AZ-500 Question 179
Single answerYou are a security engineer at a company using Azure SQL Database to store personally identifiable information (PII). You have implemented dynamic data masking on sensitive columns such as email addresses and phone numbers so that production data can be safely accessed by the development team for troubleshooting. However, you discover that members of a particular Azure Active Directory security group are still able to view unmasked data in these columns. You need to ensure that these developers only see masked data. What should you do next?
- A
Revoke the UNMASK permission from the Azure AD security group in the database
- B
Enable Transparent Data Encryption (TDE) on the Azure SQL Database
- C
Require SSL/TLS encryption for all application connections
- D
Grant the security group the db_datareader role
Show answer and explanation
Correct answer: A
Explanation
Dynamic data masking in Azure SQL Database ensures that only authorized users with the UNMASK permission (or higher privileges) can view the actual data in masked columns. If users can still see unmasked data, it is often because they have the necessary permissions. To fix this, you must remove that permission explicitly. For more information, see the Microsoft documentation on dynamic data masking: https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking.
- A. Correct.
Correct: Revoking the UNMASK permission ensures that members of that security group cannot view the actual data in masked columns. By default, dynamic data masking hides the sensitive data unless a user or group has UNMASK privileges or other higher-level permissions (e.g., sysadmin).
- B. Incorrect.
Incorrect: Transparent Data Encryption (TDE) protects data at rest by encrypting it on disk, but it does not prevent authenticated database users from viewing the underlying data if they have permissions to query unmasked columns.
- C. Incorrect.
Incorrect: SSL/TLS encryption ensures secure transmission of data between the client and the server, but it does not address whether data is masked or unmasked once the user is authenticated.
- D. Incorrect.
Incorrect: Granting db_datareader gives read access to database tables but does not remove the ability to view unmasked data if the user or group already has the UNMASK permission.