Question 10
A developer copies highly classified payment columns into an unlabeled reporting table and assumes the source database's label automatically follows every extract. Which TWO complementary actions provide the appropriate response AND evidence to verify it? Select TWO.
Explanation
Correct Answers
Classify sensitive columns, apply supported Dynamic Data Masking only for presentation control, and use encryption or RLS when stronger confidentiality is required. This is the supported administration mechanism for the described workload. Dynamic Data Masking is not encryption or a complete defense against inference; administrators and UNMASK principals can still access original values. Verify with: Inspect sensitivity labels, masking expressions, UNMASK permissions, privileged role membership and direct query behavior across application identities. It supplies the implementation portion of this complementary answer.
Inspect sensitivity labels, masking expressions, UNMASK permissions, privileged role membership and direct query behavior across application identities. This is the discriminating system or configuration evidence for the case. Dynamic Data Masking is not encryption or a complete defense against inference; administrators and UNMASK principals can still access original values. Corresponding approach: Classify sensitive columns, apply supported Dynamic Data Masking only for presentation control, and use encryption or RLS when stronger confidentiality is required. It supplies the evidence portion of this complementary answer.
Incorrect Answers
Inspect login/user mapping, server principals, password policy, Entra admin configuration, directory identity, database containment and connection string authentication mode. This choice pertains to SQL authentication versus Entra and managed-instance principals, not the needed response/evidence pair. Use: Classify sensitive columns, apply supported Dynamic Data Masking only for presentation control, and use encryption or RLS when stronger confidentiality is required. Check: Inspect sensitivity labels, masking expressions, UNMASK permissions, privileged role membership and direct query behavior across application identities.
Only approved SQL principals or application clients decrypt the intended data and key rotation retains tested recovery capability. This choice pertains to Object-level encryption and database cryptographic controls, not the needed response/evidence pair. Use: Classify sensitive columns, apply supported Dynamic Data Masking only for presentation control, and use encryption or RLS when stronger confidentiality is required. Check: Inspect sensitivity labels, masking expressions, UNMASK permissions, privileged role membership and direct query behavior across application identities.
Implement Row-Level Security with a carefully tested predicate function and security policy for each tenant or business boundary, independent of form-level filtering. This choice pertains to Row-level security and ownership predicates, not the needed response/evidence pair. Use: Classify sensitive columns, apply supported Dynamic Data Masking only for presentation control, and use encryption or RLS when stronger confidentiality is required. Check: Inspect sensitivity labels, masking expressions, UNMASK permissions, privileged role membership and direct query behavior across application identities.


