DP-203 Practice Test 31 — 15 Questions

Question 1

You are reviewing a script to create an external data source in Azure Synapse Analytics serverless SQL pool. Based on the exhibit, what is the purpose of the SAS token?

Accepted Answer

To provide read access to the container for querying data.. Option B is correct because the SAS token provides delegated access to the storage account for reading (sp=r) and listing (sp=l). Option A is wrong because the SAS is for a container, not a specific file. Option C is wrong because the SAS does not have write permission (sp=rl). Option D is wrong because the SAS is used in the credential for the external data source.

Answer

To provide write access to the container for storing query results.

Answer

To encrypt the connection between the serverless pool and storage.

Answer

To authenticate the user to the serverless SQL pool.

Question 2

You are securing an Azure Data Lake Storage Gen2 account that contains sensitive data. Which TWO of the following should you implement to protect data from unauthorized access?

Accepted Answer

Configure ACLs to grant least privilege to users and groups. Option A is correct because private endpoints ensure data traffic does not traverse the public internet. Option C is correct because ACLs provide fine-grained access control at the directory/file level. Option B is wrong because cross-origin resource sharing (CORS) is for web applications, not security. Option D is wrong because a default ACL of 'read' for all authenticated users would grant broad access. Option E is wrong because large file shares are for Azure Files, not ADLS Gen2.

Answer

Set the default ACL to allow read access for all authenticated users

Answer

Enable CORS rules to allow only specific origins

Answer

Enable large file shares on the storage account

Question 3

Your team has deployed an Azure Stream Analytics job that writes output to Azure Cosmos DB. You need to monitor the job for data latency and ensure it meets a service-level agreement (SLA) of under 10 seconds from input to output. Which metric should you track in Azure Monitor?

Accepted Answer

Watermark delay.. Option B is correct because 'Watermark delay' indicates the maximum time between the input event being received and the output being produced. Option A is wrong because 'Input events' shows volume, not latency. Option C is wrong because 'Output events' shows throughput. Option D is wrong because 'Runtime errors' indicates failures.

Answer

Output events.

Answer

Runtime errors.

Answer

Input events.

Question 4

You need to monitor the performance of an Azure Stream Analytics job that processes real-time IoT data. Which metric indicates the number of events that are being dropped or delayed due to insufficient processing capacity?

Accepted Answer

Backlogged input events.. Option B is correct because 'Backlogged input events' indicates events that are waiting to be processed. Option A is wrong because 'Input events' is the total received. Option C is wrong because 'Output events' is the total sent. Option D is wrong because 'Watermark delay' measures latency.

Answer

Watermark delay.

Answer

Output events.

Answer

Input events.

Question 5

You have an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline is failing with a 'Gateway is offline' error. What is the most likely cause?

Accepted Answer

The Self-Hosted Integration Runtime is not running or cannot connect to the Azure Data Factory service.. Option B is correct because the Self-Hosted Integration Runtime (SHIR) is required for on-premises data sources. If the SHIR is not running or unreachable, the pipeline fails. Option A is wrong because the SHIR is used, not Azure IR. Option C is wrong because the Azure IR cannot connect to on-premises networks. Option D is wrong because a VNet is optional for SHIR.

Answer

The Azure Integration Runtime is being used instead of a Self-Hosted Integration Runtime.

Answer

The Azure Integration Runtime is not configured to use the correct region.

Answer

The source SQL Server is not configured to allow remote connections from Azure.

Question 6

A company uses Azure Databricks for data processing. They want to monitor the performance of Spark jobs and set up alerts for job failures. Which Azure service should they use?

Accepted Answer

Azure Monitor. Option C is correct because Azure Monitor can collect metrics and logs from Azure Databricks and set up alerts. Option A is wrong because Azure Log Analytics is part of Azure Monitor but is not the service name for alerting. Option B is wrong because Azure Sentinel is a SIEM, not for monitoring job performance. Option D is wrong because Azure Advisor provides recommendations, not monitoring and alerts.

Answer

Azure Advisor

Answer

Azure Sentinel

Answer

Azure Log Analytics

Question 7

An organization is using Azure Synapse Analytics and wants to implement column-level security to restrict access to sensitive columns. Which feature should they use?

Accepted Answer

Column-level security using GRANT. Option D is correct because column-level security in Azure Synapse Analytics uses GRANT statements on specific columns. Option A is wrong because row-level security filters rows, not columns. Option B is wrong because dynamic data masking masks data at query time but does not restrict access. Option C is wrong because Azure Purview is for governance, not access control.

Answer

Dynamic data masking

Answer

Azure Purview

Answer

Row-level security

Question 8

You have an Azure Data Lake Storage Gen2 account that stores parquet files. You need to ensure that files containing personally identifiable information (PII) are automatically classified and tagged. Which Azure service should you integrate?

Accepted Answer

Microsoft Purview. Option B is correct because Microsoft Purview provides automated data classification and labeling for Azure Storage. Option A is wrong because Microsoft Sentinel is a SIEM, not for classification. Option C is wrong because Microsoft Defender for Cloud is for security posture, not data classification. Option D is wrong because Azure Policy enforces rules but does not classify content.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 9

Your Azure Databricks workspace contains sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the workspace, and all access must be logged and monitored. You also need to audit data access at the table level. What should you implement?

