DP-203 Practice Test 26 — 15 Questions

Question 1

You are designing a disaster recovery plan for an Azure Synapse Analytics dedicated SQL pool. The primary region becomes unavailable. You need to fail over to a secondary region with minimal data loss. The recovery point objective (RPO) is 1 hour. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable geo-backup on the dedicated SQL pool.. Geo-backup is a built-in feature for Azure Synapse Analytics dedicated SQL pools that automatically takes full backups at regular intervals and replicates them to a paired region. The default recovery point objective (RPO) is 1 hour, meeting the requirement. Option A is incorrect because active geo-replication is a feature for Azure SQL Database, not for Synapse dedicated SQL pools. Option B is incorrect because automatic restore points are local and not automatically replicated; copying them via Azure Data Factory adds complexity and does not guarantee the RPO. Option D is incorrect because user-defined restore points are manual and would require additional orchestration to store them in a secondary region, making it less reliable and harder to meet the 1-hour RPO consistently.

Answer

Configure active geo-replication to the secondary region.

Answer

Use automatic restore points and copy them to the secondary region using Azure Data Factory.

Answer

Create user-defined restore points every hour and store them in the secondary region.

Question 2

Your company uses Azure Data Lake Storage Gen2. You need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable 'Azure Storage encryption' with customer-managed keys in the storage account's encryption blade.. Azure Storage encryption with customer-managed keys is configured in the encryption blade of the storage account. This ensures data at rest is encrypted using a key stored in Azure Key Vault. Option A is incorrect because Azure Policy can audit or enforce encryption but does not configure customer-managed keys. Option C is incorrect because client-side encryption encrypts data before it reaches Azure Storage, not at rest. Option D is incorrect because infrastructure encryption provides a second encryption layer but does not use customer-managed keys for the primary encryption.

Answer

Use Azure Policy to audit storage accounts without encryption.

Answer

Implement client-side encryption in the application code.

Answer

Enable 'Infrastructure encryption' for double encryption.

Question 3

You are designing a data processing solution in Azure Synapse Analytics. The solution must prevent unauthorized access to data at rest and in transit. Which combination of features should you implement?

Accepted Answer

Enable Transparent Data Encryption (TDE) and enforce TLS 1.2.. Transparent Data Encryption (TDE) encrypts data at rest in Azure Synapse Analytics, and enforcing TLS 1.2 ensures encryption of data in transit. Option B (Azure RBAC and firewall rules) controls access but does not provide encryption. Option C (Always Encrypted and column-level security) is primarily for client-side encryption and access control, not comprehensive at-rest encryption. Option D (storing keys in Key Vault and enabling double encryption) relates to key management and infrastructure encryption, but the direct combination of TDE and TLS 1.2 is the required solution.

Answer

Use Azure RBAC and firewall rules.

Answer

Use Always Encrypted and column-level security.

Answer

Store encryption keys in Azure Key Vault and enable double encryption.

Question 4

You need to implement column-level security in Azure Synapse Analytics to restrict access to salary information. Only users with the 'HRManager' role should see salary columns. Which feature should you use?

Accepted Answer

Column-level security using GRANT on columns. Column-level security (CLS) in Azure Synapse Analytics uses GRANT on specific columns to restrict access. Option A is incorrect because row-level security filters rows, not columns. Option B is incorrect because dynamic data masking obfuscates data but does not prevent access. Option D is incorrect because Azure Purview is a governance tool, not a security enforcement mechanism.

Answer

Row-level security using security predicates

Answer

Dynamic data masking

Answer

Azure Purview data classification

Question 5

Refer to the exhibit. You are reviewing the workload classifier configuration for an Azure Synapse Analytics dedicated SQL pool. You notice that the 'HeavyLoader' classifier has a queryExecutionTimeoutSeconds of 0. What is the implication of this setting?

Accepted Answer

Queries classified as 'HeavyLoader' will not have a timeout.. When queryExecutionTimeoutSeconds is set to 0, it means no timeout is enforced. Queries classified as 'HeavyLoader' can run indefinitely without being terminated by the timeout mechanism. Option A is incorrect because a value of 0 does not mean indefinite waiting for resources; it refers to the timeout duration. Option B is incorrect; 0 is a valid configuration that disables the timeout. Option D is incorrect; a timeout of 0 does not cause immediate timeout but rather no timeout.

Answer

Queries classified as 'HeavyLoader' will wait indefinitely for resources.

Answer

The configuration is invalid; queryExecutionTimeoutSeconds must be greater than 0.

Answer

Queries classified as 'HeavyLoader' will timeout immediately.

