DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 14 — 15 Questions

Question 1

You have an Azure Synapse Analytics serverless SQL pool. You need to monitor the number of queries that are currently executing. Which dynamic management view should you query?

Accepted Answer

sys.dm_exec_requests. Sys.dm_exec_returns detailed information about each request currently executing on the serverless SQL pool, including its state, command, and session ID. This DMV is specifically designed for monitoring active queries.

Option A (sys.dm_resource_governor_workload_groups) shows workload group configuration and resource statistics, not current requests.

Option B (sys.dm_exec_query_stats) provides cumulative performance statistics for cached query plans, not currently executing queries.

Option D (sys.dm_exec_sessions) contains session-level information but does not indicate which sessions are actively executing a request.

Answer

sys.dm_resource_governor_workload_groups

Answer

sys.dm_exec_query_stats

Answer

sys.dm_exec_sessions

Question 2

Your team is using Azure Synapse Analytics to process sensitive customer data. You need to ensure that column-level security is applied to a specific table so that only users with a certain role can view certain columns. Which feature should you use?

Accepted Answer

Column-level security (CLS). Column-level security (CLS) in Azure Synapse Analytics allows you to restrict access to specific columns in a table based on the user's role or permissions. It is implemented using GRANT and DENY statements on individual columns, ensuring that only authorized users can view sensitive columns. This directly addresses the requirement to apply column-level security to a specific table.

Answer

Row-level security (RLS)

Answer

Azure Purview data policies

Answer

Dynamic data masking (DDM)

Question 3

Your company uses Azure Blob Storage to store backups. You need to ensure that data is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys. Azure Storage Service Encryption (SSE) encrypts data at rest and supports customer-managed keys stored in Azure Key Vault. Option A is incorrect because Azure Purview is a data governance service, not for encryption. Option B is incorrect because Azure Disk Encryption is used for virtual machine disks, not Blob Storage. Option D is incorrect because Azure Information Protection is for classification and labeling. Therefore, option C is correct.

Answer

Azure Purview

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Question 4

Your organization uses Azure Data Lake Storage Gen2 for a data lake. You need to prevent accidental deletion of data by enabling a soft delete policy. Which configuration is required?

Accepted Answer

Enable blob soft delete on the storage account.. Azure Data Lake Storage Gen2 supports blob soft delete, which protects against accidental deletion by retaining deleted blobs for a specified retention period. Option A is incorrect because Azure Resource Manager locks prevent the deletion or modification of the storage account itself, not the data within it. Option B is incorrect because Azure Backup is designed for backing up VMs, SQL databases, and other workloads, not for managing soft delete of blobs. Option C is incorrect because blob versioning preserves previous versions of blobs, but it does not prevent deletion of the current version; soft delete is specifically for recovery from accidental deletion.

Answer

Apply an Azure Resource Manager lock.

Answer

Configure Azure Backup for the storage account.

Answer

Enable blob versioning.

Question 5

You are responsible for securing an Azure Synapse Analytics workspace. You need to ensure that only authorized users can query the serverless SQL pool. Which authentication method should you use?

Accepted Answer

Microsoft Entra ID authentication. Microsoft Entra ID authentication (formerly Azure AD) is the recommended authentication method for serverless SQL pools in Azure Synapse Analytics. It provides centralized identity management, supports conditional access policies, and allows individual user identities to be used for auditing and access control. Option B (managed identity) is designed for service-to-service authentication (e.g., Azure services), not for interactive user queries. Option C (SQL authentication) is less secure as it relies on static credentials, and Microsoft recommends against it for production workloads. Option D (Azure Key Vault) is a secret store, not an authentication method.

Answer

Managed identity authentication

Answer

SQL authentication

Answer

Azure Key Vault authentication

Question 6

Which THREE security features are available in Azure Data Lake Storage Gen2 to protect data at rest and in transit? (Choose three.)

Accepted Answer

Azure Storage firewalls and virtual network rules. Option A (Azure Storage firewalls and virtual network rules) is correct because ADLS Gen2, built on Azure Storage, lets you restrict network access to the storage account by configuring firewall rules and allowing specific virtual networks and subnets, thereby protecting data at rest from unauthorized network access. Option C (Encryption at rest using Storage Service Encryption, SSE) is correct because Azure Storage automatically encrypts data at rest using 256-bit AES encryption, and this applies to ADLS Gen2 accounts, protecting data at rest. Option D (HTTPS for data in transit) is correct because ADLS Gen2 supports secure transfer over HTTPS/TLS, ensuring data is encrypted in transit between clients and the storage service. Option B (Azure Information Protection) is not a native ADLS Gen2 data-at-rest or in-transit protection feature; it is a separate classification and labeling service for documents and emails. Option E (Azure Policy) is a governance and compliance tool for enforcing organizational rules, not a direct data-at-rest or in-transit encryption/network protection feature of ADLS Gen2.

