DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 11 — 15 Questions

Question 1

You have an Azure Databricks workspace that processes sensitive data. The security team requires that all access to the workspace be authenticated using Microsoft Entra ID and that all API calls be audited. Which configuration should you implement?

Accepted Answer

Configure workspace to use Microsoft Entra ID authentication and enable diagnostic settings for audit logs.. Option C is correct because Microsoft Entra ID authentication is required, and diagnostic settings audit API calls. Option A is wrong because VNet injection is for network isolation, not authentication or auditing. Option B is wrong because personal access tokens bypass Entra ID. Option D is wrong because Azure Private Link is for private connectivity.

Answer

Enable VNet injection and configure network security groups.

Answer

Deploy Azure Private Link and disable public access.

Answer

Configure personal access tokens for API access and enable cluster logs.

Question 2

You are optimizing an Azure Synapse Analytics dedicated SQL pool. The pool experiences high concurrency and frequent data skew. Which indexing strategy should you recommend to improve query performance for large fact tables?

Accepted Answer

Use hash-distributed tables with round-robin distribution and clustered columnstore indexes.. Option B is correct because hash-distributed round-robin tables distribute data evenly, reducing skew. Option A is wrong because hash-distributed clustered columnstore may still have skew if the distribution column is poorly chosen. Option C is wrong because replicated tables are for small dimension tables. Option D is wrong because heap tables are for staging, not optimized for large fact tables.

Answer

Use hash-distributed tables with clustered columnstore indexes.

Answer

Use replicated tables with clustered indexes.

Answer

Use heap tables with non-clustered indexes.

Question 3

Your organization uses Azure Data Factory to orchestrate data pipelines. You need to ensure that sensitive data is not exposed in pipeline logs. What should you configure?

Accepted Answer

Enable 'Secure output' on pipeline activities.. Option A is correct because enabling secure output prevents sensitive data from being written to logs. Option B is wrong because data flow debug logs are for debugging, not for masking. Option C is wrong because Azure Key Vault stores secrets but does not mask pipeline logs. Option D is wrong because setting a TTL does not prevent sensitive data exposure.

Answer

Store connection strings in Azure Key Vault.

Answer

Set a retention policy for pipeline logs.

Answer

Use data flow debug logs with session logs.

Question 4

You are designing a data lake architecture using Azure Data Lake Storage Gen2. You need to implement a least-privilege security model. Which authorization mechanism should you use for granular control?

Accepted Answer

Use POSIX-like access control lists (ACLs).. Option D is correct because ACLs provide granular permissions at the file and directory level. Option A is wrong because Azure RBAC is at the subscription/resource group level, not granular. Option B is wrong because shared keys provide full access. Option C is wrong because SAS tokens with stored access policies provide limited granularity but are not as flexible as ACLs.

Answer

Use storage account keys for access.

Answer

Use Azure RBAC roles at the storage account level.

Answer

Use shared access signatures (SAS) with stored access policies.

Question 5

Your Azure Synapse Analytics pipeline uses PolyBase to load data from Azure Blob Storage into a dedicated SQL pool. The load is slow and suffers from high latency. Which optimization should you apply first?

Accepted Answer

Use a round-robin distribution for the staging table.. Option C is correct because using a round-robin distribution for staging tables avoids data movement during load. Option A is wrong because increasing DWU may help but is not the first optimization. Option B is wrong because file splitting can improve parallelism but may not address latency. Option D is wrong because columnstore indexes are for read performance, not load speed.

Answer

Split the source files into smaller chunks.

Answer

Increase the DWU (Data Warehouse Units) of the SQL pool.

Answer

Create clustered columnstore indexes on the staging table.

Question 6

You need to monitor the health of your Azure Data Lake Storage Gen2 account. Which metric should you use to track the number of successful and failed requests?

Accepted Answer

Transactions.. Option A is correct because Transactions metric tracks all requests. Option B is wrong because Ingress is about data incoming, not request count. Option C is wrong because SuccE2ELatency measures latency, not count. Option D is wrong because Blob Capacity measures storage size.

Answer

Success E2E Latency.

Answer

Blob Capacity.

Answer

Ingress.

Question 7

Which TWO actions should you take to secure data in Azure Synapse Analytics dedicated SQL pool? (Choose two.)

Accepted Answer

Apply dynamic data masking (DDM) to obfuscate sensitive data.. Options A and D are correct. Row-level security restricts data access, and dynamic data masking obfuscates sensitive data. Option B is wrong because PolyBase is for data movement, not security. Option C is wrong because workload management is for performance, not security. Option E is wrong because result-set caching is for performance.

Answer

Use PolyBase to load data from external sources.

Answer

Enable result-set caching for query performance.

Answer

Configure workload classification for resource governance.

Question 8

Which THREE features should you use to optimize query performance in Azure Synapse Analytics dedicated SQL pool? (Choose three.)

Accepted Answer

Materialized views.. Options A, C, and E are correct. Materialized views improve performance for aggregations, result-set caching speeds up repeated queries, and workload management ensures resource isolation. Option B is wrong because T-SQL views are logical, not performance optimization. Option D is wrong because geo-redundant storage is for disaster recovery, not performance.

