DP-203 Practice Test 34 — 15 Questions

Question 1

Your organization uses Azure Synapse Analytics to run large-scale queries. You need to implement a solution that automatically pauses the dedicated SQL pool when no activity is detected for a specified period, and resumes it when a connection is attempted. What should you configure?

Accepted Answer

You cannot configure auto-pause for a dedicated SQL pool.. Option D is correct because Azure Synapse Analytics dedicated SQL pool does not support auto-pause; auto-pause is only for serverless SQL pools. Option A (auto-pause setting) is for serverless. Option B (Azure Automation runbook) could work but is not a built-in feature. Option C (Azure Functions) is custom. The correct answer is that you cannot configure auto-pause for dedicated SQL pool.

Answer

Use Azure Automation to run a PowerShell script that pauses and resumes the pool.

Answer

Create an Azure Function that pauses the pool on a schedule.

Answer

Set the auto-pause delay in the SQL pool properties.

Question 2

Your company uses Azure Purview for data governance. You need to ensure that sensitive data in Azure Data Lake Storage Gen2 is automatically detected and classified. What should you configure in Purview?

Accepted Answer

Create a scan rule set that includes built-in classification rules for sensitive data types.. Option A is correct because Purview's scanning and classification rules automatically detect sensitive data. Option B is wrong because sensitivity labels in Microsoft Purview Information Protection are applied manually or via policy, not automatically by Purview scanning. Option C is wrong because Azure Policy enforces resource compliance, not data classification. Option D is wrong because Defender for Cloud is for security posture, not data classification.

Answer

Apply sensitivity labels to the storage account using Microsoft Purview Information Protection.

Answer

Enable Microsoft Defender for Cloud's data sensitivity discovery.

Answer

Use Azure Policy to enforce tagging of resources containing sensitive data.

Question 3

Your Azure Data Lake Storage Gen2 account stores sensitive data. You need to audit who accesses the data and when, and you want to send the audit logs to a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Diagnostic settings on the storage account. Diagnostic settings on the storage account can stream audit logs (like read, write, delete) to Log Analytics. Option B is wrong because Azure Activity Logs capture control plane operations, not data plane access. Option C is wrong because Azure Monitor alerts are for notifications, not log collection. Option D is wrong because Microsoft Sentinel requires data ingestion from diagnostic settings first.

Answer

Azure Activity Logs

Answer

Microsoft Sentinel

Answer

Azure Monitor alerts

Question 4

Which TWO Azure services can be used to monitor Azure Data Factory pipeline runs and set up alerts?

Accepted Answer

Log Analytics. Azure Monitor provides metrics and logs for ADF, and Log Analytics allows querying and alerting based on logs. Option C is wrong because Microsoft Sentinel is a SIEM that ingests from Log Analytics, not directly. Option D is wrong because Azure Policy is for governance. Option E is wrong because Azure Advisor provides recommendations, not monitoring.

Answer

Microsoft Sentinel

Answer

Azure Policy

Answer

Azure Advisor

Question 5

You are designing a data lake architecture using Azure Data Lake Storage Gen2. You need to implement a least-privilege security model. Which authorization mechanism should you use for granular control?

Accepted Answer

Use POSIX-like access control lists (ACLs).. Option D is correct because ACLs provide granular permissions at the file and directory level. Option A is wrong because Azure RBAC is at the subscription/resource group level, not granular. Option B is wrong because shared keys provide full access. Option C is wrong because SAS tokens with stored access policies provide limited granularity but are not as flexible as ACLs.

Answer

Use storage account keys for access.

Answer

Use Azure RBAC roles at the storage account level.

Answer

Use shared access signatures (SAS) with stored access policies.

Question 6

You have an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline runs successfully but you notice that the data transfer is taking longer than expected. You need to improve the transfer performance without increasing the cost significantly. Which configuration change should you make?

Accepted Answer

Enable staged copy with an Azure Blob Storage staging location.. Option C is correct because enabling staged copy with staging storage can improve performance by allowing parallel uploads and retries. Option A is wrong because increasing DIUs may increase cost. Option B is wrong because increasing the number of concurrent connections on SQL Server might not be the bottleneck. Option D is wrong because using PolyBase is for loading into Azure Synapse or SQL DW, not Blob Storage.

Answer

Use PolyBase to load the data into Blob Storage.

Answer

Increase the number of concurrent connections on the SQL Server.

Answer

Increase the Data Integration Units (DIU) for the copy activity.

Question 7

Your organization uses Azure Purview for data governance. You need to automatically scan an Azure Data Lake Storage Gen2 account and classify sensitive data such as credit card numbers and social security numbers. What should you configure?

Accepted Answer

A new scan rule set in Purview with classification rules for sensitive data types. Option B is correct because Purview's classification rules can detect sensitive data patterns. Option A is wrong because Azure Policy is for resource compliance, not data classification. Option C is wrong because Azure Information Protection (now part of Microsoft Purview Information Protection) labels files but requires integration. Option D is wrong because Microsoft Defender for Cloud is for security posture.

Answer

Azure Information Protection (AIP) scanner

Answer

Microsoft Defender for Cloud

Answer

Azure Policy with built-in guest configuration

Question 8

You are responsible for securing an Azure Synapse Analytics workspace. The workspace is integrated with a Git repository for source control. You need to ensure that only authorized users can publish changes from the Git branch to the live Synapse service. What should you configure?

