DP-203 Practice Test 40 — 15 Questions

Question 1

You have an Azure Synapse Analytics dedicated SQL pool that stores sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the data, and all access must be logged for auditing. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Row-level security (RLS) with a security policy. Row-level security (RLS) is the correct choice because it restricts data access at the row level based on user context, such as Microsoft Entra ID role membership, and all access can be logged via auditing. Dynamic data masking (A) obfuscates data but does not restrict access. Azure RBAC (B) controls management plane access, not data access within the SQL pool. Column-level security (D) restricts access to specific columns, not rows.

Answer

Dynamic data masking

Answer

Azure RBAC at the SQL pool level

Answer

Column-level security

Question 2

Which THREE metrics should you monitor for an Azure Synapse Analytics dedicated SQL pool to ensure optimal performance?

Accepted Answer

tempdb usage. Options A, B, and C are correct. tempdb usage (A) indicates contention and performance issues. DWU usage (B) shows resource utilization and can help determine if scaling is needed. Queued queries (C) indicate concurrency bottlenecks and performance degradation. Option D (Login failures) is not a performance metric, it's security. Option E (Total storage size) is capacity monitoring, not performance.

Answer

Login failures

Answer

Total storage size

Question 3

You are designing a data lake architecture using Azure Data Lake Storage Gen2. You need to implement a least-privilege security model. Which authorization mechanism should you use for granular control?

Accepted Answer

Use POSIX-like access control lists (ACLs).. POSIX-like ACLs provide granular permissions at the file and directory level, enabling least-privilege access control. Option A is incorrect because storage account keys grant full access to the entire storage account, violating least privilege. Option B is incorrect because Azure RBAC roles at the storage account level offer coarse-grained control, not granular file/directory permissions. Option D is incorrect because shared access signatures with stored access policies provide time-limited access but lack the detailed ACL capabilities for individual files and directories.

Answer

Use storage account keys for access.

Answer

Use Azure RBAC roles at the storage account level.

Answer

Use shared access signatures (SAS) with stored access policies.

Question 4

A data engineering team uses Azure Stream Analytics to process real-time IoT data. They notice that the job's watermark delay is increasing over time, and the output is falling behind. The input is from Event Hubs with 10 partitions. The job uses a 5-minute hopping window with a 1-minute hop. What is the most likely cause?

Accepted Answer

The job is under-provisioned in terms of Streaming Units (SUs).. The increasing watermark delay and falling behind output indicate that the Stream Analytics job cannot keep up with the input throughput. With a 5-minute hopping window (1-minute hop) processing 10 Event Hubs partitions, the job requires sufficient Streaming Units (SUs) to handle the compute load. Under-provisioned SUs cause backpressure, leading to rising watermark delay as the job struggles to process events within the window boundaries.

Answer

The hopping window size is too large.

Answer

The late arrival tolerance is set too high.

Answer

The Event Hubs partition count does not match the Stream Analytics job's parallelism.

Question 5

Which TWO actions should you take to ensure that data at rest is encrypted in Azure Synapse Analytics dedicated SQL pool?

Accepted Answer

Enable infrastructure-level encryption using double encryption.. The correct actions are B and E. Transparent Data Encryption (TDE) with service-managed keys (Option E) encrypts the entire dedicated SQL pool at rest by default. Infrastructure-level encryption using double encryption (Option B) adds a second layer of encryption at the infrastructure level, providing extra protection. Option A (Always Encrypted with secure enclaves) is for client-side encryption during queries, not at rest. Option C (column-level encryption with ENCRYPTBYPASSPHRASE) encrypts specific columns, not the entire pool. Option D (creating a customer-managed key in Azure Key Vault) is a prerequisite for TDE with customer-managed keys, but the action to enable encryption itself is TDE; Option E with service-managed keys already achieves at-rest encryption without requiring a customer-managed key.

Answer

Enable Always Encrypted with secure enclaves.

Answer

Apply column-level encryption using ENCRYPTBYPASSPHRASE.

Answer

Create a customer-managed key in Azure Key Vault.

Question 6

You are designing an Azure Data Factory pipeline to ingest data from an on-premises SQL Server into Azure Synapse Analytics. The data must be encrypted in transit. Which integration runtime type should you use and what additional configuration is required?

