Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics support dynamic data masking. Dynamic data masking limits sensitive data exposure by masking it to non-privileged users.
The Credit card masking method exposes the last four digits of the designated fields and adds a constant string as a prefix in the form of a credit card.
Example:
XXXX-XXXX-XXXX-1234
Basic Concept: This question tests secure database administration, where the control must match the data state, access boundary, identity model, or compliance requirement.
Why B is Correct: data masking matches the expected DP-300 administration action. data masking is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. The question is not asking for a general Azure capability; it is asking for the feature that produces this result: You need to recommend a solution to provide salespeople with the ability to view all the entries in Customers.
Why A is Wrong: Row-Level Security filters rows returned by queries based on a predicate function, allowing different users or tenants to see different subsets of the same tables. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why C is Wrong: Always Encrypted protects sensitive columns from exposure to the database engine by encrypting and decrypting data at the client side with keys protected outside the database. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.
Why D is Wrong: column-level security is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.