DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 12 — 15 Questions

Question 1

Which TWO Azure services can be used to audit data access and changes in Azure Data Lake Storage Gen2? (Choose two.)

Accepted Answer

Storage account diagnostic settings.. Options C and D are correct. Storage account diagnostic settings enable logging of read, write, and delete operations to Azure Data Lake Storage Gen2, which can be used for auditing. Azure Monitor collects these logs and integrates with Microsoft Sentinel for advanced security monitoring and threat detection. Option A is incorrect because Microsoft Entra ID sign-in logs track user authentication, not data access at the storage level. Option B is incorrect because Azure Backup reports focus on backup status, not auditing data changes. Option E is incorrect because Azure Policy enforces compliance rules but does not audit data access or modification events.

Answer

Microsoft Entra ID sign-in logs.

Answer

Azure Backup reports.

Answer

Azure Policy.

Question 2

You are designing a data lake in Azure Data Lake Storage Gen2 for a large enterprise. You need to ensure that only authorized users can access the data, and you must implement the principle of least privilege. Which security mechanism should you use to grant fine-grained access to specific directories and files without modifying the underlying storage account firewall settings?

Accepted Answer

Azure RBAC roles combined with POSIX-like ACLs. Azure RBAC combined with POSIX-like ACLs allows fine-grained permissions at the directory and file level, supporting the principle of least privilege without modifying firewall settings. Option D is incorrect because shared access signatures (SAS) grant time-limited access but are not fine-grained at the directory/file level and can be complex to manage. Option B is incorrect because managed identities provide identity-based access but still require RBAC or ACLs for fine-grained control. Option C is incorrect because storage account firewall rules apply at the account level, not at the directory or file level.

Answer

Managed identities for Azure resources

Answer

Storage account firewall rules

Answer

Shared access signatures (SAS)

Question 3

Your Azure Synapse Analytics dedicated SQL pool is experiencing performance degradation. You suspect that the workload is generating excessive data movement due to suboptimal distribution. Which dynamic management view (DMV) should you query to identify queries that are causing significant data movement?

Accepted Answer

sys.dm_pdw_exec_requests. Sys.dm_pdw_exec_requests shows query steps including data movement operations. Option A is wrong because sys.dm_pdw_node_status shows node health. Option C is wrong because sys.dm_pdw_errors shows error details. Option D is wrong because sys.dm_pdw_waits shows wait states.

Answer

sys.dm_pdw_node_status

Answer

sys.dm_pdw_errors

Answer

sys.dm_pdw_waits

Question 4

You need to monitor the performance of an Azure Stream Analytics job in real time. Which Azure service should you use to track the job's resource utilization (e.g., SU % utilization) and set up alerts when the job is approaching its capacity?

Accepted Answer

Azure Monitor. Azure Monitor provides real-time metrics such as SU % utilization for Azure Stream Analytics jobs and allows you to set up alerts based on these metrics. Option B is incorrect because Azure Advisor offers best practice recommendations, not real-time monitoring and alerts. Option C is incorrect because Microsoft Sentinel is a SIEM tool for security analytics. Option D is incorrect because Azure Log Analytics is used for log analysis, not primarily for real-time metric alerts on resource utilization.

Answer

Azure Advisor

Answer

Microsoft Sentinel

Answer

Azure Log Analytics

Question 5

Refer to the exhibit. You have created the custom RBAC role shown and assigned it to a security group. Members of the group report that they can read blobs in the storage account but cannot list the contents of the container. What is the most likely reason for this issue?

Accepted Answer

The role does not include the permission to list blobs in a container.. The custom RBAC role includes the 'read' data action for blobs, which allows reading blob data, but it does not include the 'list' action for blobs. Without the 'list' permission, users cannot list the blobs within a container. In Azure RBAC for storage, the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' action permits reading blob content and properties, but listing blobs requires the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list' action (or equivalent at the container level). Therefore, the role lacks the necessary permission to list blobs.

Option A is incorrect because custom RBAC roles are fully supported for Azure Data Lake Storage Gen2. Option B is incorrect because the scope of the role at the storage account level does not prevent listing blobs; the issue is missing data actions. Option D is incorrect because the role already includes the 'read' data action for blobs; the missing action is 'list'.

Answer

Custom roles are not supported for Azure Data Lake Storage Gen2.

Answer

The role is scoped to the storage account but not to the container.

Answer

The role lacks the 'read' data action for blobs.

