Question 90
In a Microsoft Fabric solution, a support engineer can view a masked identifier but has no explicit permission to see unmasked PII values. Which configuration or implementation should the engineer choose?
Explanation
Correct Answer
The UNMASK permission governs access to unmasked results separately from general SELECT.
Incorrect Answers
A specific SQL object grant limits reach more safely than a broad workspace authoring role.
OneLake security supports Grant roles rather than a separate Deny role type.
Dynamic data masking alone does not prevent inference attacks through predicates.