DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 15 — 15 Questions

Question 1

You are designing a data pipeline in Azure Data Factory that copies data from Azure Blob Storage to Azure SQL Database. The data contains personally identifiable information (PII). What should you use to protect the data during transit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encryption over HTTPS/TLS. Encryption over HTTPS/TLS protects data while it is moving between Azure Blob Storage and Azure SQL Database, which is exactly what 'in transit' means. Azure Data Factory uses the HTTPS endpoint of Blob Storage and TLS-encrypted connections to Azure SQL Database by default, so enforcing TLS 1.2+ ensures PII cannot be intercepted in cleartext. This is the only option that addresses the transport layer rather than data at rest or classification.

Answer

Azure Information Protection

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption

Question 2

Which TWO Azure services can be used to monitor data pipeline runs and set up alerts for failures in Azure Data Factory?

Accepted Answer

Azure Log Analytics. Options B and D are correct. Azure Monitor is the primary service for collecting Azure Data Factory metrics and logs and for configuring alerts. Azure Log Analytics is used to query those logs and create failure alerts. Option A is not a standalone Azure service; Azure Data Factory monitoring views are a built-in feature and do not independently provide alerting. Option C is a SIEM/SOAR security service, not for pipeline monitoring. Option E is for automation, not monitoring/alerting.

Answer

Azure Data Factory monitoring views

Answer

Azure Sentinel

Answer

Azure Automation

Question 3

Which THREE best practices should be followed when designing a data lake in Azure Data Lake Storage Gen2 for optimal performance?

Accepted Answer

Use Parquet file format for analytics workloads.. Option C is correct because columnar formats like Parquet compress data efficiently and let analytics engines such as Spark, Synapse, and Databricks read only the needed columns, dramatically reducing I/O and improving query performance. Option D is correct because ADLS Gen2 (and the underlying Blob REST/ABFS APIs) handles simple, predictable names more efficiently; special characters can break path parsing and high-cardinality names (e.g., GUIDs or timestamps in every filename) defeat caching, listing, and partition pruning. Option E is correct because partitioning data by date (e.g., year=/month=/day=) aligns with how engines like Spark, Hive, and Synapse perform partition elimination, so queries scanning a single day skip all other partitions instead of reading the whole dataset. Option A is wrong because enabling the hierarchical namespace is what makes ADLS Gen2 a true data lake with directory-level operations, atomic renames, and better performance for analytics; disabling it reverts to flat Blob storage semantics. Option B is wrong because deep, heavily nested directory trees increase metadata and listing overhead and slow down operations; a shallow, well-partitioned structure is preferred.

Answer

Disable hierarchical namespace to improve performance.

Answer

Use a deep directory structure with many subfolders.

Question 4

Refer to the exhibit. You are deploying an Azure Synapse Analytics workspace using an ARM template. The exhibit shows the encryption configuration. What is the effect of setting infrastructureEncryption to Enabled?

Accepted Answer

It adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys.. Enabling infrastructureEncryption adds a second layer of encryption at the infrastructure level, ensuring data is encrypted at rest with two different keys (double encryption). Option A is incorrect because enabling infrastructure encryption does not disable customer-managed key encryption; it adds an additional layer. Option B is incorrect because infrastructure encryption applies to data at rest, not in transit between nodes. Option C is incorrect because infrastructure encryption applies to the entire Azure Synapse Analytics workspace, not just SQL pools, and it is not transparent data encryption (TDE); it is a separate infrastructure-level encryption.

Answer

It disables encryption using the customer-managed key.

Answer

It enables encryption of data in transit between nodes.

Answer

It enables transparent data encryption for SQL pools.

Question 5

An organization is using Azure Synapse Analytics and wants to implement column-level security to restrict access to sensitive columns. Which feature should they use?