Answer

T-SQL views.

Answer

Geo-redundant storage (GRS).

Question 9

Which TWO Azure services can be used to audit data access and changes in Azure Data Lake Storage Gen2? (Choose two.)

Accepted Answer

Storage account diagnostic settings.. Options B and C are correct. Diagnostic settings in storage accounts capture logs, and Azure Monitor integrates with Microsoft Sentinel for security monitoring. Option A is wrong because Azure Policy is for compliance, not auditing data access. Option D is wrong because Microsoft Entra ID is for identity, not logging. Option E is wrong because Azure Backup is for data protection, not auditing.

Answer

Microsoft Entra ID sign-in logs.

Answer

Azure Backup reports.

Answer

Azure Policy.

Question 10

You are designing a data lake in Azure Data Lake Storage Gen2 for a large enterprise. You need to ensure that only authorized users can access the data, and you must implement the principle of least privilege. Which security mechanism should you use to grant fine-grained access to specific directories and files without modifying the underlying storage account firewall settings?

Accepted Answer

Azure RBAC roles combined with POSIX-like ACLs. Option D is correct because Azure RBAC with ACLs allows fine-grained permissions at the directory and file level. Option A is wrong because SAS tokens grant time-limited access but are not fine-grained. Option B is wrong because managed identities provide identity-based access but still require RBAC or ACLs for fine-grained control. Option C is wrong because firewall rules apply at the account level, not directory/file level.

Answer

Managed identities for Azure resources

Answer

Storage account firewall rules

Answer

Shared access signatures (SAS)

Question 11

Your Azure Synapse Analytics dedicated SQL pool is experiencing performance degradation. You suspect that the workload is generating excessive data movement due to suboptimal distribution. Which dynamic management view (DMV) should you query to identify queries that are causing significant data movement?

Accepted Answer

sys.dm_pdw_exec_requests. Option B is correct because sys.dm_pdw_exec_requests shows query steps including data movement operations. Option A is wrong because sys.dm_pdw_node_status shows node health. Option C is wrong because sys.dm_pdw_errors shows error details. Option D is wrong because sys.dm_pdw_waits shows wait states.

Answer

sys.dm_pdw_node_status

Answer

sys.dm_pdw_errors

Answer

sys.dm_pdw_waits

Question 12

You need to monitor the performance of an Azure Stream Analytics job in real time. Which Azure service should you use to track the job's resource utilization (e.g., SU % utilization) and set up alerts when the job is approaching its capacity?

Accepted Answer

Azure Monitor. Option C is correct because Azure Monitor provides metrics and alerts for Stream Analytics jobs. Option A is wrong because Azure Log Analytics ingests logs but is not primarily for real-time metric alerts. Option B is wrong because Microsoft Sentinel is a SIEM. Option D is wrong because Azure Advisor provides recommendations but not real-time monitoring and alerts for resource utilization.

Answer

Azure Advisor

Answer

Microsoft Sentinel

Answer

Azure Log Analytics

Question 13

Refer to the exhibit. You have created the custom RBAC role shown and assigned it to a security group. Members of the group report that they can read blobs in the storage account but cannot list the contents of the container. What is the most likely reason for this issue?

Accepted Answer

The role does not include the permission to list blobs in a container.. Option A is correct because the role lacks the 'list' action on containers. The 'read' action on containers only allows reading container properties and metadata, not listing blobs. Option B is wrong because the 'read' data action on blobs is included. Option C is wrong because the scope is correct for the storage account. Option D is wrong because custom roles can be used for ADLS Gen2.

Answer

Custom roles are not supported for Azure Data Lake Storage Gen2.

Answer

The role is scoped to the storage account but not to the container.

Answer

The role lacks the 'read' data action for blobs.

Question 14

You have an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline runs successfully but you notice that the data transfer is taking longer than expected. You need to improve the transfer performance without increasing the cost significantly. Which configuration change should you make?

Accepted Answer

Enable staged copy with an Azure Blob Storage staging location.. Option C is correct because enabling staged copy with staging storage can improve performance by allowing parallel uploads and retries. Option A is wrong because increasing DIUs may increase cost. Option B is wrong because increasing the number of concurrent connections on SQL Server might not be the bottleneck. Option D is wrong because using PolyBase is for loading into Azure Synapse or SQL DW, not Blob Storage.

Answer

Use PolyBase to load the data into Blob Storage.

Answer

Increase the number of concurrent connections on the SQL Server.

Answer

Increase the Data Integration Units (DIU) for the copy activity.

Question 15

You need to ensure that sensitive data stored in Azure SQL Database is encrypted at rest. Which feature should you enable?

Accepted Answer

Transparent Data Encryption (TDE). Option C is correct because Transparent Data Encryption (TDE) encrypts data at rest. Option A is wrong because Always Encrypted encrypts data in use and in transit, not at rest. Option B is wrong because Dynamic Data Masking masks data in query results. Option D is wrong because Azure Information Protection is a classification and labeling service.

Answer

Always Encrypted

Answer

Azure Information Protection

Answer

Dynamic Data Masking