DP-203 Secure, monitor, and optimize data storage and data processing — 20 Questions

Question 1

Your team uses Azure Data Factory to copy data from on-premises SQL Server to Azure Blob Storage. You need to ensure that data in transit is encrypted using TLS 1.2. What should you configure?

Accepted Answer

Ensure the Azure Data Factory pipeline uses HTTPS for the copy activity.. Azure Data Factory uses HTTPS by default, which enforces TLS encryption for data in transit. Option B is wrong because VPN is not required for TLS encryption. Option C is wrong because configuring the on-premises SQL Server to use SSL certificates is necessary but not sufficient; Azure Data Factory must also use HTTPS. Option D is wrong because Azure ExpressRoute provides a private connection but does not replace TLS.

Answer

Set up a site-to-site VPN between the on-premises network and Azure.

Answer

Configure the on-premises SQL Server to use SSL certificates.

Answer

Use Azure ExpressRoute with private peering.

Question 2

Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to grant a service principal read and write access to a specific directory without granting access to the parent directories. What should you use?

Accepted Answer

Assign the Storage Blob Data Contributor role at the directory level using RBAC.. Azure RBAC with scope at the directory level can be assigned using the Storage Blob Data Contributor role. Option B is wrong because managed identity is an identity, not a permission mechanism. Managed identity provides an identity for Azure resources, but permissions must be assigned via RBAC or ACLs. Option C is wrong because stored access policies are used for shared access signatures (SAS), not for granting permissions to a service principal. Option D is wrong because ACLs can be used for fine-grained permissions, but they are scoped to the file system level for default ACLs, and assigning ACLs directly to a directory can provide permission, but default ACLs apply to child items. However, for a service principal, using RBAC at directory scope is more appropriate.

Answer

Use a managed identity and assign it to the directory.

Answer

Create a stored access policy on the directory.

Answer

Set ACLs on the directory with default ACLs for the service principal.

Question 3

Your team is using Azure Synapse Analytics to process sensitive customer data. You need to ensure that column-level security is applied to a specific table so that only users with a certain role can view certain columns. Which feature should you use?

Accepted Answer

Column-level security (CLS). Column-level security (CLS) in Azure Synapse restricts access to specific columns based on user's group membership or role. Option B is incorrect because row-level security (RLS) filters rows, not columns. Option C is incorrect because Azure Purview data policies are used for data governance and classification, not for implementing column-level access control. Option D is incorrect because dynamic data masking (DDM) obfuscates data at query time but does not restrict which columns a user can see; it still allows access to the column but masks the data.

Answer

Row-level security (RLS)

Answer

Azure Purview data policies

Answer

Dynamic data masking (DDM)

Question 4

You are responsible for securing an Azure Synapse Analytics workspace. You need to ensure that only authorized users can query the serverless SQL pool. Which authentication method should you use?

Accepted Answer

Microsoft Entra ID authentication. Microsoft Entra ID authentication (formerly Azure AD) is the recommended authentication method for serverless SQL pools in Azure Synapse Analytics. It provides centralized identity management, supports conditional access policies, and allows individual user identities to be used for auditing and access control. Option B (managed identity) is designed for service-to-service authentication (e.g., Azure services), not for interactive user queries. Option C (SQL authentication) is less secure as it relies on static credentials, and Microsoft recommends against it for production workloads. Option D (Azure Key Vault) is a secret store, not an authentication method.

Answer

Managed identity authentication

Answer

SQL authentication

Answer

Azure Key Vault authentication

Question 5

Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only users with specific Microsoft Entra ID roles can query the data. What should you configure?

Accepted Answer

Assign the Storage Blob Data Contributor role to the users on the Azure Data Lake Storage Gen2 account.. Azure Synapse Analytics serverless SQL pools rely on Microsoft Entra ID tokens and RBAC roles to authorize access to data in Azure Data Lake Storage Gen2. The Storage Blob Data Contributor role grants read and write access to data. Option B is wrong because SAS tokens are shared secrets, not tied to user identity. Option C is wrong because firewall rules control network access, not user-level authorization. Option D is wrong because managed identity is not suitable for per-user authorization.

Answer

Generate a shared access signature (SAS) token for the storage account and include it in the external table definition.

Answer

Configure an IP firewall rule on the storage account to allow only the SQL pool's outbound IP addresses.

Answer

Create a managed identity for the SQL pool and grant it access to the storage account.

