DP-203 Practice Test 18 — 15 Questions

Question 1

Your company uses Azure Databricks for data processing. You need to ensure that spark jobs cannot access certain storage accounts. What is the most secure approach?

Accepted Answer

Use Azure RBAC to grant specific storage account permissions to the Azure Databricks managed identity.. Using Azure RBAC to grant specific storage account permissions to the Azure Databricks managed identity is the most secure approach because it eliminates the need to store or transmit storage account keys, and it enforces least-privilege access through Microsoft Entra ID identities. The managed identity is automatically managed by Azure, so credentials are rotated and never exposed to notebooks or code. This aligns with the principle of avoiding long-lived secrets and centralizing access control.

Answer

Store storage account keys in Azure Key Vault and retrieve them in notebooks.

Answer

Use shared access keys and restrict their usage.

Answer

Disable public network access on storage accounts.

Question 2

You are designing a data pipeline that uses Azure Data Factory to load data from an FTP server to Azure Data Lake Storage. The FTP server requires authentication with username and password. Which type of linked service should you create?

Accepted Answer

FTP. Azure Data Factory provides a native FTP connector that supports username/password authentication for connecting to FTP servers. This linked service type is specifically designed to handle the FTP protocol (RFC 959) and allows you to copy data directly from an FTP server to Azure Data Lake Storage without requiring any additional gateways or custom activities.

Answer

Azure Blob Storage

Answer

HTTP

Answer

Rest service

Question 3

You are implementing a data processing solution in Azure Databricks. The solution must read data from Azure Data Lake Storage Gen2, transform it using PySpark, and write the results back to a different location in the same storage account. You need to authenticate to the storage account securely without storing secrets in the notebook. What should you use?

Accepted Answer

Azure Key Vault-backed secret scope. Azure Key Vault-backed secret scopes allow you to securely reference secrets without storing them in the notebook. Option A is wrong because storing a client secret directly in the notebook is insecure. Option C is wrong because SAS tokens can be exposed and are less secure. Option D is wrong because storage account access keys are long-lived and should not be used in notebooks.

Answer

Service Principal with a client secret stored in the notebook

Answer

Shared access signature (SAS) token

Answer

Storage account access key

Question 4

You need to monitor the performance of your Azure Synapse Analytics dedicated SQL pool. Which metric should you use to identify queued queries due to concurrency limits?

Accepted Answer

Queued queries. The 'Queued queries' metric in Azure Synapse Analytics dedicated SQL pool specifically counts queries waiting for resources due to concurrency limits, making it the direct indicator of queuing caused by insufficient concurrency slots. Monitoring this metric helps identify when the workload exceeds available concurrency and queries are being held in the queue.

Answer

DWU percentage

Answer

Active queries

Answer

Memory percentage

Question 5

You have an Azure Databricks notebook that processes data from a Delta table. The notebook runs slowly due to many small files. You need to optimize the Delta table for faster reads. Which Delta Lake operation should you run?

Accepted Answer

Run OPTIMIZE to compact small files.. The OPTIMIZE command in Delta Lake compacts many small files into larger ones by rewriting data files based on the table's partitioning scheme. This reduces the number of files that need to be read during queries, significantly improving read performance. Since the notebook is slow due to many small files, OPTIMIZE directly addresses the root cause.

Answer

Run CONVERT TO DELTA on the underlying Parquet files.

Answer

Run DESCRIBE HISTORY to analyze file sizes.

Answer

Run VACUUM to delete old files.

Question 6

Your organization uses Azure Synapse Analytics dedicated SQL pool. You need to ensure that all data at rest in the SQL pool is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault encrypts the dedicated SQL pool's data at rest (data files, log files, backups) and allows the organization to control and rotate the encryption key. TDE is the native at-rest encryption mechanism for Azure Synapse dedicated SQL pools. Configuring it with a customer-managed key in Key Vault meets the requirement precisely.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Answer

Configure Dynamic Data Masking to obfuscate sensitive data.

Answer

Enable Azure Storage Service Encryption with a customer-managed key.

Question 7

You are designing a data processing solution in Azure that must handle both batch and streaming data. The solution should use a common storage layer for both and support schema evolution. Which TWO technologies should you recommend?

