DP-203 Practice Test 39 — 15 Questions

Question 1

Refer to the exhibit. You deploy the ARM template to create a storage account. After deployment, a developer reports that they cannot access the storage account from an Azure Databricks notebook running in the same virtual network as specified in the subnet rule. What is the most likely reason?

Accepted Answer

The Databricks cluster is not using a managed virtual network with a service endpoint to the storage account.. Option D is correct because the default action is Deny, and only traffic from the specified subnet is allowed. The developer's Databricks notebook might be using a cluster that is not using a managed virtual network or is not in that subnet. Option A is wrong because HNS enabled does not block access. Option B is wrong because firewall is correctly set to Deny with a rule for the subnet. Option C is wrong because the key vault encryption doesn't block access.

Answer

The storage account uses customer-managed keys from Key Vault, which requires additional permissions.

Answer

The firewall default action is Deny, and there are no IP rules allowing the Databricks cluster's public IP.

Answer

The storage account has hierarchical namespace enabled, which blocks non-ADLS Gen2 tools.

Question 2

You are monitoring an Azure Data Lake Storage Gen2 account using Azure Monitor. You need to be alerted when the number of storage account requests exceeds 20,000 per hour. What is the most efficient way to set up this alert?

Accepted Answer

Create a metric alert on the 'Transactions' metric with a threshold of 20,000 and aggregation granularity of 1 hour.. Option B is correct because the metric 'Transactions' is available at the storage account level and can be aggregated per hour. Option A is wrong because a Log Analytics query would be more complex and less efficient. Option C is wrong because Activity Log does not contain transaction counts. Option D is wrong because Azure Advisor does not provide custom alerting on metrics.

Answer

Create a Log Analytics workspace and write a KQL query to count requests.

Answer

Create an Activity Log alert for 'List Storage Account Keys' events.

Answer

Use Azure Advisor to recommend scaling.

Question 3

You are optimizing an Azure Data Factory pipeline that moves data from Azure Blob Storage to Azure SQL Database. The pipeline currently uses a Copy activity with a staging setting enabled. You notice high DTU consumption on the Azure SQL Database during the copy operation. How can you reduce the impact on the source database?

Accepted Answer

Configure the Copy activity to use staging with Azure Blob Storage and then use a stored procedure to bulk insert.. Option B is correct because using PolyBase in Azure Synapse Analytics (not SQL Database) is for bulk loads, but the target is Azure SQL Database. Actually, the correct approach is to use staging copy with Azure Blob Storage as staging and then use PolyBase? Wait, the target is Azure SQL Database, not Synapse. For SQL Database, using a staging blob and then bulk insert can reduce DTU consumption. But among options, Option A (increase DTU) is scaling, not reduction. Option B (use PolyBase) is for Synapse. Option C (use staging copy with Azure Blob Storage and then use bulk insert) is correct. Option D (use parallel copy) increases throughput but also DTU. So correct is C.

Answer

Use PolyBase to load data directly from Blob Storage to Azure SQL Database.

Answer

Enable parallel copy in the Copy activity settings.

Answer

Increase the DTU of the Azure SQL Database to handle the load.

Question 4

You have an Azure Data Factory pipeline defined as shown. The pipeline is failing because the preCopyScript truncates the staging table before each run, but the table is empty on the first run. What change would you make to ensure the pipeline works correctly?

Accepted Answer

Change the preCopyScript to: IF OBJECT_ID('dbo.Staging') IS NOT NULL TRUNCATE TABLE dbo.Staging.. Option B is correct because the preCopyScript should check if the table exists before truncating. The script 'IF OBJECT_ID('dbo.Staging') IS NOT NULL TRUNCATE TABLE dbo.Staging' handles the first run. Option A is wrong because setting writeBatchSize higher may cause memory issues. Option C is wrong because disabling recursive is not related to the truncate issue. Option D is wrong because the script is executed on each run, not only on the first.

Answer

Remove the preCopyScript entirely.

