DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 17 — 15 Questions

Question 1

A company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. They need to restrict a specific application's access to only write files in a particular directory without being able to read or list files. Which type of permission should be assigned?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an access control list (ACL) that grants execute and write permissions to the application's service principal.. In ADLS Gen2 with hierarchical namespace, POSIX-style ACLs are the granular permission mechanism. To allow an application to write files in a directory without reading or listing, you grant the service principal 'execute' (traverse) and 'write' permissions on the directory. Execute allows traversal through the directory, and write allows creating files within it; without read, the principal cannot list directory contents. This is the least-privilege approach for the stated requirement.

Answer

Configure a firewall rule to allow only the application's IP address.

Answer

Generate a shared access signature (SAS) with write and list permissions.

Answer

Assign the Storage Blob Data Contributor role at the storage account level.

Question 2

Your team is running a critical Azure Stream Analytics job that writes results to Azure SQL Database. Recently, the job has been failing with high latency and occasional data loss. You need to monitor the job's performance and set up alerts for when the watermark delay exceeds a threshold. What should you use?

Accepted Answer

Azure Monitor metrics for the Stream Analytics job.. Azure Monitor metrics for the Stream Analytics job provide built-in performance metrics such as Watermark Delay, Input Events, Output Events, and Runtime Errors, and you can create alert rules on these metrics when the watermark delay exceeds a threshold. This is the native, recommended way to monitor Stream Analytics job performance and set up alerts.

Answer

Application Insights SDK integration in the job.

Answer

Azure Log Analytics workspace connected to the job diagnostics logs.

Answer

Azure Data Explorer for querying job performance data.

Question 3

Your company uses Azure Purview for data governance. You need to ensure that sensitive data in Azure Data Lake Storage Gen2 is automatically detected and classified. What should you configure in Purview?

Accepted Answer

Create a scan rule set that includes built-in classification rules for sensitive data types.. In Microsoft Purview, you can create scan rule sets that include built-in classification rules to automatically detect sensitive data types during scanning. Option A is incorrect because sensitivity labels are applied after classification, not for detection. Option B is incorrect because Microsoft Defender for Cloud's data sensitivity discovery is a different feature; Purview itself handles classification. Option C is incorrect because Azure Policy enforces compliance rules, not data classification at the file level.

Answer

Apply sensitivity labels to the storage account using Microsoft Purview Information Protection.

Answer

Enable Microsoft Defender for Cloud's data sensitivity discovery.

Answer

Use Azure Policy to enforce tagging of resources containing sensitive data.

Question 4

You are reviewing an Azure PowerShell script that sets permissions on a directory in Azure Data Lake Storage Gen2. The script sets a default ACL for a user on the path 'sales/2024/01/'. What is the effect of the -DefaultScope parameter?

Accepted Answer

The ACL is inherited by all new child items created under this directory.. The -DefaultScope parameter in Azure Data Lake Storage Gen2 sets a default ACL entry. Default ACLs do not set permissions on the current directory; instead, they define permissions that are inherited by new child items (files and subdirectories) created under that directory. Therefore, option B is correct. Option A is incorrect because default ACLs do not replace the access ACL; access ACLs are set separately without -DefaultScope. Option C is incorrect because default ACLs do not apply to existing items; they only affect future items. Option D is incorrect because default ACLs apply to both new files and new subdirectories.

Answer

The ACL replaces the existing access ACL on the directory.

Answer

The ACL is applied to all existing files and subdirectories recursively.

Answer

The ACL is applied only to files, not subdirectories.

Question 5

Which THREE metrics should you monitor for an Azure Synapse Analytics dedicated SQL pool to ensure optimal performance?

Accepted Answer

tempdb usage. Monitoring tempdb usage (A) is essential because dedicated SQL pool queries spill to tempdb for sorts, hash joins, and other operations, and high tempdb utilization can indicate insufficient memory or poorly designed queries that degrade performance. DWU usage (B) is a key metric because it reflects how much of the provisioned Data Warehouse Unit capacity is being consumed; consistently high DWU usage signals that the pool may need scaling or workload tuning. Queued queries (C) should be monitored because a growing queue indicates that concurrency limits or resource contention are delaying query execution, directly affecting performance. The unmarked options do not belong: login failures (D) is a security/connectivity metric rather than a performance indicator, and total storage size (E) relates to capacity planning and cost, not to query performance optimization.

Answer

Login failures

Answer

Total storage size

Question 6

Which TWO methods can you use to optimize the cost of storing data in Azure Data Lake Storage Gen2?