Question 6

A company is designing a data storage solution for IoT device telemetry data. The data is append-only, needs to be stored cost-effectively for long-term analytics, and must support querying by device ID and timestamp. Which Azure storage solution should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines the cost-effective, append-only blob storage of Azure Blob Storage with a hierarchical namespace that enables directory-level operations and POSIX-like access control. This makes it ideal for storing large volumes of IoT telemetry data at low cost while supporting efficient querying by device ID and timestamp through partition pruning in tools like Azure Synapse Analytics or Apache Spark.

Answer

Azure Cosmos DB

Answer

Azure SQL Database

Answer

Azure Blob Storage with hot access tier

Question 7

You are designing a data processing pipeline in Azure Data Factory. The pipeline must copy data from Azure Blob Storage to Azure SQL Database and transform the data using a mapping data flow. The data flow includes a Derived Column transformation. What is the purpose of the Derived Column transformation?

Accepted Answer

Create new columns or modify existing columns using expressions.. The Derived Column transformation in Azure Data Factory mapping data flows is used to create new columns or modify existing columns by applying expressions. This allows you to perform calculations, string manipulations, or conditional logic directly within the data flow, enabling in-flight data transformation before writing to the sink.

Answer

Aggregate data by grouping rows.

Answer

Sort data in ascending or descending order.

Answer

Rename or drop columns.

Question 8

You are designing a data storage solution for real-time analytics on IoT telemetry. The system must ingest 10,000 events per second and support sub-second query latency. Which Azure data store should you use?

Accepted Answer

Azure Data Explorer (ADX).. Azure Data Explorer (ADX) is purpose-built for high-velocity telemetry and log analytics, ingesting 10,000+ events per second with sub-second query latency via its columnar storage and distributed query engine. It supports real-time analytics on streaming IoT data without requiring pre-defined schemas or indexing, making it the optimal choice for this scenario.

Answer

Azure Table Storage.

Answer

Azure SQL Database with in-memory OLTP.

Answer

Azure Cosmos DB with analytical store.

Question 9

Refer to the exhibit. You have an Azure Data Factory pipeline that performs an incremental load from an Azure SQL Database source to a target Azure SQL Database. The pipeline uses a watermark column approach. After running the pipeline, you notice that the target table is empty. What is the most likely cause of this issue?

Accepted Answer

The watermark query returns the maximum LastModified value, but the copy query uses the same value to filter, resulting in zero rows.. The most likely cause is that the watermark query returns the maximum LastModified value, and the copy query uses that same value to filter, resulting in zero rows. In a watermark-based incremental load, the copy query should filter for rows where the watermark column is greater than the last watermark value, not equal to it. Using the same value would only capture rows with that exact timestamp, which may be none if no new rows have that exact value.

Answer

The dependency condition should be 'Completed' instead of 'Succeeded'.

Answer

The WatermarkQuery activity failed, causing the CopyData activity to be skipped.

Answer

The CopyData activity runs before the WatermarkQuery activity completes.

Question 10

You are designing a near-real-time data processing solution for a retail company. The source is a Kafka cluster on-premises. The target is an Azure Synapse Dedicated SQL Pool. The solution must handle up to 10,000 events per second with less than 5-minute latency. Which Azure service should you use to ingest the data?

Accepted Answer

Azure Event Hubs (with Kafka protocol support). Azure Event Hubs with Kafka protocol support is the correct choice because it provides a fully managed, high-throughput data ingestion service that can handle up to 10,000 events per second with sub-second latency, and it natively supports the Kafka protocol, allowing direct integration with your on-premises Kafka cluster without custom code or additional gateways. This meets the near-real-time requirement (<5-minute latency) and scales to the specified throughput.

Answer

Azure Data Lake Storage Gen2

Answer

Azure IoT Hub

Answer

Azure Stream Analytics

Question 11

You are troubleshooting a slow-running pipeline in Azure Data Factory that uses a Copy activity to transfer data from Azure Blob Storage to Azure Synapse Analytics. The pipeline processes about 100 GB of CSV files. The copy performance is poor even though the source and sink are in the same region. What is the most likely cause?

Accepted Answer

The copy activity is not using staging and PolyBase. The Copy activity in Azure Data Factory uses PolyBase or COPY statement (staging) to bulk load data into Azure Synapse Analytics. Without staging and PolyBase, the default insert method is row-by-row, which is extremely slow for large datasets like 100 GB of CSV files. Enabling staging with PolyBase allows parallel, high-throughput loading, which is essential for performance at this scale.

Answer

The source and sink are in different Azure regions

Answer

The Data Integration Unit (DIU) setting is too low

Answer

The source files are compressed

Question 12

Which TWO actions should you take to secure data in Azure Synapse Analytics dedicated SQL pool? (Choose two.)

