DP-203 Practice Test 13 — 15 Questions

Question 1

You are building a data processing pipeline in Azure Synapse Analytics. The pipeline should read data from Azure Data Lake Storage Gen2 (Parquet files), apply transformations using a mapping data flow, and write the results to a dedicated SQL pool table. The source data contains personally identifiable information (PII). You need to mask the PII columns (e.g., email) using a data masking function within the data flow. Which transformation should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Derived Column transformation. The Derived Column transformation in mapping data flows allows you to create new columns or modify existing ones using expressions, including built-in data masking functions like `mask()`, `maskEmail()`, or `substring()`. This is the correct transformation to apply PII masking on columns such as email addresses within the data flow pipeline before writing to the dedicated SQL pool.

Answer

Join transformation

Answer

Aggregate transformation

Answer

Pivot transformation

Question 2

You are designing a data storage solution for IoT sensor data. The data is written thousands of times per second and requires low-latency reads for real-time dashboards. Which Azure storage solution should you use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it provides single-digit millisecond read and write latency at any scale, with automatic indexing and multi-region distribution. Its support for multiple APIs (SQL, MongoDB, Cassandra, etc.) and configurable consistency levels makes it ideal for IoT sensor data requiring high-throughput writes and low-latency reads for real-time dashboards.

Answer

Azure Blob Storage

Answer

Azure SQL Database

Answer

Azure Data Lake Storage Gen2

Question 3

You are designing a data lakehouse architecture in Azure using Delta Lake. The solution needs to process batch and streaming data from multiple sources, including IoT devices and CRM systems. You need to ensure data quality by enforcing schema validation and handling schema evolution. You also need to provide a unified catalog for querying. Which service should you use?

Accepted Answer

Azure Databricks Unity Catalog. Azure Databricks Unity Catalog is the only option that provides a unified governance layer across workspaces with built-in support for Delta Lake schema enforcement, schema evolution, and a centralized metastore for querying. It natively integrates with Delta Lake's transaction log to enforce schema-on-write and supports MERGE/ALTER operations for evolution. The other services provide storage or query capabilities but not unified cataloging with schema governance.

Answer

Azure Purview

Answer

Azure Data Lake Storage Gen2

Answer

Azure Synapse Analytics serverless SQL pool

Question 4

You are a data engineer for a healthcare company that processes patient data. You have an Azure Databricks workspace with a cluster configured for data processing. You need to implement a solution that processes streaming data from Azure Event Hubs, enriches it with reference data stored in Azure Cosmos DB, and writes the output to Delta Lake in Azure Data Lake Storage Gen2. The solution must ensure that the data processing is fault-tolerant and can handle schema evolution. The reference data is updated infrequently. You need to choose an approach that minimizes complexity and cost. What should you do?

Accepted Answer

Use Azure Databricks Structured Streaming to read from Event Hubs, use a streaming static join to enrich with reference data from Cosmos DB, and write to Delta Lake. Enable schema evolution on the Delta table.. Azure Databricks Structured Streaming can read from Event Hubs, and a streaming static join allows enriching with reference data from Cosmos DB (which is updated infrequently). Writing to Delta Lake with schema evolution enabled handles schema changes. This approach minimizes complexity and cost by using native Databricks features without additional services.

Answer

Use Azure Databricks Auto Loader with Delta Live Tables to ingest streaming data, and use Change Data Capture from Cosmos DB to update the reference data inline.

Answer

Use Azure Data Factory to copy data from Event Hubs to Azure Data Lake Storage Gen2 in batches, then use Azure Databricks to process and enrich with Cosmos DB.

Answer

Use Azure Stream Analytics to ingest from Event Hubs, join with Cosmos DB reference data, and output to Azure Data Lake Storage Gen2 in Parquet format.

Question 5

You are monitoring an Azure Stream Analytics job that processes data from an IoT hub. The job's output to Azure Synapse Analytics is experiencing high latency. The job's SU% utilization is at 90%. Which action will most likely reduce the latency?

Accepted Answer

Increase the number of Streaming Units (SUs) allocated to the job.. The job's SU% utilization is at 90%, indicating that the current Streaming Units (SUs) are nearly saturated, causing a processing bottleneck. Increasing the number of SUs allocates more compute resources (CPU and memory) to the Stream Analytics job, allowing it to process incoming IoT data faster and reduce the latency to Azure Synapse Analytics. This directly addresses the high utilization issue, which is the most likely root cause of the latency.

