DP-203 Practice Exam 3 — 20 Questions

Question 1

Match each storage redundancy option to its description in Azure Storage.

Question 2

Match each performance optimization technique to its description.

Question 3

A company uses Azure Synapse Analytics to process large datasets. They need to transform JSON data stored in Azure Data Lake Storage Gen2 into a star schema. Which data processing approach minimizes data movement and leverages the compute closest to the data?

Accepted Answer

Create external tables on the JSON files using PolyBase, then use CREATE EXTERNAL TABLE AS SELECT (CETAS) to write transformed Parquet files.. Option D is correct because it uses PolyBase external tables and CETAS to transform JSON data directly in Azure Data Lake Storage Gen2, minimizing data movement by leveraging the compute power of the dedicated SQL pool or serverless SQL pool closest to the data. This approach reads JSON in place, transforms it into Parquet format, and writes the star schema tables back to the data lake without copying data to an intermediate store.

Answer

Use Azure Data Factory to copy the JSON data into Azure SQL Database, then use T-SQL to transform.

Answer

Use Azure Data Factory with SSIS to transform and load into dedicated SQL pool.

Answer

Load data into a Spark DataFrame in Synapse notebooks, transform, and write back.

Question 4

A company uses Azure Databricks to process streaming data from Event Hubs. The data is written to a Delta table. The job occasionally fails due to checkpoint corruption. Which THREE measures should you implement to improve reliability?

Accepted Answer

Configure checkpointing to a durable storage like Azure Data Lake Storage.. Option A is correct because checkpointing to durable storage like Azure Data Lake Storage (ADLS) ensures that streaming progress metadata is persisted across cluster restarts and failures. ADLS provides high durability and availability, preventing checkpoint corruption that can occur with local or ephemeral storage, thereby enabling exactly-once processing guarantees in Structured Streaming.

Answer

Increase the batch interval to reduce load.

Answer

Increase the cluster size to handle spikes.

Question 5

Refer to the exhibit. An Azure Data Factory instance uses a self-hosted integration runtime. The exhibit shows the properties of the integration runtime. The data engineer notices that copy activities are failing with errors indicating that the integration runtime is not available. What is the most likely cause?

Accepted Answer

The integration runtime version is outdated and needs to be manually updated. Option C is correct because the exhibit shows the integration runtime version as '5.24.8345.1' and the status as 'Online', but copy activities are failing. The most likely cause is that the self-hosted IR version is outdated and no longer compatible with the Azure Data Factory service endpoints, leading to connectivity failures. Auto-update being disabled (Option B) would prevent automatic updates, but the core issue is the outdated version itself, which requires manual intervention to update.

Answer

The integration runtime status is "Offline"

Answer

Auto-update is disabled, preventing the IR from updating

Answer

Self-contained interactive authoring is disabled, causing connectivity issues

Question 6

You need to audit all data access to an Azure Storage account. Which Azure service should you enable?

Accepted Answer

Azure Storage analytics logs and send to Log Analytics workspace. Azure Storage analytics logs capture detailed information about successful and failed requests to a storage account, including authentication details, IP addresses, and operation types. By sending these logs to a Log Analytics workspace, you can query and analyze them using KQL, enabling comprehensive auditing of all data access. This is the correct service for auditing because it provides the granular, queryable logs required for security and compliance audits.

Answer

Azure Policy to audit storage account access

Answer

Azure Monitor metrics

Answer

Azure Security Center

Question 7

Match each Azure service tier to its description.

Question 8

Match each Azure security feature to its description.

Question 9

A company uses Azure Data Factory to orchestrate an ETL pipeline that copies data from an on-premises SQL Server to Azure Synapse Analytics. The pipeline runs hourly and uses a self-hosted integration runtime. Recently, the pipeline started failing with timeout errors. The on-premises SQL Server is healthy and the network is stable. What is the most likely cause and solution?

Accepted Answer

The self-hosted integration runtime is under-provisioned; scale up the VM or add more nodes. Option B is correct because timeouts often occur when the self-hosted IR is overloaded or has insufficient resources, and scaling up or adding nodes resolves the issue. Option A is wrong because the integration runtime version is automatically updated. Option C is wrong because the source query timeout is set to 120 seconds by default and increasing it may mask the problem. Option D is wrong because staging is used for large data transfers, but the issue is likely IR performance.

Answer

The self-hosted integration runtime version is outdated; update it to the latest version

Answer

The copy activity is not using staging; enable staging through Azure Blob Storage

Answer

The source query timeout in the copy activity is too low; increase it to 3600 seconds

Question 10

A company uses Azure Synapse Analytics with dedicated SQL pools. They need to allow a data scientist to read all tables in the 'sales' schema but prevent access to columns containing personally identifiable information (PII). Which feature should be used?

Accepted Answer

Column-level security. Column-level security (C) is the correct choice because it allows you to restrict access to specific columns in a table, such as PII columns, while granting read access to all other columns in the 'sales' schema. This is achieved by defining a GRANT SELECT statement on the table with a column list, or by using a security policy with a filter predicate that blocks access to sensitive columns. Unlike Dynamic Data Masking, which obfuscates data at query time but does not prevent the user from seeing the masked values in certain scenarios, Column-level security actually denies access to the specified columns entirely.