Accepted Answer

Configure lifecycle management policies to move older data to the cool or archive tier.. Option B is correct because Azure Data Lake Storage Gen2 lifecycle management policies automatically transition blobs to cooler access tiers (cool or archive) or delete them based on age or last-access rules, directly lowering storage costs for infrequently accessed data. Option D is correct because ADLS Gen2 is built on Azure Blob Storage, so data can be stored in the hot, cool, or archive access tiers, and choosing the appropriate tier for each dataset's access pattern minimizes per-GB storage charges. Option A is incorrect because customer-managed keys affect encryption key management and security/compliance, not storage cost. Option C is incorrect because soft delete retains deleted blobs for a retention period, which adds storage consumption rather than reducing cost. Option E is incorrect because geo-redundant storage increases durability and disaster-recovery capability but raises cost compared with locally redundant storage.

Answer

Use customer-managed keys for encryption.

Answer

Enable soft delete for blobs.

Answer

Enable geo-redundant storage (GRS) for disaster recovery.

Question 7

Your company uses Azure Data Lake Storage Gen2. You need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable 'Azure Storage encryption' with customer-managed keys in the storage account's encryption blade.. Azure Storage encryption with customer-managed keys is configured in the encryption blade of the storage account. This ensures data at rest is encrypted using a key stored in Azure Key Vault. Option A is incorrect because Azure Policy can audit or enforce encryption but does not configure customer-managed keys. Option C is incorrect because client-side encryption encrypts data before it reaches Azure Storage, not at rest. Option D is incorrect because infrastructure encryption provides a second encryption layer but does not use customer-managed keys for the primary encryption.

Answer

Use Azure Policy to audit storage accounts without encryption.

Answer

Implement client-side encryption in the application code.

Answer

Enable 'Infrastructure encryption' for double encryption.

Question 8

You are designing a data processing solution in Azure Synapse Analytics. The solution must ensure that sensitive columns containing personally identifiable information (PII) are masked at query time for users without explicit permissions. Which Azure Synapse Analytics feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) in Azure Synapse Analytics masks sensitive column data at query time for users without explicit UNMASK permissions, returning masked values (e.g., XXXX or 0) instead of the real data. It is applied via a MASKED WITH clause on the column definition and does not alter the stored data, making it the correct choice for query-time PII obfuscation.

Answer

Row-Level Security

Answer

Transparent Data Encryption

Answer

Always Encrypted

Question 9

Your Azure Data Lake Storage Gen2 account stores sensitive data. You need to audit who accesses the data and when, and you want to send the audit logs to a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Diagnostic settings on the storage account. Diagnostic settings on the storage account can stream audit logs (like read, write, delete) to Log Analytics for analysis. Option A is incorrect because Azure Activity Logs capture control plane operations, not data plane access. Option B is incorrect because Microsoft Sentinel is a SIEM that would consume logs from diagnostic settings, not a direct configuration for log collection. Option C is incorrect because Azure Monitor alerts are for notifications based on metrics or logs, not for collecting logs.

Answer

Azure Activity Logs

Answer

Microsoft Sentinel

Answer

Azure Monitor alerts

Question 10

You have an Azure Synapse Analytics dedicated SQL pool. You notice that some queries are taking longer than expected due to excessive data movement operations. You need to minimize data movement without changing the distribution columns. Which table design approach should you recommend?

Accepted Answer

Use replicated tables for small dimension tables. Replicated tables are recommended for small dimension tables because they are copied to all compute nodes, avoiding data movement during joins. This reduces excessive data movement without changing distribution columns. Option B is incorrect because round-robin distribution distributes data evenly but does not reduce data movement for joins; it is typically used for staging tables. Option C is incorrect because using hash distribution for all tables can lead to data movement when joining on different columns, and it is not a one-size-fits-all solution. Option D is incorrect because partitioning alone does not reduce data movement; it is used for data management and pruning, not for minimizing shuffle operations.

Answer

Use round-robin distribution for dimension tables

Answer

Use hash distribution for all tables

Answer

Use partitioning on join columns

Question 11

You have an Azure Synapse Analytics serverless SQL pool that queries data in Azure Data Lake Storage Gen2. You need to ensure that only users with specific Microsoft Entra ID groups can access the data through the serverless SQL pool. What should you configure?

