Which of the following is the BEST method to mitigate the risk of an unauthorized employee viewing confidential data in a database''

Role-based access control restricts access to the database or specific tables, but if an employee has authorized access, RBAC alone does not prevent them from viewing unmasked confidential data within their authorized scope.

Data masking alters sensitive data elements with realistic but false data, making the original confidential data unreadable or unintelligible to unauthorized individuals, even if they have database access permissions, thereby directly preventing viewing of actual confidential information.

NDAs and sanctions are legal and deterrent controls, but they do not technically prevent an unauthorized employee from viewing confidential data if they manage to gain access.

A Data Loss Prevention (DLP) tool primarily monitors and prevents sensitive data from *leaving* the organization's controlled environment, not from being viewed by an employee with internal database access.