Accepted Answer

Enable Unity Catalog and assign the Databricks workspace to use Entra ID as the identity provider. Configure audit logs for the workspace. Option C is correct because Azure Databricks with Unity Catalog provides fine-grained access control at the table level and integrates with Entra ID for authentication, and audit logs capture access events. Option A is wrong because SCIM provisioning only syncs users, not access control. Option B is wrong because IP access lists control network access, not data access. Option D is wrong because Microsoft Defender XDR is for security monitoring across Microsoft 365, not specifically for Databricks table-level auditing.

Answer

Configure SCIM provisioning to sync the Entra ID group to Databricks and assign the group to the workspace

Answer

Set up IP access lists to restrict workspace access to the corporate network and enable diagnostic logs

Answer

Use Microsoft Defender XDR to monitor access to the Databricks workspace

Question 10

You are using Azure Data Explorer to monitor real-time sensor data. You run the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

To visualize the count of events every 5 minutes over the last hour. Option B is correct because the query counts events per 5-minute bin and renders a timechart, showing the event frequency over time. Option A is wrong because it does not detect anomalies. Option C is wrong because it does not calculate averages. Option D is wrong because it does not filter specific sensors.

Answer

To detect anomalies in the sensor data

Answer

To calculate the average value of a numeric column over time

Answer

To filter events from a specific sensor

Question 11

Your company uses Azure Data Factory to orchestrate data movement. You need to monitor pipeline runs across multiple factories and create a dashboard that shows success and failure rates over the past 30 days. What is the most efficient approach?

Accepted Answer

Configure diagnostic settings for each Data Factory to send logs to a Log Analytics workspace, then create a workbook using KQL queries.. Option B is correct because sending diagnostic logs to a Log Analytics workspace allows querying and visualizing data from multiple factories in a single dashboard. Option A is wrong because Azure Monitor alerts are for notifications, not historical dashboards. Option C is wrong because Azure Data Factory monitoring views are per factory. Option D is wrong because Azure Storage Analytics is for storage metrics, not pipeline runs.

Answer

Use the Data Factory monitoring UI to view runs for each factory individually.

Answer

Enable Azure Storage Analytics and query the logs stored in a storage account.

Answer

Create alert rules in Azure Monitor for each pipeline failure and aggregate manually.

Question 12

You have an Azure Synapse Analytics dedicated SQL pool that stores sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the data, and all access must be logged for auditing. What should you implement?

Accepted Answer

Row-level security (RLS) with a security policy. Option B is correct because row-level security (RLS) controls access at the row level based on user context, and it can be integrated with Microsoft Entra ID roles. Option A (column-level security) restricts columns, not rows. Option C (dynamic data masking) obfuscates data but does not restrict access. Option D (Azure RBAC) controls resource management, not data access inside the SQL pool.

Answer

Dynamic data masking

Answer

Azure RBAC at the SQL pool level

Answer

Column-level security

Question 13

Which TWO Azure services can you use to monitor data processing pipelines in Azure Data Factory?

Accepted Answer

Log Analytics workspace. Options B and C are correct. Azure Monitor provides metrics and alerts; Log Analytics workspace enables querying pipeline run logs. Option A (Azure Sentinel) is a SIEM, not typically for pipeline monitoring. Option D (Azure Dashboard) is a visualization tool, not a monitoring service. Option E (Azure Service Health) monitors Azure service health, not pipelines.

Answer

Azure Sentinel

Answer

Azure Dashboard

Answer

Azure Service Health

Question 14

You need to ensure that data in an Azure Data Lake Storage Gen2 account is encrypted at rest using a customer-managed key. Which feature should you configure?

Accepted Answer

Azure Key Vault integration with Storage Service Encryption. Option C is correct because ADLS Gen2 supports encryption at rest with customer-managed keys via Azure Key Vault. Option A is wrong because Azure Information Protection is for labeling, not encryption at rest. Option B is wrong because Azure Disk Encryption is for VMs. Option D is wrong because Azure Storage Service Encryption uses Microsoft-managed keys by default; customer-managed keys require Key Vault.

Answer

Azure Information Protection

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Disk Encryption

Question 15

Refer to the exhibit. You are deploying an Azure Synapse Analytics workspace using an ARM template. The exhibit shows the encryption configuration. What is the effect of setting infrastructureEncryption to Enabled?

Accepted Answer

It adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys.. Option D is correct because infrastructure encryption (double encryption) encrypts data at both the service level and the infrastructure level. Option A is wrong because it encrypts at rest, not in transit. Option B is wrong because it does not disable encryption; it adds another layer. Option C is wrong because it's not for logs.

Answer

It disables encryption using the customer-managed key.

Answer

It enables encryption of data in transit between nodes.

Answer

It enables transparent data encryption for SQL pools.

DP-203 Practice Test 31 — 15 Questions

Exhibit

DP-203 Practice Test 31 — 15 Questions

Exhibit