DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 10 — 15 Questions

Question 1

You are designing an Azure Data Factory pipeline to ingest data from an on-premises SQL Server into Azure Synapse Analytics. The data must be encrypted in transit. Which integration runtime type should you use and what additional configuration is required?

Accepted Answer

Use Self-hosted Integration Runtime with a certificate for HTTPS. A self-hosted integration runtime is needed to connect to on-premises networks. To encrypt data in transit, the certificate must be used for HTTPS encryption. Option A is wrong because Azure IR cannot access on-premises directly. Option C is wrong because ExpressRoute provides private connectivity but does not handle encryption at the application layer. Option D is wrong because VPN Gateway is a network-level solution; ADF still needs self-hosted IR.

Answer

Use Azure Integration Runtime with ExpressRoute

Answer

Use Self-hosted Integration Runtime with Azure VPN Gateway

Answer

Use Azure Integration Runtime with a public endpoint

Question 2

You need to monitor the performance of Azure Stream Analytics jobs. Which Azure Monitor metric can be used to detect if the job is falling behind in processing input data?

Accepted Answer

InputEventsBacklog. InputEventsBacklog measures the number of input events that are not yet processed, indicating the job is falling behind. Option B is wrong because OutputEvents counts events written. Option C is wrong because WatermarkDelay shows the latency. Option D is wrong because RuntimeErrors counts errors.

Answer

WatermarkDelay

Answer

OutputEvents

Answer

RuntimeErrors

Question 3

Your organization uses Azure Purview for data governance. You need to ensure that only authorized users can register data sources and create classification rules, while other data consumers can only search and browse the data catalog. What should you configure?

Accepted Answer

Assign the Data Curator role to curators and Data Reader role to consumers. Azure Purview uses roles: Data Curator can register sources and manage classifications; Data Reader can only search and browse. Option A is wrong because Data Source Administrator can only manage source registrations. Option C is wrong because Collection Admin manages collections. Option D is wrong because there is no 'Catalog Admin' role; Purview has built-in roles.

Answer

Assign the Catalog Admin role to curators and Data Reader role to consumers

Answer

Assign the Collection Admin role to curators and Data Reader role to consumers

Answer

Assign the Data Source Administrator role to curators and Data Reader role to consumers

Question 4

You have an Azure Synapse Analytics serverless SQL pool that queries data in Azure Data Lake Storage Gen2. You need to ensure that only users with specific Microsoft Entra ID groups can access the data through the serverless SQL pool. What should you configure?

Accepted Answer

Grant the Microsoft Entra ID group CONNECT permission on the serverless SQL pool and configure ACLs on the storage to allow read access for the group. Controlling access involves two layers: the SQL pool itself and the underlying storage. Users must have both CONNECT permission on the SQL pool and read permissions on the storage via ACLs (using their managed identity or user identity). Option A is wrong because firewall rules are network-level. Option B is wrong because storage account keys are not used with Microsoft Entra authentication. Option D is wrong because SAS tokens are not recommended for user-level access.

Answer

Grant the Microsoft Entra ID group the Storage Blob Data Reader role on the storage account

Answer

Configure a firewall rule to allow only the Microsoft Entra ID group IP ranges

Answer

Use a shared access signature (SAS) token with the SQL pool and distribute it to users

Question 5

You are optimizing an Azure Synapse Analytics dedicated SQL pool. The pool has a large fact table distributed by hash on CustomerID. Most queries filter on OrderDate. You need to improve query performance for date-range queries without changing the distribution. What should you do?

Accepted Answer

Partition the table on OrderDate. Adding a partition on OrderDate allows partition elimination, reducing data scanned. Distribution remains unchanged. Option A is wrong because changing to round-robin would increase data movement. Option B is wrong because adding indexes is not supported in dedicated SQL pool (only clustered columnstore indexes are used). Option D is wrong because materialized views can help but are not specifically for date-range filtering on a large table; partition elimination is more direct.

Answer

Change the distribution to round-robin on OrderDate

Answer

Create a materialized view on OrderDate

Answer

Create a non-clustered index on OrderDate

Question 6

You need to ensure that an Azure Data Factory pipeline retries a failed activity up to three times with a 5-minute delay between retries. How should you configure the activity?

Accepted Answer

Set retry to 3 and retryIntervalInSeconds to 300 in the activity policy. The retry property in activity policy sets the number of retries, and retryIntervalInSeconds sets the delay. Option B is wrong because there is no 'maxRetries' property; it's 'retry'. Option C is wrong because 'retryPolicy' is not a property; retry is at the activity level. Option D is wrong because timeout is separate from retry.

Answer

Configure the Retry policy on the pipeline activity as 'Exponential' with count 3

Answer

Set the activity timeout to 15 minutes and enable retry

Answer

Set maxRetries to 3 and delay to 5 minutes in the pipeline JSON

Question 7

Which TWO actions should you take to secure data at rest in Azure Data Lake Storage Gen2?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) for data at rest. Enabling encryption at rest (Azure Storage Service Encryption) and using Azure RBAC to control access are both security best practices. Option C is wrong because firewall rules are network-level, not data-at-rest. Option D is wrong because soft delete is for recovery, not security. Option E is wrong because diagnostic settings are for auditing, not encryption.

Answer

Enable diagnostic settings to audit access

Answer

Configure firewall rules to restrict network access

Answer

Enable soft delete for blobs

Question 8

Which THREE metrics should you monitor to evaluate the performance of an Azure Stream Analytics job?

