Does the CustomerProfiles schema satisfy PII and RLS requirements?
HOTSPOT
Case Study
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Existing Environment
Azure Environment
Contoso has an Azure subscription in North Europe that contains the corporate infrastructure. The current infrastructure contains a Microsoft SQL Server 2017 database. The database contains the following tables.
The FeedbackJson column has a full-text index and stores JSON documents in the following format.
The support staff at Contoso never has the UNMASK permission.
Problem Statements
Contoso is deploying a new Azure SQL database that will become the authoritative data store for the following:
AI workloads
Vector search
Modernized API access
Retrieval Augmented Generation (RAG) pipelines
Sometimes the ingestion pipeline fails due to malformed JSON and duplicate payloads.
The engineers at Contoso report that the following dashboard query runs slowly.
You review the execution plan and discover that the plan shows a clustered index scan.
VehicleIncidentReports often contains details about the weather, traffic conditions, and location. Analysts report that it is difficult to find similar incidents based on these details.
Requirements
Planned Changes
Contoso wants to modernize Fleet Intelligence Platform to support AI-powered semantic search over incident reports.
Security Requirements
Contoso identifies the following security requirements:
Restrict the support staff from viewing Personally Identifiable Information (PII) data, which is full email addresses and phone numbers.
Enforce row-level filtering so that analysts see only incidents for the fleets to which they are assigned. The analysts can be assigned to multiple fleets.
Database Performance and Requirements
Contoso identifies the following telemetry requirements:
Telemetry data must be stored in a partitioned table.
Telemetry data must provide predictable performance for ingestion and retention operations.
latitude, longitude, and accuracy JSON properties must be filtered by using an index seek.
Contoso identifies the following maintenance data requirements:
Ensure that any changes to a row in the MaintenanceEvents table updates the corresponding value in the LastModifiedUtc column to the time of the change.
Avoid recursive updates.
AI Search, Embeddings, and Vector Indexing
Contoso plans to implement semantic search over incident data to meet the following requirements:
Embeddings must be stored in dedicated Azure SQL Database tables.
Embeddings must be generated from rich natural language fields.
Chunking must preserve semantic coherence.
Hybrid search must combine the following:
Vector similarity
Keyword filtering or boosting
Development Requirements
The development team at Contoso will use Microsoft Visual Studio Code and GitHub Copilot and will retrieve live metadata from the databases.
Contoso identifies the following requirements for querying data in the FeedbackJson column of the CustomerFeedback table:
Extract the customer feedback text from the JSON document.
Filter rows where the JSON text contains a keyword.
Calculate a fuzzy similarity score between the feedback text and a known issue description.
Order the results by similarity score, with the highest score first.
You are creating a table that will store customer profiles.
You have the following Transact-SQL code.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Community Insight
The item tests DDM and RLS interaction in Azure SQL Database; the trap is assuming masking runs before RLS or that server administrators automatically see all rows through an application connection.
This hotspot tests whether a dbo.CustomerProfiles schema using dynamic data masking and row-level security satisfies Contoso's PII and fleet-filtering requirements, and how the two security features interact. The correct selections are Yes for PII masking, No for administrators seeing all rows through the application, and No for masking applying to rows RLS filters out.
A common mistake is treating DDM and RLS as one control, or assuming administrator bypass applies even when the application connects with a normal app login, which produces the wrong Yes/No selections.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The T-SQL defines masking on EmailAddress and PhoneNumber, satisfying the requirement to hide full email addresses and phone numbers from support staff who lack the UNMASK permission. The security policy applies a FILTER predicate using RegionName and UserRegionAccess, so analysts only see rows for assigned regions and multiple assignments are handled by the EXISTS clause. For the administrator statement, the application connection identity is what RLS evaluates; an Azure SQL server administrator using the application does not automatically get all rows unless that connection itself has bypass privileges. For the masking statement, RLS filters rows before the result set is produced, so rows removed by RLS are never returned and DDM has nothing to mask on them.
Why Other Candidate Answers Are Wrong
Answering No to the PII requirement ignores that MASKED WITH on EmailAddress and PhoneNumber directly meets the masking requirement. Answering Yes to administrators seeing all rows through the application confuses direct administrative access with the application login identity used by the app. Answering Yes to masking rules applying to rows RLS filters out reverses the execution order; RLS removes those rows before DDM is relevant. Treating DDM and RLS as mutually exclusive also fails because they are independent controls that stack on the rows that are actually returned.
Community Comment Notes
As pmajo noted, masking is defined for EmailAddress and PhoneNumber and the policy uses RLS filters; their note that "RLS is first" matches the official interaction. gangreja also explains that the two features are independent and stack, and states that "Rows that RLS removes are never returned", which supports the No answer for masking filtered rows. Some learners read the stacking as applying masking to every processed row, but the practical result is that only rows surviving RLS are returned to be masked.
Official Reference
Exam Strategy
For case-study hotspot items, map each statement to one requirement and one feature: DDM for PII masking, RLS for fleet or region filtering. Remember RLS filters rows before DDM projects the result set, and evaluate administrator statements by the identity the application actually uses.
Frequently Asked Questions
Does DDM mask rows that RLS filters out in dbo.CustomerProfiles?
No. The RLS filter predicate is evaluated first, so filtered rows never reach the result set and DDM has nothing to mask.
Can Azure SQL server admins see all dbo.CustomerProfiles rows when using the app?
Not automatically. If the application connects with a non-admin login, RLS applies to that login; administrator bypass does not follow the app connection.