Answer

Increase the writeBatchSize to 50000 to speed up the copy.

Answer

Set recursive to false in the source.

Question 5

You are troubleshooting an Azure Databricks job that writes data to Azure Data Lake Storage Gen2. The job fails with '403 Forbidden' error. The Databricks workspace uses a managed identity (system-assigned) for authentication. What should you verify?

Accepted Answer

The managed identity has 'Storage Blob Data Contributor' role assigned to the storage account. Option A is correct because the managed identity must have the 'Storage Blob Data Contributor' RBAC role on the storage account to write data. Option B is wrong because the error is 403, not 404. Option C is wrong because no service endpoint or private endpoint is required. Option D is wrong because firewall rules would cause a different error.

Answer

The storage account name is correct

Answer

The storage account firewall is configured to allow Azure services

Answer

A private endpoint is configured between Databricks and the storage account

Question 6

You are designing access control for Azure Data Lake Storage Gen2. You need to allow a group of data scientists to read and write files in the 'processed' directory but prevent them from deleting files. Which authorization method should you use?

Accepted Answer

Assign the Storage Blob Data Contributor role at the container level and use ACLs to deny delete on the directory. Azure RBAC roles like Storage Blob Data Contributor grant read/write/delete permissions. To differentiate write and delete, you need ACLs that allow read/execute on the container and read/write on the directory, but not delete. Option A (Storage Blob Data Contributor) includes delete. Option B (Storage Blob Data Reader) is read-only. Option D (Storage Blob Delegator) is not a built-in role.

Answer

Assign the Storage Blob Data Contributor role at the container level

Answer

Assign the Storage Blob Delegator role at the container level

Answer

Assign the Storage Blob Data Reader role and use ACLs to grant write

Question 7

Your company uses Azure Databricks for data processing. You need to ensure that spark jobs cannot access certain storage accounts. What is the most secure approach?

Accepted Answer

Use Azure RBAC to grant specific storage account permissions to the Azure Databricks managed identity.. Option D is correct because Azure RBAC on storage accounts using Microsoft Entra ID (formerly Azure AD) is the recommended way to control access. Option A is wrong because shared access keys provide broad access. Option B is wrong because secrets are not recommended for production. Option C is wrong because disabling firewall doesn't help.

Answer

Store storage account keys in Azure Key Vault and retrieve them in notebooks.

Answer

Use shared access keys and restrict their usage.

Answer

Disable public network access on storage accounts.

Question 8

You need to monitor the performance of your Azure Synapse Analytics dedicated SQL pool. Which metric should you use to identify queued queries due to concurrency limits?

Accepted Answer

Queued queries. Option C is correct because 'Queued queries' metric directly shows the number of queries waiting due to concurrency limits. Option A is wrong because DWU percentage shows resource usage, not queuing. Option B is wrong because active queries show running queries. Option D is wrong because memory percentage shows memory pressure.

Answer

DWU percentage

Answer

Active queries

Answer

Memory percentage

Question 9

You are monitoring an Azure Synapse Analytics dedicated SQL pool using dynamic management views (DMVs). You want to identify queries that are experiencing excessive memory grants causing concurrency issues. Which DMV should you query?

Accepted Answer

sys.dm_pdw_exec_requests. Option D is correct because sys.dm_pdw_exec_requests contains the total_request_memory_granted column that can be used to identify queries with large memory grants. Option A is wrong because it shows only waits, not memory grants. Option B is wrong because it shows resource class membership, not current memory usage. Option C is wrong because it shows workload group settings, not actual grants.

Answer

sys.dm_pdw_waits

Answer

sys.dm_pdw_resource_waits

Answer

sys.dm_pdw_workload_management_workload_groups_details

Question 10

You need to ensure that an Azure Synapse Analytics dedicated SQL pool automatically pauses after 2 hours of inactivity to save costs. Which feature should you configure?