Question 6

Your Azure Synapse Analytics dedicated SQL pool query performance is degrading over time. You suspect that the statistics might be outdated. What is the most efficient way to update statistics for all tables in the pool?

Accepted Answer

Execute `sp_updatestats` in the user database.. `sp_updatestats` updates statistics for all tables in the current user database efficiently. Option A is wrong: while automatic statistics update is enabled by default, it may not immediately address performance degradation if the statistics are outdated; waiting is not proactive. Option B is wrong: `sp_updatestats` in the master database updates only system tables, not user tables. Option D is wrong: running `UPDATE STATISTICS` on each table individually is less efficient than using `sp_updatestats` for all tables.

Answer

Enable automatic statistics update and wait for the system to update them.

Answer

Execute `sp_updatestats` in the master database.

Answer

Run `UPDATE STATISTICS` on each table individually.

Question 7

You are designing a data processing solution using Azure Databricks. You need to optimize costs while maintaining performance. Which TWO strategies should you implement? (Choose two.)

Accepted Answer

Use spot instances for non-critical, fault-tolerant workloads.. Options A and B are correct. A: Using spot instances reduces costs for fault-tolerant workloads. B: Autoscaling adjusts resources based on workload. Option C is wrong because using larger VMs may lead to underutilization and higher costs. Option D is wrong because all-purpose clusters are more expensive and not recommended for production jobs. Option E is wrong because Azure Databricks does not offer a serverless pricing tier for compute; you pay for running VMs.

Answer

Always choose the largest VM sizes to minimize cluster count.

Answer

Use all-purpose clusters for all workloads to avoid startup delays.

Answer

Use the serverless pricing tier to avoid paying for idle resources.

Question 8

You use Azure Data Lake Storage Gen2 with a hierarchical namespace. You need to delegate permissions to a group of data scientists so they can create folders and upload files only within a specific directory path. What is the best way to achieve this?

Accepted Answer

Set ACL entries on the specific directory path granting read, write, and execute permissions to the users.. Azure Data Lake Storage Gen2 supports POSIX-like ACLs that can be set on directory paths to grant granular permissions. Option A is wrong because stored access policies are used to control permissions for shared access signatures (SAS), not to directly grant directory-level permissions. Option C is wrong because SAS tokens are scoped to the storage account or container level, not to subdirectories. Option D is wrong because assigning the Storage Blob Data Contributor role at the storage account level grants permissions to the entire account or container, which is too broad for the requirement.

Answer

Use a stored access policy to grant permissions to the directory.

Answer

Generate a shared access signature (SAS) with permissions scoped to the specific directory.

Answer

Assign the Storage Blob Data Contributor role to the users at the storage account level.

Question 9

Which TWO security features should be implemented to protect data in Azure Data Lake Storage Gen2?

Accepted Answer

Role-based access control (RBAC). (RBAC) is correct because it provides coarse-grained access control for Azure Data Lake Storage Gen2. Option D (Firewall and virtual network rules) is correct because it restricts network access to the storage account. Option B (Azure Policy) is incorrect because it is used for governance and compliance, not directly for data protection. Option C (Azure Active Directory integration) is incorrect because while it provides authentication, it is not a security feature specific to data protection in ADLS Gen2; it is a prerequisite for RBAC. Option E (Azure Monitor alerts) is incorrect because it is for monitoring and alerting, not for implementing security controls.

Answer

Azure Policy

Answer

Azure Active Directory (Microsoft Entra ID) integration

Answer

Azure Monitor alerts

Question 10

Which TWO Azure services can be used to monitor data pipeline runs and set up alerts for failures in Azure Data Factory?

Accepted Answer

Azure Data Factory monitoring views. Options A and D are correct. Azure Monitor is the primary service for monitoring and alerts; Azure Data Factory metrics and logs are sent to Azure Monitor. Option B (Azure Log Analytics) is wrong because Log Analytics is part of Azure Monitor, not a separate service for alerting. Option C (Azure Sentinel) is wrong because Azure Sentinel is for security, not pipeline monitoring. Option E is wrong because Azure Automation is for automation, not monitoring.

Answer

Azure Log Analytics

Answer

Azure Sentinel

Answer

Azure Automation

Question 11

Refer to the exhibit. You are deploying an Azure Synapse Analytics workspace using an ARM template. The exhibit shows the encryption configuration. What is the effect of setting infrastructureEncryption to Enabled?

