Dynamic Data Masking (DDM) Features in Azure Synapse Dedicated SQL Pool
Question
A famous BPO startup handles sensitive user data.
You are designing a data solution that uses an Azure Synapse Dedicated SQL Pool.
As part of compliance, you are looking at Dynamic Data Masking (DDM) features, which can benefit your new setup.
Choose the option which is NOT correct about DDM.
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: C.
One thing which we should note is that the question is actually asking to pick the incorrect choice.
Dynamic Data Masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much sensitive data to reveal with minimal impact on the application layer.
When your application runs some predefined queries, Dynamic Data Masking can be used to limit the data view and data exposed.
This will prevent the accidental exposure of data, but we need to keep in mind that the data can sometimes be accessed by unprivileged users with ad hoc query permissions.
Option A is incorrect: It is true, and it is the main purpose of using DDM.
Option B is incorrect: This is one advantage of DDM.
Option C is incorrect: DDM cannot fully secure sensitive data from users running ad-hoc queries.
Option D is incorrect: This is true and is talking about the RBAC role which has permission to set up DDM.
To know more about DDM Limitations, please refer to the doc below:
Dynamic Data Masking (DDM) is a feature in Azure Synapse Dedicated SQL Pool that allows you to restrict sensitive data access by masking the data to non-privileged users. The purpose of DDM is to ensure data security and compliance with data privacy regulations. It can be applied to tables and views, and it masks data on-the-fly, providing real-time data security.
Now, let's review the options provided and determine which one is NOT correct about DDM:
A. Restricting view to data for non-privileged users This statement is correct. DDM restricts access to sensitive data by masking it for non-privileged users. The users who have access to the data can only view the unmasked data.
B. Can be applied when running SQL Server Import and Export This statement is incorrect. DDM is a runtime feature that masks sensitive data on-the-fly while accessing the data. It cannot be applied during data import or export operations.
C. Fully secure sensitive data from users running ad-hoc queries This statement is partially correct. DDM can mask sensitive data from ad-hoc queries, but it does not fully secure the data. The masked data can still be accessed by privileged users or those with access to the unmasked data.
D. Can be configured by the user with SQL Security Manager role (RBAC) This statement is correct. DDM can be configured by users with the SQL Security Manager role, which is part of the Role-Based Access Control (RBAC) system in Azure Synapse Analytics. The SQL Security Manager role has the necessary permissions to manage data masking policies.
In conclusion, the answer to the question is option B. DDM cannot be applied during SQL Server Import and Export operations.
