DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 10 — 15 Questions

Question 1

Your company uses Azure Purview for data governance. You need to ensure that sensitive data in Azure Data Lake Storage Gen2 is automatically detected and classified. What should you configure in Purview?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a scan rule set that includes built-in classification rules for sensitive data types.. In Microsoft Purview, you can create scan rule sets that include built-in classification rules to automatically detect sensitive data types during scanning. Option A is incorrect because sensitivity labels are applied after classification, not for detection. Option B is incorrect because Microsoft Defender for Cloud's data sensitivity discovery is a different feature; Purview itself handles classification. Option C is incorrect because Azure Policy enforces compliance rules, not data classification at the file level.

Answer

Apply sensitivity labels to the storage account using Microsoft Purview Information Protection.

Answer

Enable Microsoft Defender for Cloud's data sensitivity discovery.

Answer

Use Azure Policy to enforce tagging of resources containing sensitive data.

Question 2

You are reviewing an Azure PowerShell script that sets permissions on a directory in Azure Data Lake Storage Gen2. The script sets a default ACL for a user on the path 'sales/2024/01/'. What is the effect of the -DefaultScope parameter?

Accepted Answer

The ACL is inherited by all new child items created under this directory.. The -DefaultScope parameter in Azure Data Lake Storage Gen2 sets a default ACL entry. Default ACLs do not set permissions on the current directory; instead, they define permissions that are inherited by new child items (files and subdirectories) created under that directory. Therefore, option B is correct. Option A is incorrect because default ACLs do not replace the access ACL; access ACLs are set separately without -DefaultScope. Option C is incorrect because default ACLs do not apply to existing items; they only affect future items. Option D is incorrect because default ACLs apply to both new files and new subdirectories.

Answer

The ACL replaces the existing access ACL on the directory.

Answer

The ACL is applied to all existing files and subdirectories recursively.

Answer

The ACL is applied only to files, not subdirectories.

Question 3

You are monitoring Azure Data Factory pipelines. You need to set up an alert when a pipeline run fails. What is the most efficient way to achieve this?

Accepted Answer

Create an Azure Monitor alert based on the 'Failed pipeline runs' metric.. The most efficient way to alert on pipeline failures is to use the 'Failed pipeline runs' metric in Azure Monitor, as it is a native metric provided by Azure Data Factory without additional configuration. Option A (logging to custom table) requires extra activities and setup. Option B (diagnostic settings and log alerts) is possible but more complex than using the metric. Option D (Application Insights) is not directly integrated for pipeline run monitoring.

Answer

Add an activity in each pipeline to log failures to a custom table in Log Analytics.

Answer

Enable diagnostic settings to send pipeline runs to a Log Analytics workspace and create a log alert.

Answer

Use Application Insights to monitor pipeline executions.

Question 4

Which TWO actions should you take to secure access to an Azure Data Lake Storage Gen2 account using Microsoft Entra ID?

Accepted Answer

Assign Azure RBAC roles such as Storage Blob Data Contributor to users or groups.. Correct options are B and E. Option B: Assigning Azure RBAC roles such as Storage Blob Data Contributor uses Microsoft Entra ID to grant coarse-grained access to the storage account. Option E: Enabling hierarchical namespace is necessary to use ACLs (access control lists) for fine-grained permissions, which can be integrated with Entra ID. Option A is wrong because SAS tokens bypass Entra ID and provide access via shared key. Option C is wrong because firewall rules restrict network access, not identity. Option D is wrong because storage account access keys bypass Entra ID entirely.

Answer

Generate a shared access signature (SAS) token with limited permissions.

Answer

Configure a storage firewall to allow only specific IP addresses.

Answer

Use storage account access keys for authentication.

Question 5

Which THREE metrics should you monitor for an Azure Synapse Analytics dedicated SQL pool to ensure optimal performance?

Accepted Answer

tempdb usage. Options A, B, and C are correct. tempdb usage (A) indicates contention and performance issues. DWU usage (B) shows resource utilization and can help determine if scaling is needed. Queued queries (C) indicate concurrency bottlenecks and performance degradation. Option D (Login failures) is not a performance metric, it's security. Option E (Total storage size) is capacity monitoring, not performance.

Answer

Login failures

Answer

Total storage size

Question 6

Which TWO methods can you use to optimize the cost of storing data in Azure Data Lake Storage Gen2?