Answer

Decrease the watermark delay interval.

Answer

Increase the late arrival tolerance window.

Answer

Increase the number of partitions in the output table.

Question 6

Your company stores sensitive customer data in Azure SQL Database. You need to encrypt the data at rest and ensure that only your application can decrypt it, even from database administrators. What should you implement?

Accepted Answer

Always Encrypted. Always Encrypted is correct because it ensures that sensitive data is encrypted at rest and in use, and the encryption keys are stored client-side, so only the application can decrypt the data. Database administrators (DBAs) cannot access the plaintext data because they lack the column encryption keys, even though they have full administrative access to the database.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Answer

Azure Storage Service Encryption

Question 7

You have an Azure Databricks workspace that uses a managed resource group. The security team requires that all cluster nodes use no public IP addresses and that all outbound traffic goes through a firewall. What should you configure?

Accepted Answer

Deploy the workspace in a VNet with forced tunneling enabled and a firewall.. To ensure no public IPs on cluster nodes and all outbound traffic routed through a firewall, you must deploy the Azure Databricks workspace into your own VNet (VNet injection) with forced tunneling enabled, and route egress through a firewall such as Azure Firewall or a user-defined route to an NVA. VNet injection gives you control over the subnets, NSGs, and routing, and forced tunneling redirects all outbound traffic to your inspection appliance. This is the documented architecture for secure, no-public-IP Databricks deployments.

Answer

Configure service endpoints for Azure Storage and Azure Data Lake Storage.

Answer

Apply network security groups (NSGs) to the subnet that restrict outbound traffic.

Answer

Enable Azure Private Link for the Databricks workspace.

Question 8

Your company is migrating an on-premises SQL Server database to Azure SQL Database. The database includes a large fact table with hourly updates. You need to minimize downtime during migration. Which Azure service should you use to replicate data continuously?

Accepted Answer

Use Azure Database Migration Service with online migration mode. Azure Database Migration Service (DMS) with online migration mode uses continuous change data capture (CDC) to replicate ongoing changes from the source SQL Server to Azure SQL Database with minimal downtime. This is the only option that supports near-zero downtime migration by synchronizing data continuously until the final cutover, which is critical for a large fact table with hourly updates.

Answer

Use Azure SQL Managed Instance as a target

Answer

Use Azure Data Factory with a copy activity

Answer

Use Azure Synapse Link for SQL Server

Question 9

You need to monitor the performance of an Azure Stream Analytics job in real time. Which Azure service should you use to track the job's resource utilization (e.g., SU % utilization) and set up alerts when the job is approaching its capacity?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service for real-time monitoring of Azure Stream Analytics jobs, providing metrics such as SU % utilization, watermark delay, and input/output events. It allows you to create alert rules based on these metrics to notify when the job approaches capacity limits.

Answer

Azure Advisor

Answer

Microsoft Sentinel

Answer

Azure Log Analytics

Question 10

Your company uses Azure Data Lake Storage Gen2 and needs to implement a data retention policy that automatically deletes files older than 90 days in a specific container. What should you use?

Accepted Answer

Azure Storage lifecycle management rule with a filter for the container and a delete action after 90 days.. Azure Storage lifecycle management policies are the native, server-side mechanism for automatically transitioning or deleting blobs based on age. A rule can be scoped with a prefix filter matching the specific container and configured with a delete action after 90 days, executing automatically without any external orchestrator. This is the correct, cost-effective, and operationally simple solution for ADLS Gen2 retention.

Answer

Azure Data Factory pipeline with a Delete activity scheduled to run daily.

Answer

Azure Policy with a deny effect for files older than 90 days.

Answer

Azure Purview data lifecycle policy.

Question 11

You need to store JSON files from an external partner in Azure Blob Storage. The files contain sensitive financial data. Which access method provides the highest security while allowing the partner to upload files?

Accepted Answer

Generate a shared access signature (SAS) with write-only permission and expiry time. A Shared Access Signature (SAS) with write-only permission and an expiry time provides delegated, time-limited access to Azure Blob Storage without exposing the storage account key. This ensures the partner can upload JSON files but cannot read, modify, or list existing blobs, and access automatically revokes after the expiry, meeting the highest security requirement for sensitive financial data.