Accepted Answer

It adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys.. Enabling infrastructureEncryption adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys (double encryption). Option A is incorrect because enabling infrastructure encryption does not disable customer-managed key encryption; it adds an additional layer. Option B is incorrect because infrastructure encryption applies to data at rest, not in transit between nodes. Option C is incorrect because infrastructure encryption applies to the entire Azure Synapse Analytics workspace, not just SQL pools, and it is not transparent data encryption (TDE); it is a separate infrastructure-level encryption.

Answer

It disables encryption using the customer-managed key.

Answer

It enables encryption of data in transit between nodes.

Answer

It enables transparent data encryption for SQL pools.

Question 12

You have an Azure Synapse Analytics dedicated SQL pool that stores sensitive financial data. You need to ensure that all queries accessing the data are audited and that any use of unapproved client tools is blocked. What should you implement?

Accepted Answer

Enable auditing and set an IP firewall rule that allows only approved IP ranges.. Azure Synapse Analytics supports IP firewall rules and auditing. By enabling auditing and creating a firewall rule that only allows approved client IP ranges, you can both audit queries and block unapproved tools. Option A is wrong because Microsoft Defender for Cloud provides threat detection but not granular control over client tools. Option B is wrong because Azure Private Link only provides network-level isolation, not auditing or blocking. Option D is wrong because Azure role-based access control (RBAC) alone does not enforce client tool restrictions.

Answer

Enable Microsoft Defender for Cloud on the server.

Answer

Configure Azure Private Link for the dedicated SQL pool.

Answer

Assign Azure RBAC roles to users for the SQL pool.

Question 13

You are optimizing a Slowly Changing Dimension (SCD) Type 2 load in Azure Synapse Analytics. The dimension table has 10 million rows. Which table distribution strategy minimizes data movement during the merge operation?

Accepted Answer

Hash distribution on the business key. Hash distribution on the business key ensures that rows with the same business key are co-located, minimizing data movement during the MERGE operation for SCD Type 2. Option A is wrong because Round-robin distributes rows randomly, causing significant data shuffling. Option B is wrong because Hash distribution on the surrogate key is ineffective; surrogate keys are typically sequential and not used in matching conditions, leading to data movement. Option C is wrong because Replicated distribution is unsuitable for a table with 10 million rows, as replication copies the entire table to each distribution, causing high storage and maintenance overhead.

Answer

Round-robin distribution

Answer

Hash distribution on the surrogate key

Answer

Replicated distribution

Question 14

You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies the creation or update of a storage account if its default blob service version is not set to '2020-10-02'. The policy denies any storage account creation or update if the default blob service version is not set to '2020-10-02'. Option B is wrong because the policy denies non-compliant resources, it does not set the version. Option C is wrong because the policy uses the 'deny' effect, not 'audit'. Option D is wrong because it denies if the version is not set to the specified value, not if it is set to that value.

Answer

Sets the default blob service version of all storage accounts to '2020-10-02'

Answer

Audits storage accounts to check if their default blob service version is set to a value other than '2020-10-02'

Answer

Denies the creation of storage accounts that have the default blob service version set to '2020-10-02'

Question 15

Your company uses Azure Databricks to process large datasets stored in Azure Data Lake Storage Gen2. You need to implement a solution that automatically rotates the storage account access keys every 90 days without interrupting running jobs. The solution should use managed identities where possible. What should you do?

Accepted Answer

Configure Azure Databricks to use a user-assigned managed identity for authentication to Azure Data Lake Storage Gen2.. Using a user-assigned managed identity for Databricks to access Azure Data Lake Storage Gen2 eliminates the need for access keys and prevents job interruption during key rotation. Option B is wrong because Azure Policy cannot directly update Databricks cluster configurations, and key rotation would disrupt jobs relying on keys. Option C is wrong because storing keys in Azure Key Vault with a lifecycle policy still requires updating Databricks secrets, potentially interrupting running jobs, and managed identity is a simpler, more secure approach. Option D is wrong because generating a SAS token with a 90-day expiry requires manual management and rotation, and if not updated on time, jobs will fail.

Answer

Use Azure Policy to automatically rotate keys and update Databricks cluster configurations.

Answer

Use Azure Key Vault to store the storage account keys and configure a lifecycle policy to rotate them every 90 days. Update Databricks secrets accordingly.

