nerdexam
Microsoft

DP-300 · Question #52

Drag and Drop Question You have an Azure SQL database that contains a table named Employees. Employees contains a column named Salary. You need to encrypt the Salary column. The solution must…

The correct answer is Create a column master key.; Create a column encryption key.; Encrypt the Salary column by using the randomized encryption type. Always Encrypted is the correct feature to use because it encrypts data at the client side, meaning even database administrators cannot read the plaintext values - addressing the core requirement. The sequence must start with creating a Column Master Key (CMK), which protects…

Submitted by ashley.k· Mar 6, 2026Implement data security and encryption in Azure SQL - specifically understanding Always Encrypted architecture (CMK → CEK → column encryption) and distinguishing it from TDE and Dynamic Data Masking based on DBA access prevention requirements.

Question

Drag and Drop Question You have an Azure SQL database that contains a table named Employees. Employees contains a column named Salary. You need to encrypt the Salary column. The solution must prevent database administrators from reading the data in the Salary column and must provide the most secure encryption. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibit

DP-300 question #52 exhibit

Answer Area

Drag items

Encrypt the Salary column by using the randomized encryption type.Create a column encryption key.Enable Transparent Data Encryption (TDE).Encrypt the Salary column by using the deterministic encryption type.Apply a dynamic data mask to the Salary column.Create a column master key.

Correct arrangement

  • Create a column master key.
  • Create a column encryption key.
  • Encrypt the Salary column by using the randomized encryption type.

Explanation

Always Encrypted is the correct feature to use because it encrypts data at the client side, meaning even database administrators cannot read the plaintext values - addressing the core requirement. The sequence must start with creating a Column Master Key (CMK), which protects the Column Encryption Key (CEK), followed by creating the CEK, which is then used to encrypt the actual column data. Randomized encryption is chosen over deterministic because it is more secure - it produces different ciphertext for the same plaintext value, preventing pattern analysis, making it the 'most secure encryption' option as specified.

Topics

#Always Encrypted#Azure SQL Database#Column Encryption#Data Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DP-300 Practice