Accepted Answer

Use Self-hosted Integration Runtime with a certificate for HTTPS. A self-hosted integration runtime is required to connect to on-premises networks. To encrypt data in transit, a certificate must be configured for HTTPS encryption. Option A is wrong because Azure Integration Runtime cannot directly access on-premises data sources. Option B is incorrect because Azure VPN Gateway provides network-level connectivity but does not handle application-layer encryption; the self-hosted IR still needs a certificate. Option D is wrong because using a public endpoint does not ensure encryption in transit without additional configuration, and Azure IR still cannot access on-premises directly.

Answer

Use Azure Integration Runtime with ExpressRoute

Answer

Use Self-hosted Integration Runtime with Azure VPN Gateway

Answer

Use Azure Integration Runtime with a public endpoint

Question 7

When designing a data processing solution using Azure Databricks, what is the recommended approach to handle schema evolution when reading data from Delta Lake tables?

Accepted Answer

Set the option 'mergeSchema' to 'true' on write. In Delta Lake, schema evolution is automatically handled by setting the 'mergeSchema' option to 'true' on write operations. This allows new columns to be added or existing column types to be safely widened without manual intervention, preserving existing data and metadata integrity.

Answer

Set the option 'overwriteSchema' to 'true' on write

Answer

Manually alter the table schema using ALTER TABLE

Answer

Ignore schema changes and use 'failOnDataLoss' flag

Question 8

Your team uses Azure Synapse Analytics serverless SQL pool to query data in Azure Data Lake Storage Gen2. You notice that queries are running slower than expected. You need to improve query performance by reducing the amount of data scanned. Which two features should you implement? (Select two.)

Accepted Answer

Partition the data in the data lake and use partition elimination in queries.. Options A and E are correct. Partition elimination (A) reduces data scanned by skipping irrelevant partitions. File pruning (E) reduces data scanned by reading only specified files via OPENROWSET. Option B is wrong because result-set caching caches query results but does not reduce the amount of data scanned on the first execution. Option C is wrong because auto-optimize is a feature for Delta Lake tables and is not applicable to serverless SQL pool queries. Option D is wrong because materialized views are not supported in serverless SQL pool, and even if they were, they would not reduce the data scanned by the original query.

Answer

Enable result-set caching for the serverless SQL pool.

Answer

Enable auto-optimize on the Delta Lake tables.

Answer

Create materialized views on the serverless SQL pool.

Question 9

You have an Azure Synapse Analytics dedicated SQL pool that stores sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the data, and all access must be logged for auditing. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reduce the degree of parallelism (MAXDOP) for the workload.. Options C and E are correct. Reducing the degree of parallelism (MAXDOP) limits the number of concurrent operations, reducing tempdb usage. Optimizing queries that perform large sorts or hash joins reduces the demand on tempdb. Option A is incorrect because result-set caching does not affect tempdb usage. Option B is incorrect because increasing DWU may provide more tempdb space but does not address the root cause of excessive tempdb usage. Option D is incorrect because moving tempdb to a separate storage account is not supported in Azure Synapse Analytics.

Answer

Enable result-set caching to reduce query reruns.

Answer

Increase the service level (DWU) of the dedicated SQL pool.

Answer

Move tempdb to a separate storage account.

Question 10

You have an Azure Data Lake Storage Gen2 account that stores sensitive customer data. You need to implement security controls to prevent data exfiltration by a malicious insider who has Contributor role access. Which Azure feature should you use?

Accepted Answer

Apply an Azure Policy that denies data access from unapproved locations.. Azure Policy can enforce a deny effect on data access requests originating from unapproved locations, effectively preventing data exfiltration even if the user has Contributor role. This is a preventive control, not just monitoring. Option A (diagnostic settings) is detective only. Option B (removing Contributor role) might reduce permissions but does not prevent the insider from using their current role. Option C (network firewall rules) can be bypassed if the insider accesses from within the trusted network. Therefore, Azure Policy with location-based deny is the most effective prevention.

Answer

Enable diagnostic settings to log all access to the storage account.

Answer

Remove the Contributor role and assign a custom role with read-only permissions.

Answer

Configure network firewall rules to allow only trusted IP addresses.

Question 11

Your company uses Azure Databricks for data processing. You need to ensure that spark jobs cannot access certain storage accounts. What is the most secure approach?

Accepted Answer

Use Azure RBAC to grant specific storage account permissions to the Azure Databricks managed identity.. The most secure approach is to use Azure RBAC to grant specific storage account permissions to the Azure Databricks managed identity. This follows the principle of least privilege by granting only the required permissions to the identity used by the spark jobs. Option A is less secure because storing keys in Key Vault still requires managing secrets and the keys provide broad access. Option B (shared access keys) also provides broad access and is not recommended. Option D (disabling public network access) controls network-level access but does not prevent access from authorized networks or services that are allowed; it does not specifically restrict spark job access within Databricks. Therefore, option C is the most secure and best practice.

