nerdexam
Microsoft

DP-203 · Question #225

You are a data engineer for an Azure SQL Database. You write the following SQL statements: CREATE TABLE Customer ( CustomerID int IDENTITY PRIMARY KEY, GivenName varchar(100) MASKED WITH (FUNCTION =…

The correct answer is D. 1 SaXX Jack xxxx. Option D is correct because Azure SQL Dynamic Data Masking applies two different masking functions: partial(2,"XX",0) on GivenName exposes the first 2 characters ("Sa"), replaces the middle with the literal padding string "XX", and exposes 0 trailing characters - producing…

Submitted by diego_uy· Mar 30, 2026Secure, monitor, and optimize data storage and processing

Question

You are a data engineer for an Azure SQL Database. You write the following SQL statements:

CREATE TABLE Customer ( CustomerID int IDENTITY PRIMARY KEY, GivenName varchar(100) MASKED WITH (FUNCTION = 'partial(2,"XX",0)') NULL, SurName varchar(100) NOT NULL, Phone varchar(12) MASKED WITH (FUNCTION = 'default()') INSERT Customer (GivenName, SurName, PhonE. VALUES ('Sammy', 'Jack', '555.111.2222'); SELECT * FROM Customer; You need to determine what is returned by the SELECT query. What data is returned?

Options

  • A1 SaXX Jack XXX.XXX.2222
  • B1 XXXX Jack XXX.XXX.XXXX
  • C1 xx Jack XXX.XXX.2222
  • D1 SaXX Jack xxxx

How the community answered

(44 responses)
  • A
    2% (1)
  • B
    5% (2)
  • C
    11% (5)
  • D
    82% (36)

Explanation

Option D is correct because Azure SQL Dynamic Data Masking applies two different masking functions: partial(2,"XX",0) on GivenName exposes the first 2 characters ("Sa"), replaces the middle with the literal padding string "XX", and exposes 0 trailing characters - producing "SaXX"; default() on a varchar column always returns the fixed string "xxxx" (four lowercase x's), regardless of the actual value or its length.

  • A is wrong because it shows the phone as "XXX.XXX.2222", which is neither the real value nor the default mask output - default() never preserves partial real digits.
  • B is wrong because "XXXX" for GivenName misapplies the mask; partial(2,"XX",0) always keeps the first 2 real characters ("Sa"), it does not replace them.
  • C is wrong because "xx" (lowercase, 2 chars) is not what partial(2,"XX",0) produces - the padding token is the literal string "XX" appended after the 2 real characters, giving "SaXX".

Memory tip: Think of default() as "xxxx - always exactly four lowercase x's, no matter what." For partial(prefix, pad, suffix), read the numbers left-to-right as "show this many from the front, insert the pad string, show this many from the back."

Topics

#Dynamic Data Masking (DDM)#Azure SQL Database#Data Security#SQL DDL/DML

Community Discussion

No community discussion yet for this question.

Full DP-203 Practice