Question 6

You have an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline runs successfully but you notice that the data transfer is taking longer than expected. You need to improve the transfer performance without increasing the cost significantly. Which configuration change should you make?

Accepted Answer

Enable staged copy with an Azure Blob Storage staging location.. Enabling staged copy with an Azure Blob Storage staging location improves performance by allowing parallel uploads and retries. Option B is wrong because PolyBase is used for loading data into Azure Synapse Analytics or SQL Data Warehouse, not Blob Storage. Option C is wrong because increasing concurrent connections on SQL Server may not address the bottleneck and could impact source performance. Option D is wrong because increasing Data Integration Units (DIU) would increase cost without necessarily improving performance if the bottleneck is elsewhere (e.g., network or source).

Answer

Use PolyBase to load the data into Blob Storage.

Answer

Increase the number of concurrent connections on the SQL Server.

Answer

Increase the Data Integration Units (DIU) for the copy activity.

Question 7

You need to ensure that sensitive data stored in Azure SQL Database is encrypted at rest. Which feature should you enable?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) is correct because it encrypts the entire database at rest, including backups and log files. Option A (Always Encrypted) is incorrect because it encrypts data in use and in transit (client-side encryption), not at rest. Option B (Azure Information Protection) is incorrect because it is a classification and labeling service, not an encryption mechanism. Option C (Dynamic Data Masking) is incorrect because it masks data in query results to unauthorized users, but does not encrypt the underlying data.

Answer

Always Encrypted

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Question 8

You are optimizing a batch processing job in Azure Databricks that reads data from Azure Data Lake Storage Gen2 and writes aggregated results back. The job currently runs slowly due to high shuffle writes. You plan to use Delta Lake and optimize the table layout. Which two actions should you take to reduce shuffle writes? (Select two.)

Accepted Answer

Partition the Delta table by the most frequently used filter column.. To reduce shuffle writes in a Databricks batch job using Delta Lake, you should partition the Delta table by the most frequently used filter column (B) and use the OPTIMIZE command with Z-Ordering on join keys (E). Partitioning limits data shuffling by filtering out irrelevant partitions, and Z-Ordering colocates related data, reducing shuffle size during joins. Option A (auto-optimize) helps compaction but does not directly reduce shuffle writes. Option C (broadcast hash join) only helps if one table is small, not for large tables. Option D (increasing shuffle partitions) often increases shuffle writes due to more tasks.

Answer

Enable Delta Lake auto-optimize to coalesce small files.

Answer

Use a broadcast hash join hint for all joins.

Answer

Increase the number of shuffle partitions to 400.

Question 9

Your team uses Azure Synapse Analytics serverless SQL pool to query data in Azure Data Lake Storage Gen2. You notice that queries are running slower than expected. You need to improve query performance by reducing the amount of data scanned. Which two features should you implement? (Select two.)

Accepted Answer

Partition the data in the data lake and use partition elimination in queries.. Options A and E are correct. Partition elimination (A) reduces data scanned by skipping irrelevant partitions. File pruning (E) reduces data scanned by reading only specified files via OPENROWSET. Option B is wrong because result-set caching caches query results but does not reduce the amount of data scanned on the first execution. Option C is wrong because auto-optimize is a feature for Delta Lake tables and is not applicable to serverless SQL pool queries. Option D is wrong because materialized views are not supported in serverless SQL pool, and even if they were, they would not reduce the data scanned by the original query.

Answer

Enable result-set caching for the serverless SQL pool.

Answer

Enable auto-optimize on the Delta Lake tables.

Answer

Create materialized views on the serverless SQL pool.

Question 10

You have an Azure Data Lake Storage Gen2 account that stores log files. You need to implement a data retention policy so that logs older than 90 days are automatically deleted. What should you use?

Accepted Answer

Lifecycle management policy. A lifecycle management policy can automatically delete blobs based on age. Option A is wrong because Azure Policy enforces compliance but does not delete. Option C is wrong because Azure Blob Storage inventory provides reports but does not delete. Option D is wrong because Azure Purview scopes metadata and data discovery, not lifecycle management.

Answer

Azure Policy

Answer

Azure Blob Storage inventory

Answer

Microsoft Purview

Question 11

You are monitoring an Azure Synapse Analytics dedicated SQL pool and notice that some queries are experiencing high wait times due to concurrency slots being exhausted. You need to optimize the workload to reduce contention. Which three actions should you take? (Select three.)