Accepted Answer

Grant the Microsoft Entra ID group CONNECT permission on the serverless SQL pool and configure ACLs on the storage to allow read access for the group. Controlling access involves two layers: the serverless SQL pool and the underlying storage. Users must have both CONNECT permission on the SQL pool to query and appropriate ACLs on the storage to read the data. Granting the Microsoft Entra ID group CONNECT permission and configuring ACLs on the storage account to allow read access for the group ensures that only those users can access data through the serverless SQL pool. Option A is incorrect because the Storage Blob Data Reader role alone does not grant SQL-level permissions. Option C is incorrect because firewall rules are network-level and do not provide granular user access. Option D is incorrect because SAS tokens are not recommended for user-level access and bypass Entra ID permissions.

Answer

Grant the Microsoft Entra ID group the Storage Blob Data Reader role on the storage account

Answer

Configure a firewall rule to allow only the Microsoft Entra ID group IP ranges

Answer

Use a shared access signature (SAS) token with the SQL pool and distribute it to users

Question 12

You need to ensure that an Azure Data Factory pipeline retries a failed activity up to three times with a 5-minute delay between retries. How should you configure the activity?

Accepted Answer

Set retry to 3 and retryIntervalInSeconds to 300 in the activity policy. Azure Data Factory activity policies expose two retry-related properties: 'retry' (an integer count) and 'retryIntervalInSeconds' (the fixed delay between attempts). Setting retry to 3 and retryIntervalInSeconds to 300 produces exactly three retries with a 5-minute (300-second) fixed interval, matching the requirement. This is configured on the activity's policy object in the pipeline JSON or via the Author UI.

Answer

Configure the Retry policy on the pipeline activity as 'Exponential' with count 3

Answer

Set the activity timeout to 15 minutes and enable retry

Answer

Set maxRetries to 3 and delay to 5 minutes in the pipeline JSON

Question 13

Which THREE metrics should you monitor to evaluate the performance of an Azure Stream Analytics job?

Accepted Answer

Input Events Backlogged. Input Events Backlogged (A) is a correct metric because it measures the number of input events that are waiting to be processed, directly revealing whether the job is falling behind its input rate. Output Events (B) is correct because it counts the events emitted to the output sink, letting you verify the job is actually producing results and detect drops in throughput. Watermark Delay (seconds) (E) is correct because it quantifies how far behind real time the job is running, which is the key indicator of streaming latency and timeliness. Conversion Errors (C) is not one of the three performance metrics for evaluating job throughput/latency; it reflects data-format deserialization problems rather than performance. SU (Memory) Utilization (D) is a Streaming Unit resource metric that indicates capacity consumption, not the job's runtime performance as measured by backlog, output, and watermark delay.

Answer

Conversion Errors

Answer

SU (Memory) Utilization

Question 14

Which TWO Azure services can be used to monitor Azure Data Factory pipeline runs and set up alerts?

Accepted Answer

Log Analytics. Azure Monitor (option D) is the native platform for collecting metrics and activity/diagnostic logs from Azure Data Factory and for creating alert rules (metric alerts, log search alerts, activity log alerts) that trigger on pipeline run failures or durations, so it directly satisfies the monitoring-and-alerting requirement. Log Analytics (option A) is the service where ADF diagnostic logs are stored and queried with KQL, and it powers log search alerts (via Azure Monitor) on pipeline run records such as PipelineRun and ActivityRun, making it a valid way to monitor runs and set alerts. Microsoft Sentinel (B) is a SIEM/SOAR for security analytics, not pipeline operational monitoring; Azure Policy (C) enforces governance/compliance rules rather than monitoring runs; and Azure Advisor (E) only provides best-practice recommendations, not run monitoring or alerting.

Answer

Microsoft Sentinel

Answer

Azure Policy

Answer

Azure Advisor

Question 15

Refer to the exhibit. You are reviewing an ARM template for an Azure Data Lake Storage Gen2 account. Which of the following security best practices is violated in this template?

Accepted Answer

The account allows HTTP traffic and uses an outdated TLS version. The template sets supportsHttpsTrafficOnly to false, allowing HTTP traffic, which is insecure. Additionally, minimumTlsVersion is set to TLS1_0, an outdated and insecure version. Option A is incorrect because the location uses resourceGroup().location, which is a common and acceptable practice for flexibility. Option B is incorrect because Standard_LRS is a valid SKU; Geo-redundant storage is not a security best practice requirement. Option C is incorrect because the template does enable hierarchical namespace (isHnsEnabled: true), so that is not a violation.

Answer

The location should be fixed instead of using resourceGroup().location

Answer

The SKU should be Standard_GRS for disaster recovery

Answer

The account does not enable hierarchical namespace (HNS)