DP-203 Secure, monitor, and optimize data storage and data processing — 10 Questions

Question 1

Your organization uses Azure Synapse Analytics dedicated SQL pool. You need to ensure that all data at rest in the SQL pool is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault provides the required encryption. Option A is wrong because Azure Storage Service Encryption is for storage accounts, not SQL pools. Option B is wrong because Always Encrypted protects data in transit and at rest in application logic, not at rest in the database. Option D is wrong because Dynamic Data Masking does not encrypt data.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Answer

Configure Dynamic Data Masking to obfuscate sensitive data.

Answer

Enable Azure Storage Service Encryption with a customer-managed key.

Question 2

You are designing a data processing solution in Azure Databricks that uses Unity Catalog. The security team requires that all users authenticate using Microsoft Entra ID and that access to tables is governed by attribute-based access control (ABAC) using table tags. Which feature should you enable?

Accepted Answer

Table tags with access control lists (ACLs) in Unity Catalog.. Option B is correct because Unity Catalog supports ABAC through tags and Azure Databricks can use Microsoft Entra ID for authentication. Option A is wrong because row-level security is for filtering rows, not ABAC with tags. Option C is wrong because column-level security is for columns. Option D is wrong because dynamic views are for custom logic, not attribute-based access control with tags.

Answer

Column-level security masks.

Answer

Dynamic views with user context functions.

Answer

Row-level security filters.

Question 3

Your team uses Azure Data Factory to copy data from on-premises SQL Server to Azure Blob Storage. You need to ensure that data in transit is encrypted using TLS 1.2. What should you configure?

Accepted Answer

Ensure the Azure Data Factory pipeline uses HTTPS for the copy activity.. Option A is correct because Azure Data Factory uses HTTPS by default, which enforces TLS encryption for data in transit. Option B is wrong because VPN is not required for TLS encryption. Option C is wrong because Azure ExpressRoute provides a private connection but does not replace TLS. Option D is wrong because configuring the on-premises SQL Server to use SSL certificates is necessary but not sufficient; Azure Data Factory must also use HTTPS.

Answer

Set up a site-to-site VPN between the on-premises network and Azure.

Answer

Configure the on-premises SQL Server to use SSL certificates.

Answer

Use Azure ExpressRoute with private peering.

Question 4

You have an Azure Databricks workspace that uses a managed resource group. The security team requires that all cluster nodes use no public IP addresses and that all outbound traffic goes through a firewall. What should you configure?

Accepted Answer

Deploy the workspace in a VNet with forced tunneling enabled and a firewall.. Option D is correct because Azure Databricks can be deployed in a VNet injected configuration with no public IPs and route all traffic through a firewall. Option A is wrong because private endpoints are for data plane services, not for cluster nodes. Option B is wrong because service endpoints do not eliminate public IPs. Option C is wrong because network security groups control inbound/outbound rules but do not force traffic through a firewall.

Answer

Configure service endpoints for Azure Storage and Azure Data Lake Storage.

Answer

Apply network security groups (NSGs) to the subnet that restrict outbound traffic.

Answer

Enable Azure Private Link for the Databricks workspace.

Question 5

Refer to the exhibit. You are creating an Azure Storage account using an ARM template with the above snippet. After deployment, a security auditor reviews the configuration and notes that the storage account is not using a customer-managed key for encryption. What is the most likely reason?

Accepted Answer

The 'keyVersion' is missing a specific version, so Azure Storage defaults to Microsoft-managed key.. Option B is correct because the keyVersion is empty, which means Azure Storage will use the latest version of the key, but the key must be present in the vault. However, the snippet does not specify the 'keyVaultProperties' correctly; the property 'keyName' is valid, but the 'keyVersion' being empty might cause Azure to default to a Microsoft-managed key if the key does not exist or if the vault is not accessible. Option A is wrong because infrastructure encryption is independent of key source. Option C is wrong because 'infrastructureEncryption' is a separate setting. Option D is wrong because double encryption is not the issue.

Answer

The 'keySource' should be 'Microsoft.Storage' for customer-managed key.

Answer

The storage account requires double encryption to use customer-managed key.