Answer

Azure Information Protection

Answer

Azure Policy

Question 7

Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only users with specific Microsoft Entra ID roles can query the data. What should you configure?

Accepted Answer

Assign the Storage Blob Data Contributor role to the users on the Azure Data Lake Storage Gen2 account.. Azure Synapse Analytics serverless SQL pools rely on Microsoft Entra ID tokens and RBAC roles to authorize access to data in Azure Data Lake Storage Gen2. The Storage Blob Data Contributor role grants read and write access to data. Option B is wrong because SAS tokens are shared secrets, not tied to user identity. Option C is wrong because firewall rules control network access, not user-level authorization. Option D is wrong because managed identity is not suitable for per-user authorization.

Answer

Generate a shared access signature (SAS) token for the storage account and include it in the external table definition.

Answer

Configure an IP firewall rule on the storage account to allow only the SQL pool's outbound IP addresses.

Answer

Create a managed identity for the SQL pool and grant it access to the storage account.

Question 8

Your team uses Azure Databricks for data processing. You need to implement a cost-control strategy that automatically terminates idle clusters after 30 minutes of inactivity, but allows users to override this policy for specific workloads that require long-running clusters. What is the most efficient approach?

Accepted Answer

Create a cluster policy that enforces auto-termination with a default of 30 minutes, but allows users to override the value for specific clusters.. Azure Databricks cluster policies let administrators define constraints and defaults for cluster configuration, including auto-termination. A cluster policy can set a default auto-termination of 30 minutes while allowing users to override the value (within policy-permitted bounds) for specific long-running workloads. This centralizes governance without blocking legitimate exceptions.

Answer

Instruct all users to set auto-termination to 30 minutes on each cluster they create.

Answer

Configure a global auto-termination setting in the Azure Databricks workspace that terminates all clusters after 30 minutes of inactivity.

Answer

Use Azure Policy to enforce a tag that triggers a function to terminate idle clusters.

Question 9

Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to implement a monitoring strategy to detect and alert on unusual access patterns that could indicate a security breach. Which THREE services or features should you use? (Choose three.)

Accepted Answer

Enable Microsoft Defender for Storage to get security alerts about unusual access patterns.. Option A is correct because Microsoft Defender for Storage analyzes data-plane telemetry on the storage account and raises security alerts for suspicious activity such as unusual access patterns, anomalous data exfiltration, or access from unusual locations, which directly addresses breach detection. Option C is correct because Microsoft Sentinel can ingest storage logs and use analytics rules (including built-in anomaly and threat-detection templates) to correlate events and alert on anomalous access patterns across the environment. Option D is correct because enabling diagnostic settings on the storage account is the prerequisite that exports read, write, and delete data-plane logs (the StorageRead/StorageWrite/StorageDelete categories) to a Log Analytics workspace, Event Hub, or storage account, providing the raw telemetry that Sentinel and Defender for Storage rely on for anomaly detection. Option B does not belong because Azure Policy enforces configuration and compliance (for example, requiring encryption or HTTPS), but it does not detect or alert on unusual access patterns. Option E does not belong because Azure Monitor Metrics provides aggregate numeric time-series data such as transaction counts, latency, and availability, not per-request access detail needed to identify anomalous access patterns.

Answer

Apply Azure Policy to enforce encryption and access policies.

Answer

Use Azure Monitor Metrics to track storage account transactions and latency.

Question 10

You have an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline is failing with a 'Gateway is offline' error. What is the most likely cause?

Accepted Answer

The Self-Hosted Integration Runtime is not running or cannot connect to the Azure Data Factory service.. The Self-Hosted Integration Runtime (SHIR) acts as the gateway between on-premises data sources and Azure Data Factory. If the SHIR is not running or cannot communicate with the Azure Data Factory service, the pipeline fails with a 'Gateway is offline' error. Option A is incorrect because using the Azure Integration Runtime for an on-premises source would cause a different error, not 'Gateway is offline'. Option B is incorrect because region configuration for the Azure Integration Runtime is irrelevant when a SHIR is required. Option C is incorrect because the error relates to the gateway, not to SQL Server remote connection settings.

Answer

The Azure Integration Runtime is being used instead of a Self-Hosted Integration Runtime.