Accepted Answer

Delta Lake (on Azure Databricks). Delta Lake (on Azure Databricks) is correct because it provides ACID transactions, scalable metadata handling, and unifies batch and streaming data processing on a data lake, with native schema evolution. Azure Data Lake Storage Gen2 is correct because it provides the common storage layer for both batch and streaming data. Azure Event Hubs is a streaming ingestion service, not a common storage layer, and it does not provide batch processing or unified storage; therefore it is not a correct recommendation for this requirement.

Answer

Azure Event Hubs

Answer

Azure SQL Database

Answer

Apache Kafka on HDInsight

Question 8

You have a mission-critical pipeline that processes financial transactions in Azure Synapse Analytics. The pipeline uses Azure Data Factory with a mapping data flow to transform data. You need to ensure high availability and minimal data loss in case of a regional failure. What should you implement?

Accepted Answer

Store the source data in an RA-GRS storage account and use Azure Data Factory to copy from the secondary endpoint.. Using an RA-GRS storage account ensures geo-redundancy with a readable secondary endpoint, and Azure Data Factory can copy data from that secondary endpoint in case of a regional failure. This provides high availability and minimal data loss for the source data, while the mapping data flow transformation can proceed after the copy. Option D is incorrect because Azure Synapse Link for Cosmos DB changes the architecture (using Cosmos DB as source) and does not directly provide high availability for the existing ADF pipeline with mapping data flows; it introduces a different technology stack that may not meet the requirement of pipeline resilience.

Answer

Configure the pipeline to retry on failure and manually restore from backup.

Answer

Use Azure SQL Database active geo-replication as the source.

Answer

Use Azure Synapse Link for Cosmos DB to enable near real-time analytics with multi-region writes.

Question 9

A data engineering team is building a batch processing solution for a financial services company. Data is ingested daily from multiple sources into Azure Data Lake Storage Gen2 in CSV format. The data must be transformed (filtered, aggregated, joined) and loaded into Azure Synapse Analytics dedicated SQL pool. The team must optimize for cost and performance. The total data volume is 2 TB per day. The team has the following options:

Option A: Use Azure Data Factory pipelines with copy activity to load raw CSV files into Synapse staging tables, then use T-SQL stored procedures in Synapse to perform transformations.

Option B: Use Azure Databricks with Auto Loader to incrementally ingest CSV files, perform transformations in Spark, and write the results to Synapse using the Spark Synapse connector.

Option C: Use Azure Data Factory with mapping data flows to transform the data in a serverless environment and then write to Synapse.

Option D: Use Azure Synapse Pipelines (built on ADF) with a notebook activity that runs a PySpark notebook in Synapse Spark pool to transform and load data.

Which option should the team choose to minimize cost and management overhead while meeting performance requirements?

Accepted Answer

Option C. Correct answer: B (Option C — Azure Data Factory mapping data flows). Mapping data flows execute on a serverless Azure Data Factory integration runtime, scaling automatically and costing only per run, which minimizes cost and management overhead. Answer choice A (Option B, Azure Databricks with Auto Loader) requires managing Spark clusters. Answer choice C (Option A, Azure Data Factory copy activity plus T-SQL stored procedures) requires staging tables and stored procedures. Answer choice D (Option D, Synapse Pipelines with a notebook activity) requires managing Synapse Spark pools. Therefore, mapping data flows are the most cost-effective and lowest-overhead option.

Answer

Option B

Answer

Option A

Answer

Option D

Question 10

Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to grant a service principal read and write access to a specific directory without granting access to the parent directories. What should you use?

Accepted Answer

Set ACLs on the directory with default ACLs for the service principal.. Azure RBAC roles for Azure Storage cannot be scoped to a directory or file; they are assigned at the storage account or container level. To grant a service principal read and write access to a specific directory in an Azure Data Lake Storage Gen2 account with hierarchical namespace enabled, use access control lists (ACLs) on that directory. Default ACLs on the directory will be inherited by newly created child items. Option A is incorrect because the Storage Blob Data Contributor role cannot be assigned at the directory level. Option B is incorrect because a managed identity is an identity, not a permission mechanism. Option C is incorrect because stored access policies are used for shared access signatures (SAS), not for granting directory access.

Answer

Assign the Storage Blob Data Contributor role at the directory level using RBAC.

Answer

Use a managed identity and assign it to the directory.

Answer

Create a stored access policy on the directory.

Question 11

Which TWO Azure services can be used to monitor data pipeline runs and set up alerts for failures in Azure Data Factory?