Answer

The 'infrastructureEncryption' setting is enabled, which overrides customer-managed key.

Question 6

You are monitoring an Azure Synapse Analytics dedicated SQL pool and notice that some queries are taking longer than expected. You need to identify queries that are experiencing significant memory pressure. Which dynamic management view (DMV) should you query?

Accepted Answer

sys.dm_pdw_exec_requests. Option C is correct because sys.dm_pdw_exec_requests shows memory grants for queries. Option A is wrong because sys.dm_pdw_nodes_os_performance_counters shows OS-level counters. Option B is wrong because sys.dm_pdw_wait_stats shows wait statistics. Option D is wrong because sys.dm_pdw_query_stats_xe shows extended events.

Answer

sys.dm_pdw_wait_stats

Answer

sys.dm_pdw_query_stats_xe

Answer

sys.dm_pdw_nodes_os_performance_counters

Question 7

Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to grant a service principal read and write access to a specific directory without granting access to the parent directories. What should you use?

Accepted Answer

Assign the Storage Blob Data Contributor role at the directory level using RBAC.. Option A is correct because Azure RBAC with scope at the directory level can be assigned using the Storage Blob Data Contributor role. Option B is wrong because ACLs are used for fine-grained permissions but are scoped to the file system level for the default ACL. Option C is wrong because managed identity is an identity, not a permission mechanism. Option D is wrong because access policies are used for shared access signatures, not for service principals.

Answer

Use a managed identity and assign it to the directory.

Answer

Create a stored access policy on the directory.

Answer

Set ACLs on the directory with default ACLs for the service principal.

Question 8

You have an Azure Stream Analytics job that writes output to Azure Synapse Analytics. You need to ensure that the job can authenticate to Synapse Analytics using a managed identity. What should you do?

Accepted Answer

Enable system-assigned managed identity on the Stream Analytics job and configure the output to use it.. Option C is correct because Stream Analytics jobs can use managed identity to authenticate to Azure Synapse Analytics. Option A is wrong because connection strings with SQL authentication are not managed identity. Option B is wrong because system-assigned managed identity is enabled automatically, but the output configuration must be set to use it. Option D is wrong because a user-assigned managed identity is not required; system-assigned can be used.

Answer

Generate a shared access signature (SAS) token for the Synapse Analytics workspace.

Answer

Create a user-assigned managed identity and assign it to the Stream Analytics job.

Answer

Configure the output to use SQL Server authentication with a username and password.

Question 9

Your team uses Azure Data Factory to orchestrate data movement. You need to monitor pipeline runs and set up alerts when a pipeline fails more than three times in an hour. What is the most efficient approach?

Accepted Answer

Create an Azure Monitor metric alert for the 'Failed pipeline runs' metric with a threshold of 3 in 1 hour.. Option D is correct because Azure Monitor alerts can be configured based on metrics like Failed pipeline runs with a threshold of 3 in 1 hour. Option A is wrong because Alert rules in Data Factory are limited. Option B is wrong because diagnostic settings send logs to Log Analytics, but you would need to create a log alert, which is less efficient than a metric alert. Option C is wrong because a logic app is not the most efficient for simple threshold alerts.

Answer

Create an alert rule in Azure Data Factory based on the 'Failed pipeline runs' metric.

Answer

Configure diagnostic settings to send logs to Log Analytics and create a log alert.

Answer

Use a Logic App to periodically check the pipeline run status and send notifications.

Question 10

You are optimizing the performance of an Azure Synapse Analytics dedicated SQL pool. Which TWO actions can help reduce data movement during query execution?

Accepted Answer

Use replicated tables for small dimension tables.. Options A and B are correct. Distributing tables on join keys reduces shuffling. Using replicated tables for small dimension tables avoids broadcasting. Option C is wrong because round-robin distribution increases data movement. Option D is wrong because hash distribution on a non-join column may cause unnecessary shuffling. Option E is wrong because increasing resource class does not directly reduce data movement.

Answer

Use hash distribution on a column that is not used in joins.

Answer

Use round-robin distribution for large fact tables.

Answer

Increase the resource class for the loading user.