Accepted Answer

Auto-pause feature. Azure Synapse Analytics supports auto-pause for dedicated SQL pools (Gen2). You can set an auto-pause delay in minutes. Option A (Data Exfiltration Prevention) is security. Option B (Workload Management) is for concurrency. Option D (Maintenance Window) is for updates.

Answer

Maintenance window

Answer

Data Exfiltration Prevention

Answer

Workload Management

Question 11

Your company uses Azure Synapse Analytics serverless SQL pool to query data in Azure Data Lake Storage Gen2. You need to monitor query performance and identify queries that are consuming excessive resources. Which Azure tool should you use?

Accepted Answer

Synapse Studio monitoring hub.. Option A is correct because Synapse Studio provides monitoring dashboards for serverless SQL pool. Option B is wrong because Azure Monitor Metrics can show some metrics but not query-level details. Option C is wrong because Log Analytics can be used but requires diagnostic settings. Option D is wrong because Query Performance Insight is for dedicated SQL pool.

Answer

Azure Monitor Metrics for the serverless SQL pool.

Answer

Azure Log Analytics queries against diagnostic logs.

Answer

SQL Server Management Studio Query Performance Insight.

Question 12

You are optimizing cost for an Azure Data Lake Storage Gen2 account that stores historical data. The data is accessed infrequently after 30 days and must be retained for 7 years. Which lifecycle management rule should you apply?

Accepted Answer

Move blobs to cool tier after 30 days, then to archive tier after 1 year.. Option B is correct because moving blobs to cool tier after 30 days and then to archive after a longer period is cost-effective. Option A is wrong because deleting after 30 days loses data. Option C is wrong because premium tier is expensive. Option D is wrong because archive after 30 days would incur high retrieval costs.

Answer

Move blobs to archive tier immediately after 30 days.

Answer

Delete blobs after 30 days.

Answer

Move blobs to premium tier after 30 days.

Question 13

Which TWO actions should you take to secure data at rest in Azure Data Lake Storage Gen2? (Choose TWO)

Accepted Answer

Use Azure RBAC to grant least-privilege access to the storage account.. Correct answers: A and D. A: Enable encryption at rest using Azure Storage Service Encryption (SSE) which is enabled by default. D: Use Azure RBAC to control access to the storage account. B is wrong because data masking is for databases, not storage. C is wrong because firewall rules secure network access, not data at rest. E is wrong because audit logging is for monitoring, not encryption.

Answer

Apply dynamic data masking to sensitive columns.

Answer

Configure firewall rules to restrict network access.

Answer

Enable audit logging for the storage account.

Question 14

Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to implement a security strategy that allows users to read only specific folders within a container. Which authorization method should you use?

Accepted Answer

Access control lists (ACLs) on the folder. Option C is correct because ACLs (Access Control Lists) can be set at the folder level in ADLS Gen2 to grant granular permissions to specific directories. Option A is wrong because RBAC roles at the container level apply to the entire container. Option B is wrong because SAS tokens grant access at the container or file level, not folder level. Option D is wrong because shared key is account-level access.

Answer

Storage account shared key

Answer

Azure RBAC roles (e.g., Storage Blob Data Contributor) at the container level

Answer

Shared access signatures (SAS) with folder-level permissions

Question 15

You have an Azure Data Lake Storage Gen2 account that stores sensitive customer data. You need to prevent data exfiltration to unauthorized external IP addresses. Which TWO actions should you take?

Accepted Answer

Use private endpoints for the storage account. Network security controls: enabling firewall and deny access from internet, plus configuring service endpoints or private endpoints. Option A (Azure Firewall) is not a storage setting. Option D (Geo-redundant storage) is for durability, not security. Option E (Shared access signatures) is for fine-grained access but not prevent exfiltration.

Answer

Enable Azure Firewall on the storage account

Answer

Use shared access signatures (SAS) with limited permissions

Answer

Enable geo-redundant storage (GRS)

DP-203 Practice Test 39 — 15 Questions

Exhibit

DP-203 Practice Test 39 — 15 Questions

Exhibit