DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 11 — 15 Questions

Question 1

You need to ensure that an Azure Data Factory pipeline retries a failed activity up to three times with a 5-minute delay between retries. How should you configure the activity?

Accepted Answer

Set retry to 3 and retryIntervalInSeconds to 300 in the activity policy. The correct configuration is to set the retry property to 3 and retryIntervalInSeconds to 300 in the activity policy. This ensures up to three retries with a 5-minute (300-second) delay between each attempt. Option A is incorrect because Azure Data Factory supports a fixed retry interval, not exponential backoff via the Retry policy. Option C is incorrect because timeout is separate from retry configuration; retry is configured at the activity level. Option D is incorrect because the correct property name is 'retry' not 'maxRetries', and the delay is specified in seconds as 'retryIntervalInSeconds'.

Answer

Configure the Retry policy on the pipeline activity as 'Exponential' with count 3

Answer

Set the activity timeout to 15 minutes and enable retry

Answer

Set maxRetries to 3 and delay to 5 minutes in the pipeline JSON

Question 2

Which THREE metrics should you monitor to evaluate the performance of an Azure Stream Analytics job?

Accepted Answer

Input Events Backlogged. Watermark Delay (indicates latency), Input Events Backlogged (backlog of unprocessed events), and Output Events (throughput) are key performance metrics for an Azure Stream Analytics job. Option C (Conversion Errors) and Option D (SU (Memory) Utilization) are not performance metrics; Conversion Errors is an error metric, and SU Utilization is a resource metric.

Answer

Conversion Errors

Answer

SU (Memory) Utilization

Question 3

Which TWO Azure services can be used to monitor Azure Data Factory pipeline runs and set up alerts?

Accepted Answer

Log Analytics. Log Analytics and Azure Monitor are the correct choices because they directly support monitoring and alerting for Azure Data Factory pipeline runs. Microsoft Sentinel is a SIEM that consumes logs from Log Analytics but is not a primary monitoring service for ADF. Azure Policy enforces governance rules and does not provide monitoring. Azure Advisor offers recommendations for optimization, not real-time monitoring or alerts.

Answer

Microsoft Sentinel

Answer

Azure Policy

Answer

Azure Advisor

Question 4

Refer to the exhibit. You are reviewing an ARM template for an Azure Data Lake Storage Gen2 account. Which of the following security best practices is violated in this template?

Accepted Answer

The account allows HTTP traffic and uses an outdated TLS version. The template sets supportsHttpsTrafficOnly to false, allowing HTTP traffic, which is insecure. Additionally, minimumTlsVersion is set to TLS1_0, an outdated and insecure version. Option A is incorrect because the location uses resourceGroup().location, which is a common and acceptable practice for flexibility. Option B is incorrect because Standard_LRS is a valid SKU; Geo-redundant storage is not a security best practice requirement. Option C is incorrect because the template does enable hierarchical namespace (isHnsEnabled: true), so that is not a violation.

Answer

The location should be fixed instead of using resourceGroup().location

Answer

The SKU should be Standard_GRS for disaster recovery

Answer

The account does not enable hierarchical namespace (HNS)

Question 5

Refer to the exhibit. You are reviewing a Data Factory JSON definition. The factory has a user-assigned managed identity configured. However, the linked service to Azure Storage uses an account key. What security improvement should you recommend?

Accepted Answer

Modify the linked service to use the managed identity for authentication. The recommended security improvement is to modify the linked service to use the managed identity for authentication (option B). The user-assigned managed identity is already configured but not being used; instead, the linked service is using an account key, which requires storing a secret. Using the managed identity eliminates the need for secrets and leverages Azure AD authentication, which is more secure and easier to manage. Option A (firewall rule) addresses network access but not authentication. Option C (remove managed identity and use service principal) would replace one identity-based approach with another, but the managed identity is already in place and should be utilized. Option D (store key in Key Vault) still involves storing a secret, which is less secure than using the managed identity directly when possible.

Answer

Add a firewall rule to limit access to the storage account

Answer

Remove the managed identity and use a service principal

Answer

Keep the account key but store it in Azure Key Vault

Question 6

Refer to the exhibit. You run the Kusto query in Azure Monitor Logs to analyze Data Factory pipeline runs. What is the purpose of this query?

