DP-203 Practice Test 26 — 15 Questions

Question 1

You are designing a data processing solution for an e-commerce company that uses Azure Synapse Analytics. The solution must process clickstream data from a web application. The data arrives in JSON format through Azure Event Hubs. You need to load the data into a dedicated SQL pool every 5 minutes with minimal latency. The data volume is about 100 MB every 5 minutes. You want to use PolyBase for loading. Which approach should you use?

Accepted Answer

Use Azure Data Factory with a Copy activity to copy data from Event Hubs to Azure Data Lake Storage Gen2 as JSON files, then use a PolyBase activity to load from ADLS Gen2 to the dedicated SQL pool.. Option A is correct because using Azure Data Factory to copy JSON data to ADLS Gen2 as a staging area, then using PolyBase to load into dedicated SQL pool, is efficient for small frequent loads. Option B is wrong because loading directly from Event Hubs using PolyBase is not supported. Option C is wrong because using Azure Stream Analytics adds unnecessary complexity. Option D is wrong because using Azure Databricks would require a cluster running continuously, increasing cost.

Answer

Use Azure Stream Analytics to transform the JSON data and output directly to the dedicated SQL pool.

Answer

Use Azure Databricks to read from Event Hubs, transform the data, and write to the dedicated SQL pool using JDBC.

Answer

Use PolyBase directly from Event Hubs to dedicated SQL pool by creating an external data source that points to Event Hubs.

Question 2

You are designing a data processing solution for a retail company that uses Azure Synapse Analytics. The solution must process point-of-sale (POS) data from multiple stores. The data arrives in CSV files in Azure Data Lake Storage Gen2. Each store sends a file every hour. You need to process the files as they arrive and load the data into a dedicated SQL pool. The solution must handle late-arriving files (files that arrive after the scheduled processing time) and ensure that the data is consistent. Which approach should you use?

Accepted Answer

Use Azure Data Factory with a Copy activity to load data into a staging table in the dedicated SQL pool, then use a Stored Procedure activity to merge the data into the final table.. Option D is correct because using a stored procedure with merge logic can handle upserts and late-arriving data. Azure Data Factory can execute the stored procedure after copying data to a staging table. Option A is wrong because PolyBase with external tables does not handle upserts well. Option B is wrong because Azure Databricks would be overkill for this scenario. Option C is wrong because partitioning alone does not handle late-arriving data.

Answer

Use Azure Data Factory with a Copy activity to load data into a staging table, then use a Data Flow activity to perform upserts.

Answer

Use Azure Databricks to read the CSV files, perform upserts, and write to the dedicated SQL pool using JDBC.

Answer

Use PolyBase to create external tables on the CSV files and then use CREATE TABLE AS SELECT to load into the dedicated SQL pool.

Question 3

Which THREE factors should you consider when designing a real-time streaming solution using Azure Stream Analytics to process IoT data from thousands of devices?

Accepted Answer

The batch size for output to Azure Synapse Analytics to minimize write transactions.. Option A is correct because output batching reduces the number of write operations. Option B is correct because partitioning the input stream improves parallel processing. Option D is correct because late arrival policies handle out-of-order events. Option C is wrong because reference data is typically loaded once and does not require real-time joins. Option E is wrong because Azure Stream Analytics cannot directly write to Azure Cosmos DB for NoSQL without a custom output, and even then, it is not the primary consideration for real-time processing.

Answer

The need to join input data with reference data that changes every few seconds.

Answer

The latency requirements for writing output to Azure Cosmos DB for NoSQL.

Question 4

You are reviewing a mapping data flow in Azure Data Factory that reads a CSV file from ADLS Gen2 and writes to an Azure Synapse Analytics dedicated SQL pool. The data flow includes a Derived Column transformation with the expression: `column1 == "Error" ? toString(column1) : column1`. The pipeline fails with an error indicating that the sink table could not be created. What is the most likely cause?

Accepted Answer

Using allowCopyCommand with autoCreate is not supported.. Option B is correct because `allowCopyCommand` is set to `true`, which requires the sink table to already exist. The `tableOption` is `autoCreate`, but with `allowCopyCommand` enabled, auto-create is not supported. Option A is wrong because the expression is syntactically correct. Option C is wrong because the issue is with sink, not source. Option D is wrong because the source is delimited text, not JSON.

Answer

The source file does not have a header row.

Answer

The Derived Column expression has a syntax error.

Answer

The sink dataset is configured for JSON format.

Question 5

You are developing a data processing pipeline in Azure Databricks that processes streaming data from Azure Event Hubs. You need to ensure that the pipeline can recover from failures and process data exactly once. The pipeline writes to Delta Lake. Which approach should you use?

