DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 16 — 15 Questions

Question 1

You have an Azure Synapse Analytics dedicated SQL pool that handles both high-priority real-time queries and low-priority batch jobs. You need to ensure that high-priority queries always get the resources they need, while batch jobs do not starve. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create workload groups for high-priority and low-priority queries, assigning appropriate importance and resource percentages. Workload groups in a dedicated SQL pool let you classify requests into groups and assign each group an importance level (e.g., HIGH for real-time queries, LOW for batch) plus a resource percentage (min/max memory and concurrency). This ensures high-priority queries preempt lower-priority ones for resources while guaranteeing batch jobs a floor so they don't starve. It is the native workload management mechanism for dedicated SQL pools.

Answer

Enable result-set caching for the high-priority queries

Answer

Enable data compression on the tables used by batch jobs

Answer

Create materialized views for the batch job queries

Question 2

You need to monitor the performance of an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline runs on a self-hosted integration runtime. Which metric is most important to monitor to ensure the self-hosted IR is not a bottleneck?

Accepted Answer

Queue depth for the self-hosted IR. The self-hosted integration runtime (IR) queue depth metric indicates the number of activities waiting to be processed by the IR. A consistently high or increasing queue depth signals that the IR cannot keep up with the workload, making it a bottleneck. Monitoring this metric allows proactive scaling or optimization.

Answer

Pipeline duration metric

Answer

Number of active connections to the IR

Answer

Data read and data written metrics for the pipeline

Question 3

You are securing an Azure Data Lake Storage Gen2 account that contains sensitive data. Which TWO of the following should you implement to protect data from unauthorized access?

Accepted Answer

Configure ACLs to grant least privilege to users and groups. Option A is correct because Azure Data Lake Storage Gen2 uses POSIX-style access control lists (ACLs) at both the directory and file level, and configuring ACLs to grant least privilege ensures users and groups only receive the specific read/write/execute permissions they require, directly preventing unauthorized access to sensitive data. Option B is correct because private endpoints assign a private IP address from your virtual network to the storage account, removing exposure to the public internet and restricting access to only clients within the approved virtual network or connected networks. Option C is incorrect because setting a default ACL that allows read access to all authenticated users violates least privilege and would broaden, not restrict, access to sensitive data. Option D is incorrect because CORS rules only control which web origins can make cross-origin browser requests to the service; they do not authenticate users or prevent unauthorized direct access. Option E is incorrect because enabling large file shares only increases the maximum capacity and file size limits of the file share, and has no effect on access control or authorization.

Answer

Set the default ACL to allow read access for all authenticated users

Answer

Enable CORS rules to allow only specific origins

Answer

Enable large file shares on the storage account

Question 4

You are designing a data processing solution in Azure Synapse Analytics. The solution must ensure that data at rest in a dedicated SQL pool is encrypted using customer-managed keys (CMK) stored in Azure Key Vault. The encryption should be enabled at the database level. What should you configure?

Accepted Answer

Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault provides database-level encryption for dedicated SQL pools in Azure Synapse Analytics. TDE encrypts data at rest, and using a customer-managed key (CMK) allows the organization to control the key lifecycle. Option B is incorrect because Azure Purview is for data governance and classification, not encryption. Option C is incorrect because Azure Disk Encryption encrypts VM disks, not the SQL pool database. Option D is incorrect because Always Encrypted is a column-level encryption feature, not for full database encryption.

Answer

Azure Purview data classification and encryption policies.

Answer

Azure Disk Encryption on the nodes hosting the dedicated SQL pool.

Answer

Always Encrypted with keys stored in Azure Key Vault.

Question 5

Your team has deployed an Azure Stream Analytics job that writes output to Azure Cosmos DB. You need to monitor the job for data latency and ensure it meets a service-level agreement (SLA) of under 10 seconds from input to output. Which metric should you track in Azure Monitor?

Accepted Answer

Watermark delay.. Watermark delay is the correct metric to monitor for data latency because it measures the maximum time between an input event being received and the corresponding output being produced. A watermark delay consistently under 10 seconds ensures the SLA is met. Output events (A) track the number of output events, not latency. Runtime errors (B) indicate failures, not latency. Input events (D) track the number of input events, not latency.