Accepted Answer

Identify pipelines with the most failed activity runs per hour. The query filters pipeline runs with a status of 'Failed', groups them by pipeline name and hourly time bins, then counts the number of failed activity runs per hour. The results are sorted descending by count, making it easy to identify which pipelines have the most failed activity runs per hour. Therefore, option B is correct. Option A is incorrect because the query only includes failed runs, not all runs. Option C is incorrect because the query counts runs, not calculates duration. Option D is incorrect because the query filters on pipeline runs, not trigger runs.

Answer

List all pipeline runs regardless of status

Answer

Calculate the average duration of failed pipeline runs

Answer

Show the number of failed trigger runs per hour

Question 7

You are designing a data processing solution in Azure Synapse Analytics. The solution must prevent unauthorized access to data at rest and in transit. Which combination of features should you implement?

Accepted Answer

Enable Transparent Data Encryption (TDE) and enforce TLS 1.2.. Transparent Data Encryption (TDE) encrypts data at rest in Azure Synapse Analytics, and enforcing TLS 1.2 ensures encryption of data in transit. Option B (Azure RBAC and firewall rules) controls access but does not provide encryption. Option C (Always Encrypted and column-level security) is primarily for client-side encryption and access control, not comprehensive at-rest encryption. Option D (storing keys in Key Vault and enabling double encryption) relates to key management and infrastructure encryption, but the direct combination of TDE and TLS 1.2 is the required solution.

Answer

Use Azure RBAC and firewall rules.

Answer

Use Always Encrypted and column-level security.

Answer

Store encryption keys in Azure Key Vault and enable double encryption.

Question 8

Your Azure Data Lake Storage Gen2 account stores sensitive customer data. You need to ensure that data is encrypted at rest using customer-managed keys (CMK) and that access to the encryption key is logged. What should you do?

Accepted Answer

Configure customer-managed keys in Azure Key Vault and enable Key Vault diagnostics logging.. Customer-managed keys (CMK) stored in Azure Key Vault allow you to control and audit key usage, and enabling Key Vault diagnostics logging captures access events. Option A is incorrect because infrastructure encryption uses platform-managed keys. Option B is incorrect because double encryption adds a second layer but does not directly provide logging of key access. Option D is incorrect because SSE with platform-managed keys does not give customer control or logging.

Answer

Enable infrastructure encryption on the storage account.

Answer

Enable double encryption using both platform-managed and customer-managed keys.

Answer

Use Azure Storage Service Encryption (SSE) with platform-managed keys.

Question 9

You need to monitor the performance of Azure Synapse Analytics dedicated SQL pool queries. Which Azure service should you use to identify long-running queries and resource bottlenecks?

Accepted Answer

Azure Synapse Studio monitoring hub and dynamic management views (DMVs).. Azure Synapse Studio monitoring hub provides a centralized view of dedicated SQL pool activity, including running and completed queries, and dynamic management views (DMVs) can be queried to identify long-running queries and resource bottlenecks. Option A is wrong because Microsoft Purview Data Map is a data governance and cataloging service, not a performance monitoring tool. Option C is wrong because Azure Log Analytics queries can be used for historical analysis but require configuration and are not the primary tool for real-time live query monitoring in Synapse dedicated SQL pools. Option D is wrong because Azure Monitor Workbooks provide customizable dashboards for various Azure services, but they are not specifically designed for direct query monitoring in Synapse SQL pools.

Answer

Microsoft Purview Data Map.

Answer

Azure Log Analytics queries.

Answer

Azure Monitor Workbooks.

Question 10

You have an Azure Databricks workspace that processes sensitive data. The security team requires that all access to the workspace be authenticated using Microsoft Entra ID and that all API calls be audited. Which configuration should you implement?

Accepted Answer

Configure workspace to use Microsoft Entra ID authentication and enable diagnostic settings for audit logs.. It directly addresses both requirements: Microsoft Entra ID authentication ensures all access is authenticated via Entra ID, and enabling diagnostic settings captures audit logs for all API calls. Option B (VNet injection) provides network isolation, not authentication or auditing. Option C (Private Link) ensures private connectivity, not authentication or auditing. Option D (personal access tokens) bypasses Entra ID, and cluster logs do not capture API audit trails.