Accepted Answer

Create workload groups with different importance levels.. Options B, C, and D are correct. Workload groups with different importance levels allow you to prioritize critical queries, reducing contention. Workload isolation limits resources for a group, preventing resource-intensive queries from blocking others. Workload classification routes queries to appropriate groups based on criteria. Option A is incorrect because increasing DWU increases concurrency slots but may raise costs. Option E is incorrect because result-set caching does not affect concurrency slot usage.

Answer

Increase the data warehouse service level (DWU).

Answer

Enable result-set caching for frequently executed queries.

Question 12

Refer to the exhibit. You deploy the ARM template to create a storage account. After deployment, a developer reports that they cannot access the storage account from an Azure Databricks notebook running in the same virtual network as specified in the subnet rule. What is the most likely reason?

Accepted Answer

The Databricks cluster is not using a managed virtual network with a service endpoint to the storage account.. The storage account firewall is configured with a default deny and a subnet rule allowing traffic from a specific virtual network subnet. For an Azure Databricks notebook to access the storage account, the Databricks workspace must be deployed with a managed virtual network and the cluster must use that same subnet with a service endpoint to the storage account. If the Databricks cluster is not using a managed virtual network or the subnet is not correctly configured, the traffic will be blocked. Option A is incorrect because customer-managed keys from Key Vault do not block access; they are for encryption. Option B is incorrect because the firewall's default deny is expected, but the subnet rule should allow traffic from the Databricks VNet, not the cluster's public IP (Databricks clusters in a managed VNet use private IPs). Option D is incorrect because hierarchical namespace (ADLS Gen2) does not block access; it enables it.

Answer

The storage account uses customer-managed keys from Key Vault, which requires additional permissions.

Answer

The firewall default action is Deny, and there are no IP rules allowing the Databricks cluster's public IP.

Answer

The storage account has hierarchical namespace enabled, which blocks non-ADLS Gen2 tools.

Question 13

You need to monitor an Azure Data Factory pipeline for failures and send an email notification when a pipeline run fails. Which Azure service should you use to create an alert based on the pipeline run metrics?

Accepted Answer

Azure Monitor. Azure Monitor can create alerts based on ADF metrics like 'Failed pipeline runs'. Option A is wrong because Microsoft Sentinel is for security. Option C is wrong because Azure Service Health monitors Azure service health, not pipeline runs. Option D is wrong because Azure Log Analytics is for log queries, not alerting.

Answer

Microsoft Sentinel

Answer

Azure Service Health

Answer

Azure Log Analytics

Question 14

You have an Azure Synapse Analytics dedicated SQL pool that is used for reporting. You notice that the tempdb database is growing rapidly and causing queries to fail. Which two actions should you take to mitigate the issue? (Select two.)

Accepted Answer

Reduce the degree of parallelism (MAXDOP) for the workload.. Options C and E are correct. Reducing the degree of parallelism (MAXDOP) limits the number of concurrent operations, reducing tempdb usage. Optimizing queries that perform large sorts or hash joins reduces the demand on tempdb. Option A is incorrect because result-set caching does not affect tempdb usage. Option B is incorrect because increasing DWU may provide more tempdb space but does not address the root cause of excessive tempdb usage. Option D is incorrect because moving tempdb to a separate storage account is not supported in Azure Synapse Analytics.

Answer

Enable result-set caching to reduce query reruns.

Answer

Increase the service level (DWU) of the dedicated SQL pool.

Answer

Move tempdb to a separate storage account.

Question 15

Your organization uses Azure Purview for data governance. You need to automatically scan an Azure Data Lake Storage Gen2 account and classify sensitive data such as credit card numbers and social security numbers. What should you configure?

Accepted Answer

A new scan rule set in Purview with classification rules for sensitive data types. A new scan rule set in Purview with classification rules for sensitive data types. Purview allows you to create custom scan rule sets that include classification rules for sensitive data types like credit card numbers and social security numbers. When you run a scan on Azure Data Lake Storage Gen2, it uses these rules to automatically detect and classify the sensitive data. Option A is incorrect because Azure Information Protection (AIP) scanner is for classifying and protecting files in on-premises file shares and SharePoint, not for scanning Azure Data Lake Storage. Option B is incorrect because Microsoft Defender for Cloud is for security posture management and threat detection, not data classification. Option D is incorrect because Azure Policy with guest configuration is for auditing and enforcing compliance settings on virtual machines, not for data classification in storage.

Answer

Azure Information Protection (AIP) scanner

Answer

Microsoft Defender for Cloud

Answer

Azure Policy with built-in guest configuration