Help-desk analysts run SELECT on lock-operator email addresses and see full values. Which control obfuscates those emails in the result set without rewriting the data at rest?
Select an answer to reveal the explanation.
Short Explanation
Dynamic masking is sunglasses on the query results—help desk sees blurry emails, but the rows in the database are still the real ones. It’s display cover, not encryption.
Full Explanation
Dynamic data masking obfuscates sensitive column values in query results for callers without UNMASK permission; data at rest is not rewritten. Official mask types include email, default, credit card, and random. TDE encrypts files and backups transparently and does not mask result sets. Always Encrypted protects column values from the engine and privileged DBAs when configured, which is a different control and usually the wrong first choice for help-desk display obfuscation.