Answer

Output events.

Answer

Runtime errors.

Answer

Input events.

Question 6

Your organization uses Azure Data Lake Storage Gen2 and needs to prevent accidental deletion of data by enabling soft delete. You also need to ensure that deleted blobs are recoverable for 30 days. What should you configure?

Accepted Answer

Enable blob soft delete and set retention period to 30 days.. Blob soft delete enables recovery of deleted blobs within a specified retention period (30 days in this case). Option A is incorrect because blob snapshots are point-in-time copies that require manual management and do not provide automatic recovery of deleted blobs. Option B is incorrect because Azure Backup is designed for virtual machines and other Azure resources, not for blob-level recovery in Data Lake Storage Gen2. Option C is incorrect because container soft delete deletes entire containers, not individual blobs.

Answer

Enable blob snapshots and set them to expire after 30 days.

Answer

Use Azure Backup to create daily backups of the storage account.

Answer

Enable container soft delete with a retention period of 30 days.

Question 7

You are designing a security strategy for Azure Synapse Analytics. The solution must prevent users from accessing sensitive columns in a dedicated SQL pool, such as Social Security numbers, unless they have explicit permission. Which feature should you use?

Accepted Answer

Column-level security.. Column-level security (CLS) restricts access to specific columns by granting or denying SELECT permissions on individual columns. Option C (Dynamic data masking) obfuscates data at query time but does not prevent access, as users can still see the data if they bypass masking. Option B (Azure Purview) is a data governance service for cataloging and classifying data, not for access control. Option D (Row-level security) filters rows based on user context, not columns.

Answer

Azure Purview data classification.

Answer

Dynamic data masking.

Answer

Row-level security (RLS).

Question 8

Your company uses Azure Data Factory to orchestrate data movement. You need to monitor pipeline runs across multiple factories and create a dashboard that shows success and failure rates over the past 30 days. What is the most efficient approach?

Accepted Answer

Configure diagnostic settings for each Data Factory to send logs to a Log Analytics workspace, then create a workbook using KQL queries.. Diagnostic settings in Azure Data Factory can route ActivityRuns, PipelineRuns, TriggerRuns, and other logs to a Log Analytics workspace. Once logs from multiple factories land in the same workspace, KQL queries in an Azure Monitor workbook can aggregate success/failure counts across all factories over a 30-day window, giving a single consolidated dashboard. This is the most efficient, scalable approach for multi-factory monitoring.

Answer

Use the Data Factory monitoring UI to view runs for each factory individually.

Answer

Enable Azure Storage Analytics and query the logs stored in a storage account.

Answer

Create alert rules in Azure Monitor for each pipeline failure and aggregate manually.

Question 9

Your organization needs to ensure that all data stored in Azure Data Lake Storage Gen2 is encrypted at rest using Microsoft-managed keys. What is the default encryption method?

Accepted Answer

Storage Service Encryption (SSE) with Microsoft-managed keys.. Azure Data Lake Storage Gen2 is built on Azure Blob Storage, which automatically encrypts all data at rest using Storage Service Encryption (SSE) with Microsoft-managed keys by default. This encryption is always enabled and cannot be disabled. Microsoft-managed keys are used unless you choose to use customer-managed keys.

Answer

Transparent Data Encryption (TDE) on the storage account.

Answer

Client-side encryption with keys stored in Azure Key Vault.

Answer

Azure Disk Encryption on the storage nodes.

Question 10

You need to monitor the performance of an Azure Stream Analytics job that processes real-time IoT data. Which metric indicates the number of events that are being dropped or delayed due to insufficient processing capacity?

Accepted Answer

Backlogged input events.. Backlogged input events (C) measures the number of events that are queued awaiting processing, indicating that the job is unable to keep up with the input rate. High backlog suggests insufficient processing capacity, leading to dropped or delayed events. Watermark delay (A) measures the time lag in processing, but does not directly count events dropped. Input events (D) is the total received, not dropped/delayed. Output events (B) is the total sent.

Answer

Watermark delay.

Answer

Output events.

Answer

Input events.