Answer

Generate a SAS token with a 90-day expiry and update the Databricks secret before expiry.

Question 16

Your organization needs to ensure that all data stored in Azure Data Lake Storage Gen2 is encrypted at rest using Microsoft-managed keys. What is the default encryption method?

Accepted Answer

Storage Service Encryption (SSE) with Microsoft-managed keys.. Azure Storage automatically encrypts all data at rest using Storage Service Encryption (SSE) with Microsoft-managed keys by default. Option B is incorrect because Transparent Data Encryption (TDE) is a feature for Azure SQL databases, not for Azure Storage accounts. Option C is incorrect because client-side encryption is not the default; it is an additional option. Option D is incorrect because Azure Disk Encryption is used for encrypting OS and data disks on virtual machines, not for storage accounts.

Answer

Transparent Data Encryption (TDE) on the storage account.

Answer

Client-side encryption with keys stored in Azure Key Vault.

Answer

Azure Disk Encryption on the storage nodes.

Question 17

Your Azure Stream Analytics job is failing to start because the job's storage account is configured to allow access from selected networks. The job uses managed identity for authentication. What should you do to resolve the issue?

Accepted Answer

Add the Stream Analytics job's managed identity as a trusted service in the storage account firewall.. The Stream Analytics job's managed identity must be added as a trusted service to bypass the network restrictions. Option A is wrong because firewall rules apply to all services; managed identity must be explicitly allowed. Option B is wrong because private endpoints require additional configuration and are not required. Option D is wrong because SAS tokens are not needed with managed identity.

Answer

Create a private endpoint for the Stream Analytics job to access the storage account.

Answer

Disable the firewall on the storage account to allow all networks.

Answer

Generate a SAS token for the storage account and configure the job to use it.

Question 18

You are responsible for securing an Azure Synapse Analytics workspace. The workspace is integrated with a Git repository for source control. You need to ensure that only authorized users can publish changes from the Git branch to the live Synapse service. What should you configure?

Accepted Answer

Assign the 'Synapse Artifact Publisher' role to specific users in the Synapse RBAC.. To control who can publish changes from a Git branch to the live Synapse service, you use Synapse RBAC. The 'Synapse Artifact Publisher' role grants permission to publish artifacts. This role can be assigned to specific users or groups. Option A is correct. Option B is wrong because Git branch permissions control repository merge operations, not publishing to Synapse. Option C is wrong because Azure Policy enforces compliance rules, not fine-grained access control for publishing. Option D is wrong because Microsoft Entra ID Conditional Access policies manage authentication conditions, not specific publish permissions.

Answer

Use Microsoft Entra ID Conditional Access policies to require multi-factor authentication for publishing.

Answer

Create an Azure Policy to deny publishing if the user is not in an approved group.

Answer

Configure branch permissions in the Git repository to restrict who can merge to the collaboration branch.

Question 19

Which TWO Azure services can you use to monitor data processing pipelines in Azure Data Factory?

Accepted Answer

Log Analytics workspace. Azure Monitor is the primary monitoring service for Azure resources, providing metrics, alerts, and diagnostics for Azure Data Factory pipelines. Log Analytics workspace enables querying and analyzing pipeline run logs, which is essential for deep monitoring and troubleshooting. Azure Sentinel (A) is a SIEM for security, not pipeline monitoring. Azure Dashboard (C) is a visualization tool that can display metrics but is not a monitoring service itself. Azure Service Health (D) tracks Azure platform health, not individual pipeline runs.

Answer

Azure Sentinel

Answer

Azure Dashboard

Answer

Azure Service Health

Question 20

You are designing a data processing solution using Azure Databricks. The solution must use Delta Lake for ACID transactions and must optimize storage costs by automatically compacting small files. Which feature should you enable?

Accepted Answer

Enable auto-optimize on the Delta table.. Delta Lake's auto-optimize feature automatically compacts small files during writes. Option A is wrong because OPTIMIZE is a manual command that requires scheduling; it is not automatic. Option B is wrong because vacuum is used to clean up old files, not to compact small files. Option C is wrong because Z-order indexing improves data skipping for queries but does not perform file compaction.

Answer

Run OPTIMIZE command in a scheduled job.

Answer

Set retention duration for vacuum to 7 days.

Answer

Enable Z-order indexing on the Delta table.