Exam AZ-305 All Questions

View all questions & answers for the AZ-305 exam

Exam AZ-305 topic 2 question 30 discussion

Actual exam question from Microsoft's AZ-305

Question #: 30
Topic #: 2

HOTSPOT
-

You have an Azure subscription. The subscription contains an Azure SQL managed instance that stores employee details, including social security numbers and phone numbers.

You need to configure the managed instance to meet the following requirements:

• The helpdesk team must see only the last four digits of an employee’s phone number.
• Cloud administrators must be prevented from seeing the employee’s social security numbers.

What should you enable for each column in the managed instance? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by marcellov at Sept. 22, 2023, 4:18 p.m.

Comments

Submit Cancel

marcellov

Highly Voted 1 year, 9 months ago

I agree with the answer. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal effect on the application layer. https://learn.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview Always Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national/regional identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database, Azure SQL Managed Instance, and SQL Server databases. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine

upvoted 29 times

nel96

3 weeks, 1 day ago

réponse correct et apparu le 24 mai 2025, 828 obtenu

upvoted 1 times

...

[Removed]

Most Recent 7 months, 1 week ago

CORRECT

upvoted 1 times

...

Teerawee

9 months, 1 week ago

Dynamic data masking Always Encrypted

upvoted 1 times

...

23169fd

12 months ago

The given answer is correct. Dynamic Data Masking: Masks sensitive data in the result set of a query, limiting data exposure without changing the data in the database. Always Encrypted: Ensures sensitive data is encrypted both at rest and in motion, and can only be decrypted by the client application that has the encryption keys.

upvoted 1 times

...

chair123

1 year, 3 months ago

Based on Gemini AI: Box2 for SSN: "Always Encrypted": This feature encrypts data at rest and in transit, ensuring it remains unreadable even by Azure administrators with access to the database server. The decryption keys are stored in Azure Key Vault, separate from the database, requiring stricter access controls. Why not the other options? - Column Encryption: While it encrypts data at rest, the decryption key is stored within the database server, potentially accessible to cloud administrators. - Dynamic Data Masking: This technique masks data within the query results but doesn't encrypt the data itself. Cloud administrators could still access the underlying data.

upvoted 3 times

...

U4ea

1 year, 8 months ago

Can't Dynamic Data Masking also be used to mask the SSN's?

upvoted 1 times

godchild

1 year, 8 months ago

The wording of the question is bad. The question only states "Cloud administrators must be prevented from seeing the employee’s social security numbers", but not mentions about others. So I also thought it should also be dynamic masking.

upvoted 3 times

andersonslls

1 year, 5 months ago

Me too

upvoted 1 times

...

mmarkiew

1 year, 6 months ago

DDM won't address the SSN requirement: "Administrative users and roles can always view unmasked data via the CONTROL permission, which includes both the ALTER ANY MASK and UNMASK permission. Administrative users or roles such as sysadmin, serveradmin, or db_owner have CONTROL permissions on the database by design, and can view unmasked data." Reference: https://learn.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking?view=sql-server-ver16#permissions

upvoted 6 times

...