Question 11

Your company uses Azure Data Lake Storage Gen2 and needs to implement a data retention policy that automatically deletes files older than 90 days in a specific container. What should you use?

Accepted Answer

Azure Storage lifecycle management rule with a filter for the container and a delete action after 90 days.. Azure Storage lifecycle management policies are the native, server-side mechanism for automatically transitioning or deleting blobs based on age. A rule can be scoped with a prefix filter matching the specific container and configured with a delete action after 90 days, executing automatically without any external orchestrator. This is the correct, cost-effective, and operationally simple solution for ADLS Gen2 retention.

Answer

Azure Data Factory pipeline with a Delete activity scheduled to run daily.

Answer

Azure Policy with a deny effect for files older than 90 days.

Answer

Azure Purview data lifecycle policy.

Question 12

You are designing a disaster recovery plan for an Azure Synapse Analytics dedicated SQL pool. The primary region becomes unavailable. You need to fail over to a secondary region with minimal data loss. The recovery point objective (RPO) is 1 hour. What should you configure?

Accepted Answer

Enable geo-backup on the dedicated SQL pool.. Geo-backup is a built-in feature for Azure Synapse Analytics dedicated SQL pools that automatically takes full backups at regular intervals and replicates them to a paired region. The default recovery point objective (RPO) is 1 hour, meeting the requirement. Option A is incorrect because active geo-replication is a feature for Azure SQL Database, not for Synapse dedicated SQL pools. Option B is incorrect because automatic restore points are local and not automatically replicated; copying them via Azure Data Factory adds complexity and does not guarantee the RPO. Option D is incorrect because user-defined restore points are manual and would require additional orchestration to store them in a secondary region, making it less reliable and harder to meet the 1-hour RPO consistently.

Answer

Configure active geo-replication to the secondary region.

Answer

Use automatic restore points and copy them to the secondary region using Azure Data Factory.

Answer

Create user-defined restore points every hour and store them in the secondary region.

Question 13

You are running an Azure Stream Analytics job that reads from an Event Hub and writes to a Power BI dataset. The job is falling behind and processing latency is increasing. What should you do to improve performance?

Accepted Answer

Increase the number of Streaming Units (SUs) allocated to the job.. Azure Stream Analytics scales throughput by allocating Streaming Units (SUs), which represent a bundle of CPU, memory, and network resources. When a job falls behind, increasing SUs provides more parallel processing capacity, directly reducing latency. This is the standard vertical scaling mechanism for Stream Analytics and is the correct first response to performance degradation.

Answer

Use a reference data input to filter events.

Answer

Change the output to Azure Blob Storage instead of Power BI.

Answer

Decrease the size of events sent to the Event Hub.

Question 14

You deploy the Azure Security Center automation shown in the exhibit. What is the purpose of this automation?

Accepted Answer

It sends high-severity security alerts to an Event Hub for further processing.. The automation in Azure Security Center (now Microsoft Defender for Cloud) is configured to export high-severity security alerts to an Azure Event Hub. This is a built-in continuous export feature that streams alerts to an Event Hub for further processing by downstream systems like SIEM, SOAR, or custom applications. The correct option directly matches this purpose: sending high-severity alerts to an Event Hub.

Answer

It configures Azure Monitor to log high-severity alerts.

Answer

It applies an Azure Policy to remediate high-severity alerts.

Answer

It creates incidents in Azure Sentinel for high-severity alerts.

Question 15

You are designing a data processing solution using Azure Databricks. The solution must use Delta Lake for ACID transactions and must optimize storage costs by automatically compacting small files. Which feature should you enable?

Accepted Answer

Enable auto-optimize on the Delta table.. Auto-optimize (also called Optimized Writes / auto compaction) is a Delta Lake table property that automatically compacts small files during writes, eliminating the need for manual OPTIMIZE jobs. It combines with optimized writes to reduce the small-file problem at ingestion time, directly lowering storage and query costs. This is the native, built-in feature designed for the stated requirement.

Answer

Run OPTIMIZE command in a scheduled job.

Answer

Set retention duration for vacuum to 7 days.

Answer

Enable Z-order indexing on the Delta table.