Help-desk analysts run SELECT on lock-operator email addresses and see full values. Which control obfuscates those emails in the result set without rewriting the data at rest?
Select an answer to reveal the explanation.
Short Explanation
Dynamic masking is sunglasses on the query results—help desk sees blurry emails, but the rows in the database are still the real ones. It’s display cover, not encryption.
Full Explanation
Dynamic data masking (DDM) obfuscates query results for non-privileged principals—for example an email mask type shows partially hidden addresses to help-desk analysts—while the underlying column values remain stored in plaintext (from DDM’s perspective) for privileged roles. That fits a canal customer-service scenario where support staff need to work tickets without seeing full emails. Transparent Data Encryption encrypts data files, logs, and backups at rest; it does not redact SELECT output. Always Encrypted with keys shared to every help-desk analyst defeats column confidentiality and is the wrong tool when you only need result obfuscation. Deleting the email column and keeping addresses in chat transcripts destroys application functionality and creates unmanaged copies. Exam caveat: dbo and principals with UNMASK see true values—masking is not encryption and is not a substitute for Always Encrypted or column-level encryption when the threat is the DBA or the engine. Operational check: apply the email mask, connect as a help-desk role without UNMASK and confirm obfuscation, connect as a privileged role and confirm clear text, and review which roles hold UNMASK before go-live. Masking remains a presentation control for municipal help desks, so pair it with RBAC reviews rather than treating it as cryptography.