Accepted Answer

Use Structured Streaming with a Delta Lake sink and specify a checkpoint location on Azure Data Lake Storage Gen2.. Option B is correct because Structured Streaming with checkpointing enables exactly-once processing by saving the offset and state. Delta Lake's ACID transactions ensure idempotent writes. Option A is wrong because foreachBatch with batch processing may lose exactly-once guarantees. Option C is wrong because Azure Stream Analytics does not integrate directly with Delta Lake. Option D is wrong because Auto Loader is for batch file ingestion, not streaming.

Answer

Use Azure Stream Analytics to process the stream and output to Delta Lake via Azure Data Lake Storage Gen2.

Answer

Use Structured Streaming with foreachBatch to write micro-batches to Delta Lake, and set the checkpoint location to Azure Data Lake Storage Gen2.

Answer

Use Auto Loader to ingest streaming data from Event Hubs and write to Delta Lake with checkpointing.

Question 6

Your organization needs to ensure that all data stored in Azure Data Lake Storage Gen2 is encrypted at rest using Microsoft-managed keys. What is the default encryption method?

Accepted Answer

Storage Service Encryption (SSE) with Microsoft-managed keys.. Option A is correct because Azure Storage automatically encrypts all data at rest using SSE with Microsoft-managed keys. Option B is wrong because CMK is optional. Option C is wrong because Azure Disk Encryption is for VMs. Option D is wrong because TDE is for SQL databases.

Answer

Transparent Data Encryption (TDE) on the storage account.

Answer

Client-side encryption with keys stored in Azure Key Vault.

Answer

Azure Disk Encryption on the storage nodes.

Question 7

Your organization uses Azure Synapse Analytics dedicated SQL pool. You need to ensure that all data at rest in the SQL pool is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault provides the required encryption. Option A is wrong because Azure Storage Service Encryption is for storage accounts, not SQL pools. Option B is wrong because Always Encrypted protects data in transit and at rest in application logic, not at rest in the database. Option D is wrong because Dynamic Data Masking does not encrypt data.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Answer

Configure Dynamic Data Masking to obfuscate sensitive data.

Answer

Enable Azure Storage Service Encryption with a customer-managed key.

Question 8

You are designing a data processing solution in Azure Databricks that uses Unity Catalog. The security team requires that all users authenticate using Microsoft Entra ID and that access to tables is governed by attribute-based access control (ABAC) using table tags. Which feature should you enable?

Accepted Answer

Table tags with access control lists (ACLs) in Unity Catalog.. Option B is correct because Unity Catalog supports ABAC through tags and Azure Databricks can use Microsoft Entra ID for authentication. Option A is wrong because row-level security is for filtering rows, not ABAC with tags. Option C is wrong because column-level security is for columns. Option D is wrong because dynamic views are for custom logic, not attribute-based access control with tags.

Answer

Column-level security masks.

Answer

Dynamic views with user context functions.

Answer

Row-level security filters.

Question 9

Your team uses Azure Data Factory to copy data from on-premises SQL Server to Azure Blob Storage. You need to ensure that data in transit is encrypted using TLS 1.2. What should you configure?

Accepted Answer

Ensure the Azure Data Factory pipeline uses HTTPS for the copy activity.. Option A is correct because Azure Data Factory uses HTTPS by default, which enforces TLS encryption for data in transit. Option B is wrong because VPN is not required for TLS encryption. Option C is wrong because Azure ExpressRoute provides a private connection but does not replace TLS. Option D is wrong because configuring the on-premises SQL Server to use SSL certificates is necessary but not sufficient; Azure Data Factory must also use HTTPS.

Answer

Set up a site-to-site VPN between the on-premises network and Azure.

Answer

Configure the on-premises SQL Server to use SSL certificates.

Answer

Use Azure ExpressRoute with private peering.

Question 10

You have an Azure Databricks workspace that uses a managed resource group. The security team requires that all cluster nodes use no public IP addresses and that all outbound traffic goes through a firewall. What should you configure?

Accepted Answer

Deploy the workspace in a VNet with forced tunneling enabled and a firewall.. Option D is correct because Azure Databricks can be deployed in a VNet injected configuration with no public IPs and route all traffic through a firewall. Option A is wrong because private endpoints are for data plane services, not for cluster nodes. Option B is wrong because service endpoints do not eliminate public IPs. Option C is wrong because network security groups control inbound/outbound rules but do not force traffic through a firewall.

Answer

Configure service endpoints for Azure Storage and Azure Data Lake Storage.