Answer

Share the storage account access key with the partner

Answer

Configure a firewall to allow only the partner's IP address

Answer

Enable anonymous public access to a container

Question 12

Match the Azure service to its primary data processing use case. Drag each service on the left to the correct use case on the right.

Services: Azure Databricks, Azure Stream Analytics, Azure Data Factory, Azure Synapse Analytics
Use Cases: 
- Real-time event processing
- Orchestration of ETL pipelines
- Big data analytics with Spark
- Enterprise data warehousing

Accepted Answer

Azure Databricks - Big data analytics with Spark. Each Azure service maps to its canonical primary use case: Azure Databricks is the managed Apache Spark platform for big data analytics and ML; Azure Stream Analytics handles real-time event stream processing; Azure Data Factory is the cloud ETL/ELT orchestration service; and Azure Synapse Analytics is the enterprise data warehousing and analytics service. These are the standard DP-203 service-to-purpose mappings.

Question 13

You are a data engineer at a healthcare analytics company. The company uses Azure Data Factory (ADF) to orchestrate data pipelines that ingest patient data from on-premises SQL Server databases into Azure Synapse Analytics. Recently, the pipeline has been failing intermittently with the following error: 'Failure happened on 'Sink' side. ErrorCode=SqlFailedToConnect, Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException, Message=Cannot connect to SQL Server Database. The TCP connection to the host <server_name>, port 1433 has failed. Error: 'Connection timed out.'.' The on-premises SQL Server is behind a corporate firewall. The ADF self-hosted integration runtime (SHIR) is installed on a VM inside the corporate network. You have verified that the SHIR is running and that the SQL Server is accessible from the SHIR VM using SQL Server Management Studio (SSMS). The error occurs sporadically, not consistently. What is the most likely cause of the intermittent connection timeout?

Accepted Answer

The corporate firewall or network device is closing idle TCP connections to the SQL Server database.. The intermittent nature of the timeout, combined with the fact that the SHIR VM can connect to SQL Server via SSMS, strongly suggests that the corporate firewall or a network intermediary (such as a load balancer or NAT device) is closing idle TCP connections. ADF pipelines may hold connections open between activities or during long-running data transfers, and if no keep-alive packets are sent within the firewall's idle timeout window (commonly 4–30 minutes), the firewall drops the TCP session. When ADF attempts to reuse that connection, it receives a 'Connection timed out' error because the socket is no longer valid.

Answer

The data being transferred is skewed, causing the sink to be overwhelmed.

Answer

The SQL Server database is experiencing high CPU utilization during the pipeline execution window.

Answer

The self-hosted integration runtime is running out of memory during peak loads.

Question 14

You are a data engineer for a financial services company. The company uses Azure Data Lake Storage Gen2 as its data lake. You have a directory structure where each customer has a folder containing transaction files in CSV format. The security team requires that each customer's data be accessible only to that customer's users. You need to implement fine-grained access control using Azure Data Lake Storage Gen2's POSIX-like ACLs. However, you have thousands of customers, and managing ACLs individually is not feasible. What should you do?

Accepted Answer

Create an Azure AD group for each customer, add users to the group, and assign ACLs to the group on the customer folder. Azure Data Lake Storage Gen2 supports POSIX-like ACLs that can be assigned to Microsoft Entra ID security groups. By creating one Microsoft Entra ID group per customer, adding the customer's users to that group, and then assigning the group the appropriate read/execute ACLs on the customer's folder, you achieve scalable, fine-grained access control without managing thousands of individual user ACLs. This approach aligns with the principle of least privilege and simplifies administration.

Answer

Create a shared access signature (SAS) token for each customer and distribute it securely

Answer

Use POSIX ACLs on each customer folder, assigning permissions to individual user identities

Answer

Use row-level security in Azure Data Lake Storage Gen2

Question 15

You need to monitor an Azure Data Factory pipeline for failures and send an email notification when a pipeline run fails. Which Azure service should you use to create an alert based on the pipeline run metrics?

Accepted Answer

Azure Monitor. Azure Monitor can create alerts based on ADF metrics like 'Failed pipeline runs'. Option A is wrong because Microsoft Sentinel is for security. Option C is wrong because Azure Service Health monitors Azure service health, not pipeline runs. Option D is wrong because Azure Log Analytics is for log queries, not alerting.

Answer

Microsoft Sentinel

Answer

Azure Service Health

Answer

Azure Log Analytics