DP-203 Practice Test 46 — 15 Questions

Question 1

Your company stores sensitive customer data in Azure Data Lake Storage Gen2. You need to ensure that only authorized users can access the data, and that access is audited. Which approach should you use to control access to the data lake?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure RBAC roles and ACLs on directories/files, and enable storage analytics logging. Azure RBAC roles provide coarse-grained control (e.g., assigning Storage Blob Data Contributor at the storage account level), while ACLs (POSIX-style) on directories and files enable fine-grained permissions for specific users or groups. Enabling storage analytics logging (specifically the 'StorageRead', 'StorageWrite', and 'StorageDelete' logs) captures all authenticated requests, meeting the auditing requirement. This combination directly addresses the need for both authorized access control and auditability in Azure Data Lake Storage Gen2.

Answer

Use Azure managed identities for all user access

Answer

Use shared access signatures (SAS) with stored access policies

Answer

Configure a virtual network service endpoint and firewall rules

Question 2

You have an Azure Data Factory pipeline that loads data from an on-premises SQL Server to Azure Synapse Analytics. The pipeline fails intermittently with network connectivity errors. You need to ensure reliable data transfer with minimal latency. Which solution should you recommend?

Accepted Answer

Deploy a self-hosted IR with high availability on two nodes. A self-hosted integration runtime (SHIR) is required for on-premises data sources. To improve reliability, a high-availability SHIR with two or more nodes provides redundancy and load balancing. Option A is incorrect because a site-to-site VPN provides network connectivity but does not directly improve the reliability of the data transfer pipeline; the IR component is still needed. Option C is incorrect because staging data in Blob Storage with sharded files is a performance optimization for parallel loading, but it does not address intermittent network connectivity issues. Option D is incorrect because the Azure Integration Runtime cannot access on-premises networks directly.

Answer

Set up a site-to-site VPN gateway

Answer

Stage data in Azure Blob Storage using sharded files

Answer

Use an Azure Integration Runtime instead

Question 3

Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only authorized users can access the data via the serverless SQL endpoint, while minimizing administrative overhead. What should you use?

Accepted Answer

Enable Microsoft Entra ID authentication and grant users permissions via Azure RBAC on the storage account.. Microsoft Entra ID authentication allows users to authenticate with their existing identities, and Azure RBAC on the storage account provides granular, identity-based access control without managing separate SQL logins or credentials, minimizing administrative overhead. Option B is incorrect because managed identities are designed for service-to-service authentication, not for individual users. Option C is incorrect because storage account access keys provide broad, shared access that does not support per-user identity and auditing. Option D is incorrect because SAS tokens require token generation and management per user, adding overhead.

Answer

Use managed identities for the serverless SQL pool.

Answer

Use storage account access keys for authentication.

Answer

Use shared access signatures (SAS) tokens generated for each user.

Question 4

Your company uses Azure Data Factory to orchestrate data pipelines that ingest data from on-premises SQL Server to Azure Data Lake Storage Gen2. The network team has implemented a firewall that only allows outbound traffic on port 443. The on-premises SQL Server is not accessible via public endpoint. You need to configure a secure connection that complies with the firewall rules and uses managed identity for authentication. What should you use?

Accepted Answer

Install a Self-hosted Integration Runtime on an on-premises VM, register it with Azure Data Factory using managed identity, and configure the pipeline to use this IR for the SQL Server connection.. A self-hosted integration runtime (IR) installed on an on-premises VM can connect to SQL Server over the private network, then communicate with Azure Data Factory over port 443. Managed identity can be used for authentication to Azure Data Factory. Option A is incorrect: Azure IR with VNet injection still requires a public endpoint for on-premises SQL Server, which is not accessible. Option B is incorrect: Point-to-site VPN provides connectivity but does not directly support managed identity for ADF authentication, and additional configuration is needed. Option D is incorrect: Using an Azure IR with a public endpoint requires the on-premises SQL Server to have a public endpoint, which it does not, and it does not utilize managed identity for authentication.

Answer

Use Azure ExpressRoute to connect the on-premises network to Azure, then use an Azure Integration Runtime with a VNet injection.

Answer

Set up a point-to-site VPN from Azure to on-premises and use an Azure Integration Runtime with a VNet integration.

Answer

Use an Azure Integration Runtime with a public endpoint and configure a firewall rule to allow the Azure IR IP addresses.

Question 5

You are troubleshooting a failed Azure Synapse Pipeline execution. The pipeline uses a Copy activity to load data from an on-premises SQL Server to Azure Data Lake Storage Gen2. The error indicates a 'Connection timeout' to the on-premises source. The Integration Runtime is Self-Hosted and has been running successfully for months. What is the most likely cause?