Answer

Enable VNet injection and configure network security groups.

Answer

Deploy Azure Private Link and disable public access.

Answer

Configure personal access tokens for API access and enable cluster logs.

Question 11

Your organization uses Azure Data Factory to orchestrate data pipelines. You need to ensure that sensitive data is not exposed in pipeline logs. What should you configure?

Accepted Answer

Enable 'Secure output' on pipeline activities.. Enabling 'Secure output' on pipeline activities prevents sensitive data from being written to Azure Data Factory logs. Option A is incorrect because while storing connection strings in Azure Key Vault is a security best practice, it does not prevent sensitive data from appearing in pipeline logs. Option C is incorrect because setting a retention policy for logs controls how long logs are kept, but does not prevent sensitive data exposure. Option D is incorrect because data flow debug logs are for debugging and do not mask sensitive data in pipeline logs.

Answer

Store connection strings in Azure Key Vault.

Answer

Set a retention policy for pipeline logs.

Answer

Use data flow debug logs with session logs.

Question 12

You are designing a data lake architecture using Azure Data Lake Storage Gen2. You need to implement a least-privilege security model. Which authorization mechanism should you use for granular control?

Accepted Answer

Use POSIX-like access control lists (ACLs).. POSIX-like ACLs provide granular permissions at the file and directory level, enabling least-privilege access control. Option A is incorrect because storage account keys grant full access to the entire storage account, violating least privilege. Option B is incorrect because Azure RBAC roles at the storage account level offer coarse-grained control, not granular file/directory permissions. Option D is incorrect because shared access signatures with stored access policies provide time-limited access but lack the detailed ACL capabilities for individual files and directories.

Answer

Use storage account keys for access.

Answer

Use Azure RBAC roles at the storage account level.

Answer

Use shared access signatures (SAS) with stored access policies.

Question 13

Your Azure Synapse Analytics pipeline uses PolyBase to load data from Azure Blob Storage into a dedicated SQL pool. The load is slow and suffers from high latency. Which optimization should you apply first?

Accepted Answer

Use a round-robin distribution for the staging table.. Using a round-robin distribution for staging tables minimizes data movement during PolyBase loads, reducing latency. Option A is not the first optimization because splitting files can help parallelism but may not directly address high latency. Option C is not the first optimization because increasing DWU can improve performance but incurs additional cost and is not specific to the load process. Option D is incorrect because clustered columnstore indexes are beneficial for query performance, not for import speed.

Answer

Split the source files into smaller chunks.

Answer

Increase the DWU (Data Warehouse Units) of the SQL pool.

Answer

Create clustered columnstore indexes on the staging table.

Question 14

Which TWO actions should you take to secure data in Azure Synapse Analytics dedicated SQL pool? (Choose two.)

Accepted Answer

Apply dynamic data masking (DDM) to obfuscate sensitive data.. The correct answers are D and E. Dynamic data masking (DDM) obfuscates sensitive data, and row-level security (RLS) restricts data access at the row level. Option A is incorrect because PolyBase is used for data loading, not security. Option B is incorrect because result-set caching improves performance but does not secure data. Option C is incorrect because workload classification governs resource allocation, not security.

Answer

Use PolyBase to load data from external sources.

Answer

Enable result-set caching for query performance.

Answer

Configure workload classification for resource governance.

Question 15

Which THREE features should you use to optimize query performance in Azure Synapse Analytics dedicated SQL pool? (Choose three.)

Accepted Answer

Materialized views.. Options C, D, and E are correct. Materialized views precompute and store aggregated data, reducing compute for complex queries. Workload management with workload groups and importance allocates resources and prioritizes critical queries. Result-set caching stores the results of repeated queries, eliminating recomputation. Option A (T-SQL views) is a logical abstraction and does not inherently optimize performance. Option B (geo-redundant storage) provides disaster recovery but does not affect query performance.

Answer

T-SQL views.

Answer

Geo-redundant storage (GRS).