DP-203 Practice Test 23 — 15 Questions

Question 1

Your company uses Azure Blob Storage to store backups. You need to ensure that data is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys. Azure Storage Service Encryption (SSE) encrypts data at rest and supports customer-managed keys stored in Azure Key Vault. Option A is incorrect because Azure Purview is a data governance service, not for encryption. Option B is incorrect because Azure Disk Encryption is used for virtual machine disks, not Blob Storage. Option D is incorrect because Azure Information Protection is for classification and labeling. Therefore, option C is correct.

Answer

Azure Purview

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Question 2

You are monitoring an Azure Data Factory pipeline that runs daily to load data from an on-premises SQL Server to Azure Synapse Analytics. The pipeline has been failing intermittently with timeout errors. You need to configure alerts to notify the team when the pipeline fails. What is the most efficient way to achieve this?

Accepted Answer

Create an alert rule in Azure Monitor using the 'Pipeline failed runs' metric.. The most efficient way to alert on pipeline failures is to create an alert rule in Azure Monitor using the 'Pipeline failed runs' metric (Option C). This metric is specific to Data Factory and allows direct alerting without additional logging setup. Option A is inefficient because it requires enabling diagnostic settings and creating a log search alert, adding latency and cost. Option B, Azure Service Health alerts, only notify about Azure service health issues, not pipeline failures. Option D, Microsoft Defender XDR, is a security solution unrelated to pipeline monitoring.

Answer

Enable diagnostic settings to send pipeline logs to a Log Analytics workspace and create a log search alert.

Answer

Use Azure Service Health alerts to notify when Data Factory is unhealthy.

Answer

Configure Microsoft Defender XDR to monitor pipeline activities.

Question 3

You are reviewing an ARM template that assigns a role. What role is being assigned, and at what scope?

Accepted Answer

Storage Blob Data Contributor at the resource group scope. The roleDefinitionId in the ARM template corresponds to 'Storage Blob Data Contributor' and the scope is set to the resource group. Option A is wrong because the scope is not subscription level. Option B is wrong because the role is not 'Storage Blob Data Reader' (the GUID for that role is different). Option D is wrong because the scope is the resource group, not the storage account.

Answer

Storage Blob Data Owner at the subscription scope

Answer

Storage Blob Data Reader at the resource group scope

Answer

Storage Blob Data Contributor at the storage account scope

Question 4

You are designing a data processing solution in Azure Data Factory that uses mapping data flows. You need to perform type conversions on incoming data. Which two transformations can be used to change data types? (Choose two.)

Accepted Answer

Derived Column. Options B and E are correct. Derived Column can change data types through expressions, and Select can cast types during column projection. Option C (Assert) is incorrect because it only validates and routes rows based on conditions; it does not convert data types. Option A (Conditional Split) and Option D (Sort) are also incorrect.

Answer

Conditional Split

Answer

Assert

Answer

Sort

Question 5

You are a data engineer working for a logistics company. You have an existing Azure Data Factory pipeline that ingests data from a REST API to Azure Data Lake Storage Gen2. The API has rate limiting that can cause failures. You need to implement a solution that can handle rate limiting by retrying with exponential backoff. The pipeline should also log the number of retries for each API call. What should you do?

Accepted Answer

Use a Web activity with a Until loop to implement custom retry logic.. Azure Data Factory Copy activity does not support exponential backoff; the retry interval is fixed. Using a Web activity inside an Until loop allows you to implement custom retry logic with exponential backoff by adjusting the wait time dynamically. This also enables logging the number of retries. Option A is incorrect because the Copy activity's retry uses a fixed interval, not exponential backoff. Option C is more complex than necessary. Option D introduces an additional service without leveraging ADF's orchestration capabilities.

Answer

Configure the Copy activity with retry policy using exponential backoff by setting the retry count and retry interval. Enable diagnostic logs to capture retry details.

Answer

Use an Azure Function as a custom activity in Azure Data Factory to implement retry logic with exponential backoff.