Accepted Answer

Apply dynamic data masking (DDM) to obfuscate sensitive data.. Dynamic data masking (DDM) (option D) is correct because it obfuscates sensitive columns at query time for non-privileged users, so PII such as emails or credit-card numbers is masked in result sets without altering the underlying stored data in the dedicated SQL pool. Row-level security (RLS) (option E) is correct because it enforces predicate-based filters (via a security policy and inline table-valued function) so users only see rows matching their identity or role, restricting data access at the row granularity. Together, DDM and RLS directly address protecting sensitive data from unauthorized viewing, which is the stated goal. PolyBase (option A) is a data-ingestion technology for reading external sources, not a data-protection control. Result-set caching (option B) is a performance feature that caches query results and does not secure data. Workload classification (option C) governs resource allocation and query priority through workload groups, not data confidentiality or access control.

Answer

Use PolyBase to load data from external sources.

Answer

Enable result-set caching for query performance.

Answer

Configure workload classification for resource governance.

Question 13

Which TWO Azure services can be used to monitor and analyze query performance in Azure Synapse Analytics dedicated SQL pool?

Accepted Answer

Azure Monitor with Log Analytics. Azure Monitor with Log Analytics (D) is correct because dedicated SQL pool emits diagnostic logs and metrics (e.g., DmvLogs, QueryStoreRuntimeStatistics, ExecRequests) that can be routed to a Log Analytics workspace, where KQL queries and workbooks are used to monitor and analyze query performance over time. Dynamic Management Views (E) are correct because T-SQL DMVs such as sys.dm_pdw_exec_requests, sys.dm_pdw_exec_sessions, sys.dm_pdw_request_steps, and sys.dm_pdw_sql_requests expose real-time execution details, wait statistics, and step-level timings for queries running in the dedicated SQL pool. SQL Data Sync (A) is incorrect because it is a data synchronization service for Azure SQL Database and SQL Managed Instance, not a query performance monitoring tool for Synapse dedicated SQL pools. Azure Policy (B) is incorrect because it enforces governance and compliance rules on resources, not query performance analysis. Azure Advisor (C) is incorrect because it provides general best-practice recommendations (cost, reliability, performance) at the resource level, not detailed query-level monitoring or analysis for dedicated SQL pools.

Answer

SQL Data Sync

Answer

Azure Policy

Answer

Azure Advisor

Question 14

Which THREE security features are available in Azure Data Lake Storage Gen2 to protect data at rest and in transit? (Choose three.)

Accepted Answer

Azure Storage firewalls and virtual network rules. Option A (Azure Storage firewalls and virtual network rules) is correct because ADLS Gen2, built on Azure Storage, lets you restrict network access to the storage account by configuring firewall rules and allowing specific virtual networks and subnets, thereby protecting data at rest from unauthorized network access. Option C (Encryption at rest using Storage Service Encryption, SSE) is correct because Azure Storage automatically encrypts data at rest using 256-bit AES encryption, and this applies to ADLS Gen2 accounts, protecting data at rest. Option D (HTTPS for data in transit) is correct because ADLS Gen2 supports secure transfer over HTTPS/TLS, ensuring data is encrypted in transit between clients and the storage service. Option B (Azure Information Protection) is not a native ADLS Gen2 data-at-rest or in-transit protection feature; it is a separate classification and labeling service for documents and emails. Option E (Azure Policy) is a governance and compliance tool for enforcing organizational rules, not a direct data-at-rest or in-transit encryption/network protection feature of ADLS Gen2.

Answer

Azure Information Protection

Answer

Azure Policy

Question 15

You are monitoring an Azure Data Lake Storage Gen2 account using Azure Monitor. You need to be alerted when the number of storage account requests exceeds 20,000 per hour. What is the most efficient way to set up this alert?

Accepted Answer

Create a metric alert on the 'Transactions' metric with a threshold of 20,000 and aggregation granularity of 1 hour.. The 'Transactions' metric in Azure Monitor can be used to count the number of requests to the storage account, and you can set a metric alert with a threshold of 20,000 aggregated over an hour. This is the most efficient method as it directly uses the metric without needing complex queries. Option A is wrong because it requires creating a Log Analytics workspace and writing a KQL query, which is more complex and less efficient than a metric alert. Option B is wrong because Activity Log alerts are for management events like 'List Storage Account Keys', not for data transaction counts. Option D is wrong because Azure Advisor provides recommendations, not custom alerting on specific metric thresholds.

Answer

Create a Log Analytics workspace and write a KQL query to count requests.

Answer

Create an Activity Log alert for 'List Storage Account Keys' events.

Answer

Use Azure Advisor to recommend scaling.