Accepted Answer

Column-level security using GRANT. Column-level security in Azure Synapse Analytics is implemented using GRANT statements on specific columns, restricting access to sensitive columns. Option A is incorrect because dynamic data masking obfuscates data at query time but does not prevent access. Option B is incorrect because Azure Purview is a data governance service, not for access control. Option D is incorrect because row-level security filters rows, not columns.

Answer

Dynamic data masking

Answer

Azure Purview

Answer

Row-level security

Question 6

A company uses Azure Stream Analytics to process real-time data from IoT devices. They need to ensure that the output to Azure Synapse Analytics is optimized for high throughput and low latency. What should they configure in the Stream Analytics job?

Accepted Answer

Partition the output by a key and use a columnstore index in the target table.. Partitioning the output by a key and using a columnstore index in the target Synapse table optimizes for high throughput and low latency. Partitioning distributes the write load across multiple nodes, while columnstore indexes provide high compression and fast query performance for analytical workloads. This combination is recommended for Stream Analytics to Synapse ingestion at scale.

Answer

Use Azure SQL Database output instead of Azure Synapse Analytics.

Answer

Use a single partition for the output to simplify processing.

Answer

Disable batching to reduce latency.

Question 7

You need to monitor the performance of an Azure Synapse Analytics dedicated SQL pool. Which DMV should you query to find queries that are currently running and their execution status?

Accepted Answer

sys.dm_pdw_exec_requests. The correct DMV is sys.dm_pdw_exec_requests, which provides information about all requests currently executing or recently completed on the dedicated SQL pool. It includes status, submit time, and other details, making it the primary view for monitoring active queries. This DMV is specifically designed for tracking request-level execution.

Answer

sys.dm_pdw_nodes

Answer

sys.dm_pdw_request_steps

Answer

sys.dm_pdw_errors

Question 8

You need to implement column-level security in Azure Synapse Analytics to restrict access to salary information. Only users with the 'HRManager' role should see salary columns. Which feature should you use?

Accepted Answer

Column-level security using GRANT on columns. Column-level security (CLS) in Azure Synapse Analytics uses GRANT on specific columns to restrict access. Option A is incorrect because row-level security filters rows, not columns. Option B is incorrect because dynamic data masking obfuscates data but does not prevent access. Option D is incorrect because Azure Purview is a governance tool, not a security enforcement mechanism.

Answer

Row-level security using security predicates

Answer

Dynamic data masking

Answer

Azure Purview data classification

Question 9

You have an Azure Data Lake Storage Gen2 account that stores parquet files. You need to ensure that files containing personally identifiable information (PII) are automatically classified and tagged. Which Azure service should you integrate?

Accepted Answer

Microsoft Purview. Microsoft Purview provides automated data classification and labeling for Azure Storage, including Azure Data Lake Storage Gen2. Option A is wrong because Azure Policy enforces rules but does not classify content. Option B is wrong because Microsoft Sentinel is a SIEM, not for classification. Option C is wrong because Microsoft Defender for Cloud is for security posture, not data classification.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 10

Which TWO Azure features can be used to encrypt data at rest in Azure Blob Storage? (Choose two.)

Accepted Answer

Customer-managed keys in Azure Key Vault. Option C (Customer-managed keys in Azure Key Vault) is correct because Azure Blob Storage supports server-side encryption with customer-managed keys (CMK), where the key encryption key is stored in Azure Key Vault and used to wrap the account's data encryption key, providing control over the encryption of data at rest. Option D (Storage Service Encryption, SSE) is correct because SSE is the built-in Azure Storage feature that automatically encrypts blob data at rest using AES-256 before it is persisted to disk, and it is enabled by default for all storage accounts. Option A (Azure Disk Encryption) is not correct because it encrypts OS and data disks attached to Azure VMs (using BitLocker/DM-Crypt), not blobs in a storage account. Option B (Azure Information Protection) is not correct because it classifies and protects files at the application/document level rather than providing storage-account-level encryption at rest for blobs. Option E (Transport Layer Security) is not correct because TLS protects data in transit over the network, not data at rest.