Answer

Apply network security groups (NSGs) to the subnet that restrict outbound traffic.

Answer

Enable Azure Private Link for the Databricks workspace.

Question 11

Refer to the exhibit. You are creating an Azure Storage account using an ARM template with the above snippet. After deployment, a security auditor reviews the configuration and notes that the storage account is not using a customer-managed key for encryption. What is the most likely reason?

Accepted Answer

The 'keyVersion' is missing a specific version, so Azure Storage defaults to Microsoft-managed key.. Option B is correct because the keyVersion is empty, which means Azure Storage will use the latest version of the key, but the key must be present in the vault. However, the snippet does not specify the 'keyVaultProperties' correctly; the property 'keyName' is valid, but the 'keyVersion' being empty might cause Azure to default to a Microsoft-managed key if the key does not exist or if the vault is not accessible. Option A is wrong because infrastructure encryption is independent of key source. Option C is wrong because 'infrastructureEncryption' is a separate setting. Option D is wrong because double encryption is not the issue.

Answer

The 'keySource' should be 'Microsoft.Storage' for customer-managed key.

Answer

The storage account requires double encryption to use customer-managed key.

Answer

The 'infrastructureEncryption' setting is enabled, which overrides customer-managed key.

Question 12

You are monitoring an Azure Synapse Analytics dedicated SQL pool and notice that some queries are taking longer than expected. You need to identify queries that are experiencing significant memory pressure. Which dynamic management view (DMV) should you query?

Accepted Answer

sys.dm_pdw_exec_requests. Option C is correct because sys.dm_pdw_exec_requests shows memory grants for queries. Option A is wrong because sys.dm_pdw_nodes_os_performance_counters shows OS-level counters. Option B is wrong because sys.dm_pdw_wait_stats shows wait statistics. Option D is wrong because sys.dm_pdw_query_stats_xe shows extended events.

Answer

sys.dm_pdw_wait_stats

Answer

sys.dm_pdw_query_stats_xe

Answer

sys.dm_pdw_nodes_os_performance_counters

Question 13

Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to grant a service principal read and write access to a specific directory without granting access to the parent directories. What should you use?

Accepted Answer

Assign the Storage Blob Data Contributor role at the directory level using RBAC.. Option A is correct because Azure RBAC with scope at the directory level can be assigned using the Storage Blob Data Contributor role. Option B is wrong because ACLs are used for fine-grained permissions but are scoped to the file system level for the default ACL. Option C is wrong because managed identity is an identity, not a permission mechanism. Option D is wrong because access policies are used for shared access signatures, not for service principals.

Answer

Use a managed identity and assign it to the directory.

Answer

Create a stored access policy on the directory.

Answer

Set ACLs on the directory with default ACLs for the service principal.

Question 14

You have an Azure Stream Analytics job that writes output to Azure Synapse Analytics. You need to ensure that the job can authenticate to Synapse Analytics using a managed identity. What should you do?

Accepted Answer

Enable system-assigned managed identity on the Stream Analytics job and configure the output to use it.. Option C is correct because Stream Analytics jobs can use managed identity to authenticate to Azure Synapse Analytics. Option A is wrong because connection strings with SQL authentication are not managed identity. Option B is wrong because system-assigned managed identity is enabled automatically, but the output configuration must be set to use it. Option D is wrong because a user-assigned managed identity is not required; system-assigned can be used.

Answer

Generate a shared access signature (SAS) token for the Synapse Analytics workspace.

Answer

Create a user-assigned managed identity and assign it to the Stream Analytics job.

Answer

Configure the output to use SQL Server authentication with a username and password.

Question 15

Your team uses Azure Data Factory to orchestrate data movement. You need to monitor pipeline runs and set up alerts when a pipeline fails more than three times in an hour. What is the most efficient approach?

Accepted Answer

Create an Azure Monitor metric alert for the 'Failed pipeline runs' metric with a threshold of 3 in 1 hour.. Option D is correct because Azure Monitor alerts can be configured based on metrics like Failed pipeline runs with a threshold of 3 in 1 hour. Option A is wrong because Alert rules in Data Factory are limited. Option B is wrong because diagnostic settings send logs to Log Analytics, but you would need to create a log alert, which is less efficient than a metric alert. Option C is wrong because a logic app is not the most efficient for simple threshold alerts.

Answer

Create an alert rule in Azure Data Factory based on the 'Failed pipeline runs' metric.

Answer

Configure diagnostic settings to send logs to Log Analytics and create a log alert.

Answer

Use a Logic App to periodically check the pipeline run status and send notifications.