Accepted Answer

Configure lifecycle management policies to move older data to the cool or archive tier.. Options B and D are correct. Option B: Configure lifecycle management policies to automatically move data to cooler tiers (cool or archive) based on age, reducing storage costs. Option D: Azure Blob Storage access tiers (hot, cool, archive) allow you to choose the appropriate tier for data based on access frequency, optimizing cost. Option A is incorrect because using customer-managed keys for encryption does not affect storage costs; encryption is free. Option C is incorrect: enabling soft delete adds storage overhead for deleted versions, increasing cost. Option E is incorrect: geo-redundant storage (GRS) replicates data to another region, increasing storage cost.

Answer

Use customer-managed keys for encryption.

Answer

Enable soft delete for blobs.

Answer

Enable geo-redundant storage (GRS) for disaster recovery.

Question 7

You are reviewing an Azure Data Factory pipeline JSON that copies data from Azure Blob Storage to Azure SQL Database using a stored procedure. The pipeline fails with a 'Parameter supplied for object is not valid' error. What is the most likely cause?

Accepted Answer

The stored procedure parameters are not mapped to source columns.. The error 'Parameter supplied for object is not valid' in a copy activity using a stored procedure typically indicates that the stored procedure is expecting parameters that are not being provided correctly. The most common cause is that the source columns in the copy activity are not mapped to the stored procedure parameters. Option C is correct because the pipeline JSON likely lacks the necessary parameter mapping from source columns to stored procedure input parameters. Option A is incorrect because BlobSource is valid for Azure Blob Storage. Option B is incorrect because the error is about parameter supply, not the existence of a table type. Option D is incorrect because the error relates to parameter mapping, not dataset references.

Answer

The source type 'BlobSource' is not compatible with Azure Blob Storage.

Answer

The SQL table type 'dbo.InsertType' does not exist.

Answer

The dataset references are incorrect.

Question 8

You are designing a data processing solution using Azure Databricks with Delta Live Tables (DLT). The solution must handle late-arriving data and ensure that updates to the delta table are processed exactly once. Which DLT pipeline setting should you configure?

Accepted Answer

Configure the DLT pipeline with 'Delta Live Tables' and use 'APPLY CHANGES INTO' with a watermark.. DLT pipelines support exactly-once processing and handle late data via watermarking and append-only or update modes. Option A is wrong because 'Trigger once' processes data one time only, not continuous. Option B is wrong because 'Continuous' mode processes data as it arrives but may not guarantee exactly-once without proper configuration. Option C is wrong because 'File arrival' is not a DLT setting.

Answer

Set the pipeline mode to 'Trigger once'.

Answer

Set the pipeline mode to 'Continuous' and enable 'Exactly once' delivery.

Answer

Use Auto Loader with 'file arrival' mode.

Question 9

Your company uses Azure Data Lake Storage Gen2. You need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable 'Azure Storage encryption' with customer-managed keys in the storage account's encryption blade.. Azure Storage encryption with customer-managed keys is configured in the encryption blade of the storage account. This ensures data at rest is encrypted using a key stored in Azure Key Vault. Option A is incorrect because Azure Policy can audit or enforce encryption but does not configure customer-managed keys. Option C is incorrect because client-side encryption encrypts data before it reaches Azure Storage, not at rest. Option D is incorrect because infrastructure encryption provides a second encryption layer but does not use customer-managed keys for the primary encryption.

Answer

Use Azure Policy to audit storage accounts without encryption.

Answer

Implement client-side encryption in the application code.

Answer

Enable 'Infrastructure encryption' for double encryption.

Question 10

Your Azure Data Lake Storage Gen2 account stores sensitive data. You need to audit who accesses the data and when, and you want to send the audit logs to a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Diagnostic settings on the storage account. Diagnostic settings on the storage account can stream audit logs (like read, write, delete) to Log Analytics for analysis. Option A is incorrect because Azure Activity Logs capture control plane operations, not data plane access. Option B is incorrect because Microsoft Sentinel is a SIEM that would consume logs from diagnostic settings, not a direct configuration for log collection. Option C is incorrect because Azure Monitor alerts are for notifications based on metrics or logs, not for collecting logs.

Answer

Azure Activity Logs

Answer

Microsoft Sentinel

Answer

Azure Monitor alerts

Question 11

You have an Azure Synapse Analytics dedicated SQL pool. You notice that some queries are taking longer than expected due to excessive data movement operations. You need to minimize data movement without changing the distribution columns. Which table design approach should you recommend?