Answer

Use Azure Logic Apps to call the API and then copy the response to Azure Data Lake Storage Gen2.

Question 6

You are designing a data processing solution in Azure Synapse Analytics. The solution must ensure that data at rest in a dedicated SQL pool is encrypted using customer-managed keys (CMK) stored in Azure Key Vault. The encryption should be enabled at the database level. What should you configure?

Accepted Answer

Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault provides database-level encryption for dedicated SQL pools in Azure Synapse Analytics. TDE encrypts data at rest, and using a customer-managed key (CMK) allows the organization to control the key lifecycle. Option B is incorrect because Azure Purview is for data governance and classification, not encryption. Option C is incorrect because Azure Disk Encryption encrypts VM disks, not the SQL pool database. Option D is incorrect because Always Encrypted is a column-level encryption feature, not for full database encryption.

Answer

Azure Purview data classification and encryption policies.

Answer

Azure Disk Encryption on the nodes hosting the dedicated SQL pool.

Answer

Always Encrypted with keys stored in Azure Key Vault.

Question 7

You are using Azure Data Explorer to monitor real-time sensor data. You run the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

To visualize the count of events every 5 minutes over the last hour. The query uses `summarize count()` with `bin(Timestamp, 5m)` to count events in 5-minute intervals and then renders a timechart, effectively visualizing the count of events every 5 minutes over the last hour. Option A is incorrect because detecting anomalies would require functions like `series_decompose_anomalies`. Option B is incorrect because the query does not calculate an average; it counts events. Option D is incorrect because it does not filter by a specific sensor; it aggregates all events.

Answer

To detect anomalies in the sensor data

Answer

To calculate the average value of a numeric column over time

Answer

To filter events from a specific sensor

Question 8

Your team has deployed an Azure Stream Analytics job that writes output to Azure Cosmos DB. You need to monitor the job for data latency and ensure it meets a service-level agreement (SLA) of under 10 seconds from input to output. Which metric should you track in Azure Monitor?

Accepted Answer

Watermark delay.. Watermark delay is the correct metric to monitor for data latency because it measures the maximum time between an input event being received and the corresponding output being produced. A watermark delay consistently under 10 seconds ensures the SLA is met. Output events (A) track the number of output events, not latency. Runtime errors (B) indicate failures, not latency. Input events (D) track the number of input events, not latency.

Answer

Output events.

Answer

Runtime errors.

Answer

Input events.

Question 9

You need to monitor the performance of an Azure Stream Analytics job that processes real-time IoT data. Which metric indicates the number of events that are being dropped or delayed due to insufficient processing capacity?

Accepted Answer

Backlogged input events.. Backlogged input events (C) measures the number of events that are queued awaiting processing, indicating that the job is unable to keep up with the input rate. High backlog suggests insufficient processing capacity, leading to dropped or delayed events. Watermark delay (A) measures the time lag in processing, but does not directly count events dropped. Input events (D) is the total received, not dropped/delayed. Output events (B) is the total sent.

Answer

Watermark delay.

Answer

Output events.

Answer

Input events.

Question 10

You have an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline is failing with a 'Gateway is offline' error. What is the most likely cause?

Accepted Answer

The Self-Hosted Integration Runtime is not running or cannot connect to the Azure Data Factory service.. The Self-Hosted Integration Runtime (SHIR) acts as the gateway between on-premises data sources and Azure Data Factory. If the SHIR is not running or cannot communicate with the Azure Data Factory service, the pipeline fails with a 'Gateway is offline' error. Option A is incorrect because using the Azure Integration Runtime for an on-premises source would cause a different error, not 'Gateway is offline'. Option B is incorrect because region configuration for the Azure Integration Runtime is irrelevant when a SHIR is required. Option C is incorrect because the error relates to the gateway, not to SQL Server remote connection settings.

Answer

The Azure Integration Runtime is being used instead of a Self-Hosted Integration Runtime.

Answer

The Azure Integration Runtime is not configured to use the correct region.

Answer

The source SQL Server is not configured to allow remote connections from Azure.