Accepted Answer

The on-premises network configuration has changed.. A 'Connection timeout' error when using a Self-Hosted Integration Runtime (SHIR) that has been running successfully for months indicates a network-level issue rather than an authentication or configuration problem. The most likely cause is a change in the on-premises network configuration (e.g., firewall rules, proxy settings, or DNS changes) that prevents the SHIR from reaching the SQL Server on the specified port (typically TCP 1433). Since the SHIR is already installed and was working, the timeout points to a connectivity break, not a credential or installation issue.

Answer

The SQL Server authentication credentials have expired.

Answer

The Self-Hosted Integration Runtime is not installed.

Answer

The Azure Storage account firewall is blocking access.

Question 6

You are monitoring an Azure Data Factory pipeline that runs hourly. You notice that the pipeline has been failing intermittently with an error indicating 'Activity timeout'. Which Azure Monitor metric should you set an alert on to proactively detect such failures?

Accepted Answer

Failed pipeline runs metric. The 'Failed pipeline runs' metric directly captures the number of pipeline runs that have failed, including those due to timeout errors, making it the most appropriate metric for alerting on such failures. Option A is incorrect because 'Integration runtime queue depth' indicates how many activities are queued for execution, not failures. Option B is incorrect because 'Pipeline duration' shows how long the pipeline runs, but a timeout is a specific failure type that would be captured by failed runs. Option C is incorrect because 'Data read and data written' measure data throughput and are unrelated to pipeline failures.

Answer

Integration runtime queue depth metric

Answer

Pipeline duration metric

Answer

Data read and data written metrics

Question 7

You are designing a data lake architecture for a healthcare company. The solution must support fine-grained access control at the file level, encryption at rest and in transit, and integration with Microsoft Purview for data lineage. Which storage solution should you recommend?

Accepted Answer

Azure Data Lake Storage Gen2 (ADLS Gen2).. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like access control lists (ACLs) for fine-grained file-level permissions, supports encryption at rest (Azure Storage Service Encryption) and in transit (TLS 1.2+), and natively integrates with Microsoft Purview for automated data lineage and cataloging. This makes it ideal for healthcare scenarios requiring strict compliance and auditability.

Answer

Azure NetApp Files.

Answer

Azure Files.

Answer

Azure Blob Storage.

Question 8

A company uses Azure Synapse Analytics dedicated SQL pool. They need to ensure that only users with a specific Azure AD group can query a particular schema. Which approach should they use?

Accepted Answer

Use the GRANT statement to grant SELECT on the schema to the Azure AD group.. The GRANT statement in Azure Synapse dedicated SQL pool allows you to assign permissions directly to Azure AD groups. By granting SELECT on the schema to the specific Azure AD group, only members of that group can query objects within that schema, meeting the requirement precisely.

Answer

Configure a server-level firewall rule to block other users.

Answer

Create a row-level security policy on all tables in the schema.

Answer

Apply dynamic data masking to the schema.

Question 9

You are designing a data storage solution for a global IoT application that ingests millions of events per second. The data is write-heavy with occasional reads for real-time dashboards. Which Azure storage option and configuration would provide the lowest latency writes with high throughput?

Accepted Answer

Azure Cosmos DB with multi-region writes and eventual consistency. Azure Cosmos DB with multi-region writes and eventual consistency provides the lowest latency writes for a global IoT application because it allows each region to accept writes independently without cross-region coordination, and eventual consistency removes the need for quorum confirmations, reducing write latency. This configuration also offers high throughput by distributing write load across multiple regions, making it ideal for write-heavy, high-volume IoT scenarios where occasional reads for dashboards can tolerate stale data.

Answer

Azure Cosmos DB with single-region writes and strong consistency

Answer

Azure Data Lake Storage Gen2 with hierarchical namespace

Answer

Azure Blob Storage with hot tier and append blobs

Question 10

You need to store streaming data from Azure Event Hubs into Azure Data Lake Storage Gen2 in near real-time. The data should be stored in Avro format with a folder structure: /raw/{eventhub}/{yyyy}/{MM}/{dd}/{HH}/{mm}. Which Azure service should you use to ingest the data?

Accepted Answer

Azure Stream Analytics with a job that reads from Event Hubs and writes to ADLS Gen2.. Azure Stream Analytics is the correct choice because it natively supports reading from Event Hubs and writing to ADLS Gen2 with built-in time-based partitioning into the exact folder structure /raw/{eventhub}/{yyyy}/{MM}/{dd}/{HH}/{mm}. It provides near real-time processing with sub-minute latency and can output data in Avro format directly, meeting all requirements without additional code or orchestration.

Answer

Event Hubs Capture feature to automatically capture events to ADLS Gen2.

