Hiding sensitive column values behind a dynamic mask

Dynamic data masking (DDM) obscures sensitive data in query results for non-privileged users while leaving the underlying data in storage unchanged. It is applied at the column level on tables in a SQL analytics endpoint or Warehouse in Microsoft Fabric, using built-in masking functions to control how much of the data is exposed.

Must-know

• DDM works on Fabric Warehouse tables and SQL analytics endpoint tables (Lakehouse), configured via T-SQL (ADD MASKED WITH) or through the Fabric portal UI on the column.
• Available masking functions include default() (fully masks based on data type), email() (masks email format, e.g. [email protected]), random() (numeric range masking), and partial() (custom prefix/padding/suffix exposure).
• Masking is enforced at query time only: it does not encrypt data at rest, and users with sufficient permission (e.g., UNMASK permission or admin/workspace roles) can bypass the mask and see plaintext.
• By default, workspace admins and members with elevated roles can see unmasked data unless explicitly restricted; masking is not a substitute for proper access control or encryption.
• Masking rules are simple obfuscation and can potentially be inferred/bypassed via inference attacks (e.g., brute-forcing ranges or using WHERE clauses), so it should be combined with other security layers like row-level security and object-level permissions.
• DDM policies must be created/altered via T-SQL or the portal by users with ALTER ANY MASK permission, and grants/revokes of UNMASK permission control who sees the real values.

Coverage checked against the published exam guide on Aug 11, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.