Accepted Answer

Input Events Backlogged. WatermarkDelay (indicates latency), InputEventsBacklog (backlog of unprocessed events), and OutputEvents (throughput) are key performance metrics. Option D is wrong because SU (Memory) utilization is a resource metric, not a performance metric. Option E is wrong because ConversionErrors is an error metric, not a performance indicator.

Answer

Conversion Errors

Answer

SU (Memory) Utilization

Question 9

Which TWO Azure services can be used to monitor Azure Data Factory pipeline runs and set up alerts?

Accepted Answer

Log Analytics. Azure Monitor provides metrics and logs for ADF, and Log Analytics allows querying and alerting based on logs. Option C is wrong because Microsoft Sentinel is a SIEM that ingests from Log Analytics, not directly. Option D is wrong because Azure Policy is for governance. Option E is wrong because Azure Advisor provides recommendations, not monitoring.

Answer

Microsoft Sentinel

Answer

Azure Policy

Answer

Azure Advisor

Question 10

Refer to the exhibit. You are reviewing an ARM template for an Azure Data Lake Storage Gen2 account. Which of the following security best practices is violated in this template?

Accepted Answer

The account allows HTTP traffic and uses an outdated TLS version. Setting supportsHttpsTrafficOnly to false allows HTTP traffic, which is insecure. Also, minimumTlsVersion TLS1_0 is outdated and insecure. Option A is wrong because HNS is enabled correctly. Option B is wrong because Standard_LRS is a valid SKU. Option D is wrong because location is correct.

Answer

The location should be fixed instead of using resourceGroup().location

Answer

The SKU should be Standard_GRS for disaster recovery

Answer

The account does not enable hierarchical namespace (HNS)

Question 11

Refer to the exhibit. You are reviewing a Data Factory JSON definition. The factory has a user-assigned managed identity configured. However, the linked service to Azure Storage uses an account key. What security improvement should you recommend?

Accepted Answer

Modify the linked service to use the managed identity for authentication. Using the managed identity instead of account key is more secure because it avoids storing secrets. Option A is wrong because the managed identity is already configured but not used. Option B is wrong because firewall rules are separate. Option D is wrong because switching to Key Vault still stores a secret; managed identity is preferred when possible.

Answer

Add a firewall rule to limit access to the storage account

Answer

Remove the managed identity and use a service principal

Answer

Keep the account key but store it in Azure Key Vault

Question 12

Refer to the exhibit. You run the Kusto query in Azure Monitor Logs to analyze Data Factory pipeline runs. What is the purpose of this query?

Accepted Answer

Identify pipelines with the most failed activity runs per hour. The query filters failed activity runs, groups by pipeline and hourly bins, then sorts by count descending to show pipelines with most failures. Option B is wrong because it's not about duration. Option C is wrong because it's not about all runs. Option D is wrong because it's not about triggers.

Answer

List all pipeline runs regardless of status

Answer

Calculate the average duration of failed pipeline runs

Answer

Show the number of failed trigger runs per hour

Question 13

You are designing a data processing solution in Azure Synapse Analytics. The solution must prevent unauthorized access to data at rest and in transit. Which combination of features should you implement?

Accepted Answer

Enable Transparent Data Encryption (TDE) and enforce TLS 1.2.. Option B is correct because TDE encrypts data at rest and TLS 1.2 encrypts data in transit. Option A is wrong because Azure RBAC controls access but does not encrypt data. Option C is wrong because Always Encrypted is for client-side encryption, not for all data at rest. Option D is wrong because Azure Key Vault stores keys but does not encrypt data itself.

Answer

Use Azure RBAC and firewall rules.

Answer

Use Always Encrypted and column-level security.

Answer

Store encryption keys in Azure Key Vault and enable double encryption.

Question 14

Your Azure Data Lake Storage Gen2 account stores sensitive customer data. You need to ensure that data is encrypted at rest using customer-managed keys (CMK) and that access to the encryption key is logged. What should you do?

Accepted Answer

Configure customer-managed keys in Azure Key Vault and enable Key Vault diagnostics logging.. Option D is correct because CMK with Key Vault provides customer-controlled encryption keys, and Key Vault diagnostics logs key access. Option A is wrong because infrastructure encryption uses platform-managed keys. Option B is wrong because SSE with platform-managed keys does not give customer control. Option C is wrong because Double Encryption uses both platform and customer keys, but the primary requirement is CMK and logging.

Answer

Enable infrastructure encryption on the storage account.

Answer

Enable double encryption using both platform-managed and customer-managed keys.

Answer

Use Azure Storage Service Encryption (SSE) with platform-managed keys.

Question 15

You need to monitor the performance of Azure Synapse Analytics dedicated SQL pool queries. Which Azure service should you use to identify long-running queries and resource bottlenecks?

Accepted Answer

Azure Synapse Studio monitoring hub and dynamic management views (DMVs).. Option A is correct because SQL pool monitoring provides DMVs and metrics for query performance. Option B is wrong because Azure Monitor Logs can be used but is not the primary tool for live query monitoring. Option C is wrong because Log Analytics requires setting up data collection. Option D is wrong because Microsoft Purview is for data governance, not performance monitoring.

Answer

Microsoft Purview Data Map.

Answer

Azure Log Analytics queries.

Answer

Azure Monitor Workbooks.