A famous BPO startup handles sensitive user data. You are designing a data solution that uses an Azure Synapse Dedicated SQL Pool. As part of compliance, you are looking at Dynamic Data Masking (DDM) features, which can benefit your new setup. 
 Choose the option which is NOT correct about DDM.

Answer options:

A.restricting view to data for non-privileged users
B.can be applied when running SQL Server Import and Export
C.fully secure sensitive data from users running ad-hoc queries
D.can be configured by user with SQL Security Manager role (RBAC)

Correct Answer: C
One thing which we should note is that the question is actually asking to pick the incorrect choice. 
Dynamic Data Masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much sensitive data to reveal with minimal impact on the application layer. 
When your application runs some predefined queries, Dynamic Data Masking can be used to limit the data view and data exposed. This will prevent the accidental exposure of data, but we need to keep in mind that the data can sometimes be accessed by unprivileged users with ad hoc query permissions.
Option A is incorrect: It is true, and it is the main purpose of using DDM.
Option B is incorrect: This is one advantage of DDM.
Option C is incorrect: DDM cannot fully secure sensitive data from users running ad-hoc queries.
Option D is incorrect: This is true and is talking about the RBAC role which has permission to set up DDM.
Reference: 
To know more about DDM Limitations, please refer to the doc below: 

https://docs.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking?view=sql-server-ver15#security-note-bypassing-masking-using-inference-or-brute-force-techniques