Answer

The Azure Integration Runtime is not configured to use the correct region.

Answer

The source SQL Server is not configured to allow remote connections from Azure.

Question 11

Your organization uses Azure Purview for data governance. You need to ensure that sensitive data is properly classified and that access to it is monitored. Which THREE actions should you take? (Choose three.)

Accepted Answer

Create custom sensitivity labels in Microsoft Purview Information Protection and apply them to data sources.. Option C is correct because Microsoft Purview Information Protection sensitivity labels (created in the compliance portal) are the mechanism for tagging data with sensitivity classifications, and Purview can extend these labels to data sources such as Azure SQL, Storage, and Synapse for consistent classification. Option D is correct because integrating Azure Purview with Microsoft Defender for Cloud Apps enables monitoring of user access and activities on sensitive data that Purview has classified, providing anomaly detection and governance over access. Option E is correct because Azure Purview's automated scanning uses built-in and custom classification rules to discover and classify sensitive data (for example, credit card or national ID patterns) across registered sources, which is the core way to ensure data is properly classified. Option A is not correct because Azure Policy initiatives enforce configuration and compliance states on resources; they do not perform data classification of the contents within storage accounts. Option B is not correct because Azure Sentinel is a SIEM/SOAR solution for security analytics and threat detection, not a data classification engine for ingested data.

Answer

Define Azure Policy initiatives to enforce classification on all storage accounts.

Answer

Use Azure Sentinel to classify data as it is ingested.

Question 12

You use Azure Data Lake Storage Gen2 with a hierarchical namespace. You need to delegate permissions to a group of data scientists so they can create folders and upload files only within a specific directory path. What is the best way to achieve this?

Accepted Answer

Set ACL entries on the specific directory path granting read, write, and execute permissions to the users.. Azure Data Lake Storage Gen2 with hierarchical namespace supports POSIX-like ACLs at the directory and file level. To delegate permissions to a group of data scientists so they can create folders and upload files only within a specific directory path, you set ACL entries on that directory granting the necessary permissions (read, write, execute) to the group. This allows granular access control without granting broader permissions at the storage account level.

Answer

Use a stored access policy to grant permissions to the directory.

Answer

Generate a shared access signature (SAS) with permissions scoped to the specific directory.

Answer

Assign the Storage Blob Data Contributor role to the users at the storage account level.

Question 13

You need to ensure that data in an Azure Data Lake Storage Gen2 account is encrypted at rest using a customer-managed key. Which feature should you configure?

Accepted Answer

Azure Key Vault integration with Storage Service Encryption. Customer-managed keys (CMK) for Azure Storage are implemented by integrating the storage account with Azure Key Vault (or Managed HSM) and configuring the account's encryption key to reference a key stored there. Storage Service Encryption (SSE) then uses that key to wrap the account's data encryption key, giving the customer control over key lifecycle and revocation.

Answer

Azure Information Protection

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Disk Encryption

Question 14

An organization is using Azure Data Factory to ingest data from multiple on-premises SQL Server databases into Azure Synapse Analytics. They need to ensure that sensitive data is masked during ingestion before landing in the staging area. What is the best approach?

Accepted Answer

Use a Mapping Data Flow with derived column transformations to mask sensitive columns.. A Mapping Data Flow in Azure Data Factory can apply derived column transformations to mask sensitive fields (for example, using SHA2 hashing, substring, or fixed replacement) as data flows from source to sink. Because the masking occurs in the pipeline before data lands in the staging area, this satisfies the requirement to mask during ingestion.

Answer

Apply an Azure Policy that masks sensitive data in Azure Synapse Analytics.

Answer

Use Azure SQL Database dynamic data masking on the source databases.

Answer

Use Azure Purview to classify and mask sensitive data automatically.

Question 15

A company uses Azure Databricks for data processing. They want to monitor the performance of Spark jobs and set up alerts for job failures. Which Azure service should they use?

Accepted Answer

Azure Monitor. Azure Monitor is the central service for collecting metrics and logs from Azure Databricks, enabling performance monitoring and alerting on Spark jobs. Option A is incorrect because Azure Advisor provides recommendations but not real-time monitoring or alerts. Option B is incorrect because Azure Sentinel is a SIEM solution for security incidents, not for job performance monitoring. Option C is incorrect because Azure Log Analytics is a component of Azure Monitor used for log analysis, but the overarching service for monitoring and alerts is Azure Monitor.

Answer

Azure Advisor

Answer

Azure Sentinel

Answer

Azure Log Analytics