Exam SC-100 topic 12 question 1 discussion

Anyone with admin privileges can see masked data. https://docs.microsoft.com/en-us/learn/modules/protect-data-transit-rest/4-explain-object-encryption-secure-enclaves

The question isn't about encryption at rest. You need to prevent the developers from seeing data in specific column in the DB.

Interesting note here describing the purpose of Always Encrypted on the secure enclaves page. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-enclaves?view=sql-server-ver16 Always Encrypted protects the confidentiality of sensitive data from malware and high-privileged unauthorized users: Database Administrators (DBAs), computer admins, cloud admins, or anyone else who has legitimate access to server instances, hardware, etc., but shouldn't have access to some or all of the actual data.

Should be E - db_onwer can't read dynamically masked columns by default if UNMASK permission is not granted. Moreover, "Always encrypted" is related with Application to SQL relationship, here the requirement is more for direct viewing (presumably by SQL query).

From Compliance view, C is better because DDM can't help us comply 100% with HIPAA, in a few cases, we must need to use Always Encrypted option to ensure that our sensitive data is encrypted to priv users.

devs ar db_owner that has permission UNMASK in sql db, hence C, not E

Selected Answer: C https://www.youtube.com/watch?v=r-P-2lGzPFQ&list=PLQ2ktTy9rklhzzkSEZvDZT4QSIVUQZD-Y&index=9 Question113

To secure the MedicalHistory data in the ClaimsDetail table and meet the Contoso developer requirements, you should recommend implementing Dynamic Data Masking (DDM). Dynamic Data Masking (DDM) allows you to limit sensitive data exposure by masking parts of the data from specific users or roles. In this case, you can configure DDM to mask the MedicalHistory column for Contoso developers, ensuring they cannot view the sensitive data. So, the correct recommendation is Option E: Dynamic Data Masking (DDM).

C looks correct, think it's focused on the privilege level here. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver16 "This provides a separation between those who own the data and can view it, and those who manage the data but should have no access - on-premises database administrators, cloud database operators, or other high-privileged unauthorized users. As a result, Always Encrypted enables customers to confidently store their sensitive data in the cloud, and to reduce the likelihood of data theft by malicious insiders."

C is the answer. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver16 Always Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national/regional identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database, Azure SQL Managed Instance, and SQL Server databases. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. This provides a separation between those who own the data and can view it, and those who manage the data but should have no access - on-premises database administrators, cloud database operators, or other high-privileged unauthorized users. As a result, Always Encrypted enables customers to confidently store their sensitive data in the cloud, and to reduce the likelihood of data theft by malicious insiders.

Privileged developers can bypass data masking

Please look at the comments made by D3D1997 as below. "i got it today in the exam. The wording is different: "he Contoso developers must be prevented from viewing the data in a column named MedicalHistory ONLY". And there is no reference to the db_owner role in the case study tabs I had, so be careful, because in that case Dynamic Data Masking would be a better option"

If you want it hidden from administrators... Always Encrypted is where you need to focus. Dynamic Data masking makes it simply at the presentation layer. Correct E

E. dynamic data masking

A-No, it's a column not a row B- TDE encrypts the database files, not the db tables when queried D- Do not play a role here E- db_owner can bypass Dynamic Data Masking, and even lower privileged users could. MS itself says: "t's important to note that unprivileged users with ad-hoc query permissions can apply techniques to gain access to the actual data." in https://learn.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking

I will go with dynamic data masking for this one ...Always encrypted works too but this is a very specific use case for developers and it is worth to honor a capability mapped to that

Answer : C https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver16 Always Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database, Azure SQL Managed Instance, and SQL Server databases. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. This provides a separation between those who own the data and can view it, and those who manage the data but should have no access - on-premises database administrators, cloud database operators, or other high-privileged unauthorized users. As a result, Always Encrypted enables customers to confidently store their sensitive data in the cloud, and to reduce the likelihood of data theft by malicious insiders.