Answer

Dynamic data masking

Answer

Row-level security

Answer

Azure Active Directory authentication

Question 11

A company uses Azure Synapse Analytics dedicated SQL pool. They need to ensure that only users with a specific Azure AD group can query a particular schema. Which approach should they use?

Accepted Answer

Use the GRANT statement to grant SELECT on the schema to the Azure AD group.. The GRANT statement in Azure Synapse dedicated SQL pool allows you to assign permissions directly to Azure AD groups. By granting SELECT on the schema to the specific Azure AD group, only members of that group can query objects within that schema, meeting the requirement precisely.

Answer

Configure a server-level firewall rule to block other users.

Answer

Create a row-level security policy on all tables in the schema.

Answer

Apply dynamic data masking to the schema.

Question 12

You are designing data security for Azure Data Lake Storage Gen2. The requirement is to prevent data from being accessed by anyone outside the corporate network. Which feature should you enable?

Accepted Answer

Use Azure Private Endpoint or service endpoint with a VNet.. Azure Private Endpoint or service endpoint with a VNet ensures that all traffic to the storage account stays within the corporate network and never traverses the public internet. Private Endpoint assigns a private IP from the VNet to the storage account, effectively isolating it from public access. This meets the requirement to prevent access from outside the corporate network by enforcing network-level isolation.

Answer

Assign RBAC roles to deny access to all except corporate users.

Answer

Configure IP firewall rules to allow only corporate IP ranges.

Answer

Enable encryption at rest using customer-managed keys.

Question 13

A data engineer is designing a monitoring solution for Azure Data Factory pipelines. They need to be alerted when a pipeline run fails or when the duration exceeds a threshold. The solution must minimize cost and operational overhead. Which approach should they use?

Accepted Answer

Use Azure Monitor metrics and activity logs to create alert rules for pipeline failures and duration.. Option B is correct because Azure Monitor provides native, cost-effective alerting for Azure Data Factory pipelines using metrics (e.g., pipeline run duration) and activity logs (e.g., pipeline run failures). This approach requires no additional compute or log ingestion costs, as alerts are configured directly on the resource's monitoring data, minimizing both cost and operational overhead.

Answer

Configure Azure Event Grid to send pipeline run events to Azure Functions for alerting.

Answer

Send all pipeline run logs to Log Analytics and create alert rules based on custom log searches.

Answer

Create an Azure Logic App that runs every minute to check pipeline run status via REST API.

Question 14

A company uses Azure Key Vault to store secrets for data pipelines. They need to rotate the secrets automatically every 90 days. What should they implement?

Accepted Answer

Configure Key Vault secret rotation with an expiration date of 90 days.. Option C is correct because Key Vault supports automatic rotation with a specified expiration period. Option A is wrong because manual rotation is not automatic. Option B is wrong because Azure Policy does not rotate secrets. Option D is wrong because RBAC controls access, not rotation.

Answer

Use Azure Policy to enforce secret expiration.

Answer

Assign RBAC roles to a service principal to update the secret.

Answer

Create a manual process to update the secret in Key Vault.

Question 15

A company uses Azure Synapse Analytics with a dedicated SQL pool. Data engineers need to implement column-level security so that only users with the 'Manager' role can see salary columns. Which TWO actions should they take?

Accepted Answer

Create a security policy with a filter predicate on the salary column using the function, and set the state to ON with BLOCK predicate.. Option C is correct because column-level security in Azure Synapse Analytics dedicated SQL pools is implemented via a security policy that uses a filter predicate (a function) to restrict access to specific columns. Setting the state to ON with a BLOCK predicate ensures that unauthorized users cannot see the salary column. Option D is correct because the inline table-valued function is the predicate function that checks role membership (e.g., using IS_MEMBER('Manager')) and returns 1 or 0, which the security policy uses to filter rows.

Answer

Create a stored procedure that checks the user's role and returns the appropriate columns.

Answer

Grant the 'Manager' role SELECT permission on the security policy.

Answer

Use GRANT SELECT ON OBJECT::[dbo].[Employee](Salary) TO [Manager] to grant access to the salary column.

Question 16

A manufacturing company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled and Azure Databricks for analytics. The security team requires that all data stored in the 'raw' container be encrypted at rest using customer-managed keys. The data is ingested via Azure Data Factory. What should the data engineer configure to meet the requirement?

Accepted Answer

Configure the storage account to use Azure Key Vault for customer-managed key encryption.. Option C is correct because Azure Data Lake Storage Gen2 with hierarchical namespace supports encryption at rest using customer-managed keys (CMK) via Azure Key Vault. To meet the security requirement, the data engineer must configure the storage account's encryption settings to use a key from Azure Key Vault, which allows the organization to control and rotate the encryption keys independently of Azure.

Answer

Assign an Azure Policy that requires encryption at rest.

Answer

Enable Azure Information Protection on the storage account.

Answer

Enable the 'require secure transfer' setting on the storage account.

Question 17

Drag and drop the steps to implement Slowly Changing Dimension (SCD) Type 2 in Azure Synapse Analytics dedicated SQL pool into the correct order.

Question 18

Drag and drop the steps to convert data from CSV to Parquet format using Azure Data Factory into the correct order.

Question 19

Drag and drop the steps to implement incremental data loading using Azure Data Factory into the correct order.

Question 20

Drag and drop the steps to set up Azure Purview for data cataloging and lineage tracking into the correct order.