Answer

Azure Data Factory with a tumbling window trigger to copy data from Event Hubs every 5 minutes.

Answer

Azure Databricks with Auto Loader to read from Event Hubs and write to ADLS Gen2.

Question 11

You are troubleshooting a Synapse Pipeline that runs a Copy activity from an on-premises SQL Server to Azure Synapse Dedicated SQL Pool. The pipeline fails with the error: 'Failure happened on 'Source' side. ErrorCode=SqlOperationFailed.' The on-premises SQL Server has no firewall restrictions. What is the most likely cause?

Accepted Answer

The self-hosted integration runtime is not configured properly.. The error 'Failure happened on 'Source' side. ErrorCode=SqlOperationFailed' indicates that the Copy activity cannot connect to the on-premises SQL Server. Since the question states there are no firewall restrictions, the most likely cause is that the self-hosted integration runtime (SHIR) is not properly configured, registered, or running. The SHIR is required to bridge the on-premises network to Azure, and if it is not correctly set up, the source connection will fail.

Answer

Staging is not enabled for the Copy activity.

Answer

The destination table in Synapse has a different schema.

Answer

The SQL Server credentials in the linked service are incorrect.

Question 12

You are designing a data processing solution that requires running custom Python scripts for data transformation. The scripts have dependencies on specific libraries that are not pre-installed in the environment. You need a fully managed, serverless compute option that allows you to install custom libraries. Which service should you use?

Accepted Answer

Azure Databricks with cluster-scoped libraries. Azure Databricks with cluster-scoped libraries is the correct choice because it provides a fully managed, serverless Apache Spark environment where you can install custom Python libraries (e.g., via PyPI or Maven) at the cluster level. This allows your custom Python scripts to run with all required dependencies without managing any infrastructure, directly meeting the requirement for a serverless compute option with custom library support.

Answer

Azure Functions with custom handlers

Answer

Azure Container Instances with a custom Docker image

Answer

Azure Synapse Analytics serverless SQL pool

Question 13

You are designing a data processing solution in Azure Synapse Analytics. The solution must use a serverless SQL pool to query data in Azure Data Lake Storage Gen2. The data is stored as Parquet files partitioned by date. Which TWO of the following statements are true regarding querying this data? (Select TWO.)

Accepted Answer

You can use the filepath() function in the query to retrieve the partition column values.. The `filepath()` function in a serverless SQL pool query returns the file path of the row being read. When data is partitioned by date in Azure Data Lake Storage Gen2, the partition column values are embedded in the folder structure (e.g., `/year=2023/month=01/day=15/`). Using `filepath(1)`, `filepath(2)`, etc., you can extract these values directly in the query without needing to parse the path manually.

Answer

You must create an external table to query Parquet files; OPENROWSET is not supported.

Answer

You can create indexes on the serverless SQL pool to improve query performance.

Answer

You can only query a single file at a time; wildcards are not supported.

Question 14

You are building a batch processing solution in Azure Synapse Analytics that reads data from a dedicated SQL pool, applies complex transformations using Synapse Spark, and writes the results back to the dedicated SQL pool. The pipeline must run on a schedule and handle transient failures with retries. Which approach should you use?

Accepted Answer

Use Azure Synapse Pipelines with a Notebook activity that runs Spark code. Azure Synapse Pipelines with a Notebook activity is the correct approach because it natively integrates Synapse Spark for complex transformations and supports scheduling and retry policies for transient failures. This allows you to read from a dedicated SQL pool, process data in Spark, and write back to the pool without external orchestration, leveraging the built-in pipeline reliability features.

Answer

Use Azure Batch with a custom application to run Spark jobs

Answer

Use Azure Functions to trigger Spark jobs on demand

Answer

Use Azure Databricks with Auto Loader and Delta Live Tables

Question 15

Your Azure Data Lake Storage Gen2 account stores sensitive customer data. You need to ensure that data is encrypted at rest using customer-managed keys (CMK) and that access to the encryption key is logged. What should you do?

Accepted Answer

Configure customer-managed keys in Azure Key Vault and enable Key Vault diagnostics logging.. Customer-managed keys (CMK) stored in Azure Key Vault allow you to control and audit key usage, and enabling Key Vault diagnostics logging captures access events. Option A is incorrect because infrastructure encryption uses platform-managed keys. Option B is incorrect because double encryption adds a second layer but does not directly provide logging of key access. Option D is incorrect because SSE with platform-managed keys does not give customer control or logging.

Answer

Enable infrastructure encryption on the storage account.

Answer

Enable double encryption using both platform-managed and customer-managed keys.

Answer

Use Azure Storage Service Encryption (SSE) with platform-managed keys.