DP-900 Describe core data concepts Practice Question
Your organization uses Azure SQL Database and needs to ensure that all customer data is encrypted at rest and in transit with minimal administrative overhead. Which solution should you recommend?
⚠ Common exam trap
Many exam-takers confuse Dynamic Data Masking (which only hides data in results) with encryption, or they overcomplicate the solution by choosing Always Encrypted, which requires client-side changes and key management, when the question explicitly asks for minimal administrative overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Transparent Data Encryption (TDE) and enforce TLS 1.2 for connections.
Transparent Data Encryption (TDE) encrypts Azure SQL Database data files at rest without requiring any application changes, and enforcing TLS 1.2 ensures all data in transit is encrypted using a strong, industry-standard protocol. This combination meets the requirement for encryption at rest and in transit with minimal administrative overhead, as TDE is managed by the platform and TLS enforcement is a simple server-level setting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Microsoft Purview Information Protection to label and encrypt the data.
Why it's wrong here
Microsoft Purview Information Protection (formerly Azure Information Protection) is designed for classifying and labeling documents and emails, not for encrypting Azure SQL Database at rest or in transit. It does not provide database-level encryption, nor does it integrate with SQL's transparent data encryption. Therefore, while it supports data governance, it does not meet the stated encryption requirement for Azure SQL Database.
- ✓
Enable Transparent Data Encryption (TDE) and enforce TLS 1.2 for connections.
Why this is correct
Transparent Data Encryption (TDE) automatically encrypts Azure SQL Database data and log files at rest using AES-256, requiring no changes to existing applications or schemas. Enforcing TLS 1.2 as the minimum connection protocol ensures all data is encrypted in transit between the client and the database server. Together, these features provide comprehensive encryption with minimal administrative overhead, making this the correct answer for this requirement.
- ✗
Implement Dynamic Data Masking on the customer table.
Why it's wrong here
Dynamic Data Masking is a data obfuscation feature that hides sensitive information in query results for non-privileged users, such as masking a credit card number to show only the last four digits. It does not encrypt the underlying data at rest, nor does it protect data in transit — the full data is still stored and transmitted to authorized users. As a result, it cannot fulfill an encryption requirement.
- ✗
Enable Always Encrypted for all sensitive columns and use client-side encryption.
Why it's wrong here
Always Encrypted encrypts sensitive columns (e.g., customer PII) at rest and also protects the data in transit from the client to the server, because the client driver encrypts the values before they are sent. However, it requires client-side driver changes, application modifications, and key management (column master keys and encryption keys), which adds significant operational complexity. For a simple 'ensure encryption with minimal overhead' scenario, this is not the preferred option compared to TDE with TLS.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Encryption at rest
Encryption at rest is the practice of securing stored data by converting it into an unreadable format using cryptographic algorithms, so that even if physical or digital access to the storage medium is obtained, the data remains confidential.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.