Exam DP-200 topic 4 question 22 discussion

While Dynamic Data Masking can also be useful to prevent accidental exposure of sensitive data when accessing a production database directly, it is important to note that unprivileged users with ad-hoc query permissions can apply techniques to gain access to the actual data. If there is a need to grant such ad-hoc access, Auditing should be used to monitor all database activity and mitigate this scenario.

It says "when a user attempts to infer" which is futuristic and not analysis of events that have occured. In that case I think it should be Advance Threat Detection and not Auditing. Auditing only enables us to review the events that have happened before

Why isn't it A?

Answer is D

https://docs.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking?view=sql-server-ver15#security-note-bypassing-masking-using-inference-or-brute-force-techniques

I tend to agree with the answer. In addition to everything written here, the other options don't seem to make sense.

Security Note: Bypassing masking using inference or brute-force techniques Dynamic Data Masking is designed to simplify application development by limiting data exposure in a set of pre-defined queries used by the application. While Dynamic Data Masking can also be useful to prevent accidental exposure of sensitive data when accessing a production database directly, it is important to note that unprivileged users with ad-hoc query permissions can apply techniques to gain access to the actual data. If there is a need to grant such ad-hoc access, Auditing should be used to monitor all database activity and mitigate this scenario.