AZ-500 Question 180
Single answerYour organization stores customer email addresses in an Azure SQL Database. The development team should only see masked email addresses, while the compliance officer needs to view the actual (unmasked) email addresses. Which approach should you use to plan and implement dynamic data masking to meet these requirements?
- A
Enable Transparent Data Encryption (TDE) for the columns containing email addresses so that developers see masked data by default.
- B
Apply Always Encrypted to the email address columns to yield masked values for developers.
- C
Configure dynamic data masking with partial masking for email addresses, and then grant the UNMASK permission to the compliance officer.
- D
Implement Row-Level Security to block developers from viewing the email address columns.
Show answer and explanation
Correct answer: C
Explanation
Dynamic data masking in Azure SQL Database allows you to mask sensitive information for non-privileged users, while privileged users can see the actual data if they have the UNMASK permission. This approach balances the need for data privacy with operational requirements. For more details, refer to the official Microsoft documentation on dynamic data masking: https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview.
- A. Incorrect.
Incorrect. Transparent Data Encryption (TDE) protects data at rest but does not provide masking. TDE ensures stored data is encrypted on disk, but once a user has permission to query the database, they see the unencrypted data. This does not fulfill the requirement for masking values.
- B. Incorrect.
Incorrect. Always Encrypted encrypts data both at rest and in transit, requiring client-side encryption/decryption. While it protects sensitive data, it does not supply a feature to display masked values to certain user roles without decryption. This is not the correct approach for conditional masking.
- C. Correct.
Correct. Dynamic data masking with a partial masking function is designed for this scenario, allowing non-privileged users to view masked data while privileged users with the UNMASK permission see the full values. This precisely meets the requirement to differentiate data visibility.
- D. Incorrect.
Incorrect. Row-Level Security (RLS) restricts which rows a user can access, but it does not apply masking to column data. RLS can limit entire rows of data, but it cannot selectively mask email addresses within rows.