Question 11

You have an Azure Synapse Analytics serverless SQL pool. You need to monitor the number of queries that are currently executing. Which dynamic management view should you query?

Accepted Answer

sys.dm_exec_requests. Sys.dm_exec_returns detailed information about each request currently executing on the serverless SQL pool, including its state, command, and session ID. This DMV is specifically designed for monitoring active queries.

Option A (sys.dm_resource_governor_workload_groups) shows workload group configuration and resource statistics, not current requests.

Option B (sys.dm_exec_query_stats) provides cumulative performance statistics for cached query plans, not currently executing queries.

Option D (sys.dm_exec_sessions) contains session-level information but does not indicate which sessions are actively executing a request.

Answer

sys.dm_resource_governor_workload_groups

Answer

sys.dm_exec_query_stats

Answer

sys.dm_exec_sessions

Question 12

You need to implement column-level security in Azure Synapse Analytics to restrict access to salary information. Only users with the 'HRManager' role should see salary columns. Which feature should you use?

Accepted Answer

Column-level security using GRANT on columns. Column-level security (CLS) in Azure Synapse Analytics uses GRANT on specific columns to restrict access. Option A is incorrect because row-level security filters rows, not columns. Option B is incorrect because dynamic data masking obfuscates data but does not prevent access. Option D is incorrect because Azure Purview is a governance tool, not a security enforcement mechanism.

Answer

Row-level security using security predicates

Answer

Dynamic data masking

Answer

Azure Purview data classification

Question 13

Your Azure Synapse Analytics dedicated SQL pool is experiencing performance degradation. You notice that some queries are being queued due to resource class conflicts. What should you implement to optimize performance and reduce queuing?

Accepted Answer

Configure workload management with workload groups and classifiers. Workload management with workload groups and classifiers allows you to assign queries to different resource classes and prioritize them, directly addressing resource class conflicts and reducing queuing. Option A is incorrect: scaling the pool to a higher DWU increases overall resources but does not specifically manage resource class contention; it may also incur additional cost without solving the root issue. Option C is incorrect: materialized views improve query performance by pre-aggregating data but do not affect concurrency or queuing. Option D is incorrect: result-set caching reduces repeated computation for identical queries but does not resolve queuing caused by resource class conflicts.

Answer

Scale the dedicated SQL pool to a higher DWU level

Answer

Create materialized views for the most common aggregations

Answer

Enable result-set caching for frequently run queries

Question 14

You are reviewing an ARM template for Azure SQL Database security alert policy. Based on the exhibit, which threats will trigger an alert?

Accepted Answer

SQL Injection Vulnerability and Data Exfiltration. The ARM template shows the security alert policy is enabled (state = Enabled). The disabledAlerts list includes 'Sql_Injection' and 'Access_Anomaly', meaning these two alert types are suppressed and will not trigger alerts. All other alert types (e.g., Sql_Injection_Vulnerability, Data_Exfiltration, Unsafe_Action) remain enabled and will trigger alerts. Therefore, option D is correct because SQL Injection Vulnerability and Data Exfiltration are among the enabled threats.

Answer

All alerts except SQL Injection and Access Anomaly

Answer

No alerts will be triggered because the policy is disabled

Answer

SQL Injection and Access Anomaly

Question 15

You are designing a security strategy for Azure Synapse Analytics. The solution must prevent users from accessing sensitive columns in a dedicated SQL pool, such as Social Security numbers, unless they have explicit permission. Which feature should you use?

Accepted Answer

Column-level security.. Column-level security (CLS) restricts access to specific columns by granting or denying SELECT permissions on individual columns. Option C (Dynamic data masking) obfuscates data at query time but does not prevent access, as users can still see the data if they bypass masking. Option B (Azure Purview) is a data governance service for cataloging and classifying data, not for access control. Option D (Row-level security) filters rows based on user context, not columns.

Answer

Azure Purview data classification.

Answer

Dynamic data masking.

Answer

Row-level security (RLS).