A payroll table holds an employee salary column next to job title and department. Analysts should query the rest of the table but must receive an access denial when they select salary. Which configuration achieves this?
Show answer and explanation
Answer: C
Policy tags attach a classification to a column, and granting or withholding the fine-grained reader role on that tag controls which principals can read the column. Analysts can still query the other columns of the table, and selecting salary is denied. Separate datasets or tables multiply objects and complicate joins, and row access policies filter records rather than fields, so they cannot hide one column.
Why the other options are wrong
- A. Moving salaries to a separate dataset separates the data physically but forces a second table to be maintained and joined, when the requirement is to hide one column in place.
- B. Splitting fields into separate tables multiplies objects, complicates every query that needs the full record, and must be kept in sync with the base table.
- D. A row access policy filters which records a user sees, not which fields, so analysts would still see the salary column for every row they are allowed to read.