Accepted Answer

Assign the 'Synapse Artifact Publisher' role to specific users in the Synapse RBAC.. Option B is correct because Synapse RBAC roles like 'Synapse Artifact Publisher' control who can publish changes. Option A is wrong because Git permissions control access to the repository, not publishing to Synapse. Option C is wrong because Azure Policy enforces compliance rules, not access control. Option D is wrong because Microsoft Entra ID is for identity, not specific publish permissions.

Answer

Use Microsoft Entra ID Conditional Access policies to require multi-factor authentication for publishing.

Answer

Create an Azure Policy to deny publishing if the user is not in an approved group.

Answer

Configure branch permissions in the Git repository to restrict who can merge to the collaboration branch.

Question 9

You have an Azure Databricks workspace with a cluster that uses a Standard_LRS managed disk. You need to ensure that data at rest is encrypted using a customer-managed key (CMK). What should you configure?

Accepted Answer

Enable double encryption with a customer-managed key in Azure Disk Encryption. Option A is correct because Azure Databricks supports CMK encryption via Azure Disk Encryption or by using a key vault key for the managed disk. Option B (Azure Storage Service Encryption) is for storage accounts, not managed disks. Option C (Azure SQL Database TDE) is irrelevant. Option D (Azure Purview) is for data governance, not encryption.

Answer

Configure Azure Storage Service Encryption with a customer-managed key

Answer

Enable Transparent Data Encryption (TDE) in Azure SQL Database

Answer

Use Azure Purview to classify and encrypt data

Question 10

Your organization uses Azure Synapse Analytics with serverless SQL pools. You need to ensure that only users with specific Microsoft Entra ID roles can query external tables referencing Azure Data Lake Storage Gen2. What should you configure?

Accepted Answer

Grant SELECT permission on the external table to specific Microsoft Entra ID users or groups.. Option B is correct because Azure Synapse workspace firewall controls network access, but for data access, you need to grant specific permissions on the external data source. Option A is wrong because storage account firewall controls network access, not user identity. Option C is wrong because managed identity for the serverless pool is not user-specific. Option D is wrong because RBAC on the storage account alone does not restrict query access through Synapse.

Answer

Assign a managed identity to the serverless SQL pool and grant it Storage Blob Data Reader on the storage account.

Answer

Use Azure RBAC to assign Storage Blob Data Reader role to the users on the storage account.

Answer

Configure a storage account firewall to allow only the Synapse workspace IP range.

Question 11

Which THREE metrics should you monitor for an Azure Synapse Analytics dedicated SQL pool to ensure optimal performance?

Accepted Answer

tempdb usage. Options A, C, and E are correct. Option A: DWU usage indicates how much of the allocated resources are used. Option C: Queued queries indicate concurrency bottlenecks. Option E: tempdb usage can cause performance issues. Option B is wrong because storage size is capacity, not performance. Option D is wrong because login failures are security, not performance.

Answer

Login failures

Answer

Total storage size

Question 12

Your organization uses Azure Purview for data governance. You need to ensure that only authorized users can register data sources and create classification rules, while other data consumers can only search and browse the data catalog. What should you configure?

Accepted Answer

Assign the Data Curator role to curators and Data Reader role to consumers. Azure Purview uses roles: Data Curator can register sources and manage classifications; Data Reader can only search and browse. Option A is wrong because Data Source Administrator can only manage source registrations. Option C is wrong because Collection Admin manages collections. Option D is wrong because there is no 'Catalog Admin' role; Purview has built-in roles.

Answer

Assign the Catalog Admin role to curators and Data Reader role to consumers

Answer

Assign the Collection Admin role to curators and Data Reader role to consumers

Answer

Assign the Data Source Administrator role to curators and Data Reader role to consumers

Question 13

You are designing a data processing solution in Azure Synapse Analytics. The solution must prevent unauthorized access to data at rest and in transit. Which combination of features should you implement?

Accepted Answer

Enable Transparent Data Encryption (TDE) and enforce TLS 1.2.. Option B is correct because TDE encrypts data at rest and TLS 1.2 encrypts data in transit. Option A is wrong because Azure RBAC controls access but does not encrypt data. Option C is wrong because Always Encrypted is for client-side encryption, not for all data at rest. Option D is wrong because Azure Key Vault stores keys but does not encrypt data itself.

Answer

Use Azure RBAC and firewall rules.

Answer

Use Always Encrypted and column-level security.

Answer

Store encryption keys in Azure Key Vault and enable double encryption.

Question 14

Which THREE features should you use to optimize query performance in Azure Synapse Analytics dedicated SQL pool? (Choose three.)

Accepted Answer

Materialized views.. Options A, C, and E are correct. Materialized views improve performance for aggregations, result-set caching speeds up repeated queries, and workload management ensures resource isolation. Option B is wrong because T-SQL views are logical, not performance optimization. Option D is wrong because geo-redundant storage is for disaster recovery, not performance.

Answer

T-SQL views.

Answer

Geo-redundant storage (GRS).

Question 15

You have an Azure Data Lake Storage Gen2 account that stores log files. You need to implement a data retention policy so that logs older than 90 days are automatically deleted. What should you use?

Accepted Answer

Lifecycle management policy. Option B is correct because a lifecycle management policy can automatically delete blobs based on age. Option A is wrong because Azure Blob Storage inventory provides reports but does not delete. Option C is wrong because Azure Policy enforces compliance but does not delete data. Option D is wrong because Azure Purview scopes metadata and data discovery, not lifecycle management.

Answer

Azure Policy

Answer

Azure Blob Storage inventory

Answer

Microsoft Purview