Accepted Answer

Use replicated tables for small dimension tables. Replicated tables are recommended for small dimension tables because they are copied to all compute nodes, avoiding data movement during joins. This reduces excessive data movement without changing distribution columns. Option B is incorrect because round-robin distribution distributes data evenly but does not reduce data movement for joins; it is typically used for staging tables. Option C is incorrect because using hash distribution for all tables can lead to data movement when joining on different columns, and it is not a one-size-fits-all solution. Option D is incorrect because partitioning alone does not reduce data movement; it is used for data management and pruning, not for minimizing shuffle operations.

Answer

Use round-robin distribution for dimension tables

Answer

Use hash distribution for all tables

Answer

Use partitioning on join columns

Question 12

You are designing an Azure Data Factory pipeline to ingest data from an on-premises SQL Server into Azure Synapse Analytics. The data must be encrypted in transit. Which integration runtime type should you use and what additional configuration is required?

Accepted Answer

Use Self-hosted Integration Runtime with a certificate for HTTPS. A self-hosted integration runtime is required to connect to on-premises networks. To encrypt data in transit, a certificate must be configured for HTTPS encryption. Option A is wrong because Azure Integration Runtime cannot directly access on-premises data sources. Option B is incorrect because Azure VPN Gateway provides network-level connectivity but does not handle application-layer encryption; the self-hosted IR still needs a certificate. Option D is wrong because using a public endpoint does not ensure encryption in transit without additional configuration, and Azure IR still cannot access on-premises directly.

Answer

Use Azure Integration Runtime with ExpressRoute

Answer

Use Self-hosted Integration Runtime with Azure VPN Gateway

Answer

Use Azure Integration Runtime with a public endpoint

Question 13

You need to monitor the performance of Azure Stream Analytics jobs. Which Azure Monitor metric can be used to detect if the job is falling behind in processing input data?

Accepted Answer

InputEventsBacklog. InputEventsBacklog tracks the number of input events that remain unprocessed, directly indicating whether the job is falling behind. WatermarkDelay (option A) measures the time difference between event occurrence and processing, which can indicate latency but not the backlog count. OutputEvents (option C) counts events sent to output, unrelated to backlog. RuntimeErrors (option D) counts errors, not backlog.

Answer

WatermarkDelay

Answer

OutputEvents

Answer

RuntimeErrors

Question 14

Your organization uses Azure Purview for data governance. You need to ensure that only authorized users can register data sources and create classification rules, while other data consumers can only search and browse the data catalog. What should you configure?

Accepted Answer

Assign the Data Curator role to curators and Data Reader role to consumers. Azure Purview uses roles: Data Curator can register sources and manage classifications; Data Reader can only search and browse. Option A is wrong because Data Source Administrator can only manage source registrations. Option C is wrong because Collection Admin manages collections. Option D is wrong because there is no 'Catalog Admin' role; Purview has built-in roles.

Answer

Assign the Catalog Admin role to curators and Data Reader role to consumers

Answer

Assign the Collection Admin role to curators and Data Reader role to consumers

Answer

Assign the Data Source Administrator role to curators and Data Reader role to consumers

Question 15

You have an Azure Synapse Analytics serverless SQL pool that queries data in Azure Data Lake Storage Gen2. You need to ensure that only users with specific Microsoft Entra ID groups can access the data through the serverless SQL pool. What should you configure?

Accepted Answer

Grant the Microsoft Entra ID group CONNECT permission on the serverless SQL pool and configure ACLs on the storage to allow read access for the group. Controlling access involves two layers: the serverless SQL pool and the underlying storage. Users must have both CONNECT permission on the SQL pool to query and appropriate ACLs on the storage to read the data. Granting the Microsoft Entra ID group CONNECT permission and configuring ACLs on the storage account to allow read access for the group ensures that only those users can access data through the serverless SQL pool. Option A is incorrect because the Storage Blob Data Reader role alone does not grant SQL-level permissions. Option C is incorrect because firewall rules are network-level and do not provide granular user access. Option D is incorrect because SAS tokens are not recommended for user-level access and bypass Entra ID permissions.

Answer

Grant the Microsoft Entra ID group the Storage Blob Data Reader role on the storage account

Answer

Configure a firewall rule to allow only the Microsoft Entra ID group IP ranges

Answer

Use a shared access signature (SAS) token with the SQL pool and distribute it to users