Accepted Answer

Azure Log Analytics. Options B and D are correct. Azure Monitor is the primary service for collecting Azure Data Factory metrics and logs and for configuring alerts. Azure Log Analytics is used to query those logs and create failure alerts. Option A is not a standalone Azure service; Azure Data Factory monitoring views are a built-in feature and do not independently provide alerting. Option C is a SIEM/SOAR security service, not for pipeline monitoring. Option E is for automation, not monitoring/alerting.

Answer

Azure Data Factory monitoring views

Answer

Azure Sentinel

Answer

Azure Automation

Question 12

You are building a batch processing solution in Azure Synapse Analytics that reads data from a dedicated SQL pool, applies complex transformations using Synapse Spark, and writes the results back to the dedicated SQL pool. The pipeline must run on a schedule and handle transient failures with retries. Which approach should you use?

Accepted Answer

Use Azure Synapse Pipelines with a Notebook activity that runs Spark code. Azure Synapse Pipelines with a Notebook activity is the correct approach because it natively integrates Synapse Spark for complex transformations and supports scheduling and retry policies for transient failures. This allows you to read from a dedicated SQL pool, process data in Spark, and write back to the pool without external orchestration, leveraging the built-in pipeline reliability features.

Answer

Use Azure Batch with a custom application to run Spark jobs

Answer

Use Azure Functions to trigger Spark jobs on demand

Answer

Use Azure Databricks with Auto Loader and Delta Live Tables

Question 13

You are designing a data lake in Azure Data Lake Storage Gen2 for a large enterprise. You need to ensure that only authorized users can access the data, and you must implement the principle of least privilege. Which security mechanism should you use to grant fine-grained access to specific directories and files without modifying the underlying storage account firewall settings?

Accepted Answer

Azure RBAC roles combined with POSIX-like ACLs. Azure RBAC roles combined with POSIX-like ACLs is correct because Azure Data Lake Storage Gen2 supports a hierarchical namespace that enables POSIX-style access control lists (ACLs) at the directory and file level, allowing fine-grained permissions (read, write, execute) for specific Microsoft Entra ID principals. RBAC handles coarse-grained control at the management group, subscription, or storage account scope, while ACLs provide the granular, object-level authorization required for least privilege. This combination does not require altering the storage account firewall, which controls network access rather than identity-based permissions.

Answer

Managed identities for Azure resources

Answer

Storage account firewall rules

Answer

Shared access signatures (SAS)

Question 14

You have an Azure Data Factory pipeline that uses a Self-Hosted Integration Runtime (SHIR) to copy data from an on-premises Oracle database to Azure Blob Storage. The pipeline is failing with a connectivity error. You have verified that the SHIR is running and the network firewall allows outbound traffic to Azure. What is the most likely cause of the failure?

Accepted Answer

The SHIR cannot reach the Oracle database due to a network firewall.. The most likely cause is that the SHIR cannot reach the on-premises Oracle database due to a network firewall. While the SHIR can connect to Azure outbound, the connection from the SHIR to the Oracle database must also be allowed through any on-premises firewalls. Option A is incorrect because if the SHIR were not registered, you would see a different error. Option C is incorrect because the SHIR only requires outbound connectivity to Azure, not inbound. Option D is incorrect because Azure Key Vault is not required for basic connectivity; it is used for storing credentials.

Answer

The SHIR is not registered with Azure Data Factory.

Answer

The SHIR requires inbound port 443 from Azure to on-premises.

Answer

The SHIR does not have access to Azure Key Vault.

Question 15

You are designing a data processing solution for an e-commerce company. The company receives millions of clickstream events per hour from their website and needs to aggregate the data by product category and windowed time intervals for real-time dashboards. You need to minimize latency and cost. Which service should you use?

Accepted Answer

Azure Stream Analytics. (Azure Stream Analytics) is the best choice because it is purpose-built for real-time stream processing, supports windowed aggregations, and integrates with Power BI for dashboards. Option A (Azure Databricks Structured Streaming) can handle streaming but is more complex and typically more expensive for simple aggregations. Option B (Azure Data Factory) is for batch data movement, not real-time. Option D (Azure Synapse Pipelines) is for orchestrating data movement, not real-time processing.

Answer

Azure Databricks Structured Streaming

Answer

Azure Data Factory

Answer

Azure Synapse Pipelines