Answer

Store storage account keys in Azure Key Vault and retrieve them in notebooks.

Answer

Use shared access keys and restrict their usage.

Answer

Disable public network access on storage accounts.

Question 12

Which TWO actions should you take to secure data at rest in Azure Data Lake Storage Gen2? (Choose TWO)

Accepted Answer

Use Azure RBAC to grant least-privilege access to the storage account.. Correct answers: A and C. A: Use Azure RBAC to grant least-privilege access to the storage account—this ensures only authorized users can access data. C: Enable Azure Storage Service Encryption (SSE) for data at rest—this encrypts data automatically at the storage level. B is incorrect because dynamic data masking is used for databases, not for Azure Data Lake Storage Gen2. D is incorrect because firewall rules control network access, not data at rest. E is incorrect because audit logging is for monitoring, not securing data at rest.

Answer

Apply dynamic data masking to sensitive columns.

Answer

Configure firewall rules to restrict network access.

Answer

Enable audit logging for the storage account.

Question 13

A company stores IoT sensor data in Azure Blob Storage. The data is appended every minute and must be queried in near real-time using a SQL interface. Which Azure service should be used to enable this?

Accepted Answer

Azure Synapse SQL Pool. Azure Synapse SQL Pool (part of Azure Synapse Analytics) can query IoT sensor data stored in Blob Storage or ADLS Gen2 in near real-time using PolyBase or external tables. This schema-on-read approach provides a SQL interface directly over the stored data without needing to move it into a traditional database.

Answer

Azure Cosmos DB

Answer

Azure SQL Database

Answer

Azure Data Lake Storage Gen2

Question 14

Refer to the exhibit. You are reviewing an Azure Policy definition that was created to audit diagnostic settings for Azure Data Lake Storage Gen2. The policy is assigned to a management group containing several storage accounts. You notice that the policy is not flagging storage accounts that lack diagnostic settings. What is the most likely cause?

Accepted Answer

The existence condition incorrectly checks for a specific log category 'StorageRead' instead of any diagnostic setting.. The existence condition checks for a specific log category 'StorageRead' rather than checking for any diagnostic setting. Azure Policy for auditing diagnostic settings should verify that at least one diagnostic setting exists, not that a particular category is configured. This causes storage accounts with diagnostic settings that do not include 'StorageRead' (or with no settings at all) to not be flagged. Option B is incorrect because the 'field' property 'type' with value 'Microsoft.Storage/storageAccounts' is appropriate for auditing diagnostic settings on the storage account level, not blobServices. Option C is incorrect because the effect parameter defaults to 'AuditIfNotExists' even without explicit assignment, so that is not the issue. Option D is incorrect because custom policy type does not require special permissions beyond those needed to assign policies; evaluation occurs normally.

Answer

The 'field' property in the 'if' condition should be 'type' equals 'Microsoft.Storage/storageAccounts/blobServices' for Data Lake.

Answer

The effect parameter is not assigned a value; the default 'AuditIfNotExists' is not applied.

Answer

The policy type is 'Custom', which requires special permissions to evaluate.

Question 15

Your organization uses Azure SQL Database with Active Geo-Replication for disaster recovery. You need to ensure that all connections to the database use Microsoft Entra ID authentication and that access is audited. You also want to minimize the attack surface by disabling SQL authentication. What should you do?

Accepted Answer

Enable 'Azure AD-only authentication' in the Azure SQL Database server settings and remove all SQL Server authenticated logins.. Enabling 'Azure AD-only authentication' in the Azure SQL Database server settings disables SQL authentication and enforces Microsoft Entra ID authentication, which also ensures auditing through Entra ID logs. Option A is incorrect: Conditional Access policies enforce MFA for Entra ID authentication, but they do not disable SQL authentication, leaving the attack surface open. Option C is incorrect: Creating a firewall rule restricts IP addresses but does not disable SQL authentication. Option D is incorrect: Azure RBAC controls management plane access (e.g., resource management), not database-level authentication; it does not disable SQL authentication.

Answer

Configure Conditional Access policies to require MFA for database access.

Answer

Create a server-level firewall rule to allow only specific IP addresses and enable SQL authentication.

Answer

Create an Azure RBAC role to restrict access to the database and assign it to users.