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Answer

Transport Layer Security (TLS)

Question 11

You need to monitor resource utilization for an Azure Synapse Analytics dedicated SQL pool. Which Azure Monitor metric shows the percentage of allocated DWU being used?

Accepted Answer

DWU used. The 'DWU used' metric in Azure Monitor reports the percentage of allocated Data Warehouse Units (DWUs) being consumed by the dedicated SQL pool. It is the direct measure of how much of the provisioned compute capacity is in use, making it the correct answer for monitoring DWU utilization. This metric is available in the Azure portal under the Synapse workspace's Metrics blade.

Answer

Memory percentage

Answer

Data IO percentage

Answer

CPU percentage

Question 12

You are reviewing a script to create an external data source in Azure Synapse Analytics serverless SQL pool. Based on the exhibit, what is the purpose of the SAS token?

Accepted Answer

To provide read access to the container for querying data.. In Azure Synapse Analytics serverless SQL pool, an external data source pointing to Azure Storage requires a SAS token to provide read access to the container so that queries can read the data. The SAS token grants limited access rights without exposing the account key, and it is used in the CREATE EXTERNAL DATA SOURCE statement to authenticate and authorize access to the storage.

Answer

To provide write access to the container for storing query results.

Answer

To encrypt the connection between the serverless pool and storage.

Answer

To authenticate the user to the serverless SQL pool.

Question 13

Your Azure Synapse Analytics dedicated SQL pool is experiencing performance degradation. You notice that some queries are being queued due to resource class conflicts. What should you implement to optimize performance and reduce queuing?

Accepted Answer

Configure workload management with workload groups and classifiers. Workload management with workload groups and classifiers allows you to assign queries to different resource classes and prioritize them, directly addressing resource class conflicts and reducing queuing. Option A is incorrect: scaling the pool to a higher DWU increases overall resources but does not specifically manage resource class contention; it may also incur additional cost without solving the root issue. Option C is incorrect: materialized views improve query performance by pre-aggregating data but do not affect concurrency or queuing. Option D is incorrect: result-set caching reduces repeated computation for identical queries but does not resolve queuing caused by resource class conflicts.

Answer

Scale the dedicated SQL pool to a higher DWU level

Answer

Create materialized views for the most common aggregations

Answer

Enable result-set caching for frequently run queries

Question 14

You are monitoring an Azure Data Factory pipeline that runs hourly. You notice that the pipeline has been failing intermittently with an error indicating 'Activity timeout'. Which Azure Monitor metric should you set an alert on to proactively detect such failures?

Accepted Answer

Failed pipeline runs metric. The 'Failed pipeline runs' metric in Azure Monitor directly tracks the number of pipeline runs that have failed, including failures caused by activity timeouts. Setting an alert on this metric allows you to be notified immediately when a pipeline run fails, enabling proactive detection. Other metrics like queue depth or duration may indicate potential issues but do not directly signal a failure. Therefore, the correct metric to alert on for detecting failures is 'Failed pipeline runs'.

Answer

Integration runtime queue depth metric

Answer

Pipeline duration metric

Answer

Data read and data written metrics

Question 15

You need to secure data at rest for an Azure Data Lake Storage Gen2 account that contains sensitive financial data. Which configuration should you enable to ensure that data is encrypted using a customer-managed key stored in Azure Key Vault, and that access to the key is logged?

Accepted Answer

Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable Key Vault logging. Azure Storage encryption with customer-managed keys in Key Vault provides control and logging. Option A is wrong because Microsoft-managed keys are the default but do not provide customer control. Option B is wrong because client-side encryption requires managing keys on the client side. Option C is wrong because infrastructure encryption adds a second layer but does not use customer-managed keys.

Answer

Enable Azure Storage encryption with Microsoft-managed keys

Answer

Implement client-side encryption using Azure Key Vault

Answer

Enable infrastructure encryption for double encryption