requirement.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Column
A column is a vertical set of values in a database table that stores one specific type of attribute for every row.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.