DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a Data Factory JSON definition. The factory has a user-assigned managed identity configured. However, the linked service to Azure Storage uses an account key. What security improvement should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the linked service to use the managed identity for authentication. Since the Data Factory already has a user-assigned managed identity, the most secure improvement is to reconfigure the Azure Storage linked service to authenticate via that managed identity instead of an account key. Managed identities eliminate the need to store and rotate secrets, and Azure RBAC can grant the identity the minimum required role (e.g., Storage Blob Data Contributor) on the storage account. This is Microsoft's recommended authentication pattern for ADF linked services.

Answer

Add a firewall rule to limit access to the storage account

Answer

Remove the managed identity and use a service principal

Answer

Keep the account key but store it in Azure Key Vault

Question 2

You are designing a data processing solution in Azure Synapse Analytics. The solution must prevent unauthorized access to data at rest and in transit. Which combination of features should you implement?

Accepted Answer

Enable Transparent Data Encryption (TDE) and enforce TLS 1.2.. Transparent Data Encryption (TDE) encrypts data at rest in Azure Synapse Analytics, and enforcing TLS 1.2 ensures encryption of data in transit. Option B (Azure RBAC and firewall rules) controls access but does not provide encryption. Option C (Always Encrypted and column-level security) is primarily for client-side encryption and access control, not comprehensive at-rest encryption. Option D (storing keys in Key Vault and enabling double encryption) relates to key management and infrastructure encryption, but the direct combination of TDE and TLS 1.2 is the required solution.

Answer

Use Azure RBAC and firewall rules.

Answer

Use Always Encrypted and column-level security.

Answer

Store encryption keys in Azure Key Vault and enable double encryption.

Question 3

Your Azure Data Lake Storage Gen2 account stores sensitive customer data. You need to ensure that data is encrypted at rest using customer-managed keys (CMK) and that access to the encryption key is logged. What should you do?

Accepted Answer

Configure customer-managed keys in Azure Key Vault and enable Key Vault diagnostics logging.. Customer-managed keys (CMK) stored in Azure Key Vault allow you to control and audit key usage, and enabling Key Vault diagnostics logging captures access events. Option A is incorrect because infrastructure encryption uses platform-managed keys. Option B is incorrect because double encryption adds a second layer but does not directly provide logging of key access. Option D is incorrect because SSE with platform-managed keys does not give customer control or logging.

Answer

Enable infrastructure encryption on the storage account.

Answer

Enable double encryption using both platform-managed and customer-managed keys.

Answer

Use Azure Storage Service Encryption (SSE) with platform-managed keys.

Question 4

You need to monitor the performance of Azure Synapse Analytics dedicated SQL pool queries. Which Azure service should you use to identify long-running queries and resource bottlenecks?

Accepted Answer

Azure Synapse Studio monitoring hub and dynamic management views (DMVs).. Azure Synapse Studio monitoring hub provides a centralized view of query performance, including long-running queries and resource utilization. Dynamic management views (DMVs) offer detailed, real-time insights into query execution and resource bottlenecks. Together, they are the primary tools for monitoring dedicated SQL pool performance.

Answer

Microsoft Purview Data Map.

Answer

Azure Log Analytics queries.

Answer

Azure Monitor Workbooks.

Question 5

You have an Azure Databricks workspace that processes sensitive data. The security team requires that all access to the workspace be authenticated using Microsoft Entra ID and that all API calls be audited. Which configuration should you implement?

Accepted Answer

Configure workspace to use Microsoft Entra ID authentication and enable diagnostic settings for audit logs.. To meet both requirements—Microsoft Entra ID authentication and audited API calls—you must configure the workspace to use Entra ID authentication and enable diagnostic settings to send audit logs to a destination like Log Analytics. This combination ensures identity-based access and a record of API activity.

Answer

Enable VNet injection and configure network security groups.

Answer

Deploy Azure Private Link and disable public access.

Answer

Configure personal access tokens for API access and enable cluster logs.

Question 6

Your organization uses Azure Data Factory to orchestrate data pipelines. You need to ensure that sensitive data is not exposed in pipeline logs. What should you configure?

Accepted Answer

Enable 'Secure output' on pipeline activities.. Enabling 'Secure output' on pipeline activities prevents sensitive data from being written to Azure Data Factory logs. Option A is incorrect because while storing connection strings in Azure Key Vault is a security best practice, it does not prevent sensitive data from appearing in pipeline logs. Option C is incorrect because setting a retention policy for logs controls how long logs are kept, but does not prevent sensitive data exposure. Option D is incorrect because data flow debug logs are for debugging and do not mask sensitive data in pipeline logs.

Answer

Store connection strings in Azure Key Vault.

Answer

Set a retention policy for pipeline logs.

Answer

Use data flow debug logs with session logs.

Question 7

You are designing a data lake architecture using Azure Data Lake Storage Gen2. You need to implement a least-privilege security model. Which authorization mechanism should you use for granular control?

Accepted Answer

Use POSIX-like access control lists (ACLs).. POSIX-like access control lists (ACLs) in Azure Data Lake Storage Gen2 provide file- and directory-level granular permissions, enabling least-privilege access down to individual users or groups. They are the recommended mechanism when you need fine-grained control beyond what Azure RBAC roles at the container or storage account level can provide. ACLs support both access ACLs (for current access) and default ACLs (inherited by new child items).

Answer

Use storage account keys for access.

Answer

Use Azure RBAC roles at the storage account level.

Answer

Use shared access signatures (SAS) with stored access policies.

Question 8

You need to monitor the health of your Azure Data Lake Storage Gen2 account. Which metric should you use to track the number of successful and failed requests?

Accepted Answer

Transactions.. Transactions metric tracks all requests. Option B is wrong because Success E2E Latency measures latency, not count. Option C is wrong because Blob Capacity measures storage size. Option D is wrong because Ingress is about data incoming, not request count.

Answer

Success E2E Latency.

Answer

Blob Capacity.

Answer

Ingress.

Question 9

Which TWO actions should you take to secure data in Azure Synapse Analytics dedicated SQL pool? (Choose two.)

Accepted Answer

Apply dynamic data masking (DDM) to obfuscate sensitive data.. Dynamic data masking (DDM) (option D) is correct because it obfuscates sensitive columns at query time for non-privileged users, so PII such as emails or credit-card numbers is masked in result sets without altering the underlying stored data in the dedicated SQL pool. Row-level security (RLS) (option E) is correct because it enforces predicate-based filters (via a security policy and inline table-valued function) so users only see rows matching their identity or role, restricting data access at the row granularity. Together, DDM and RLS directly address protecting sensitive data from unauthorized viewing, which is the stated goal. PolyBase (option A) is a data-ingestion technology for reading external sources, not a data-protection control. Result-set caching (option B) is a performance feature that caches query results and does not secure data. Workload classification (option C) governs resource allocation and query priority through workload groups, not data confidentiality or access control.

Answer

Use PolyBase to load data from external sources.

Answer

Enable result-set caching for query performance.

Answer

Configure workload classification for resource governance.

Question 10

Which TWO Azure services can be used to audit data access and changes in Azure Data Lake Storage Gen2? (Choose two.)

Accepted Answer

Storage account diagnostic settings.. Storage account diagnostic settings (C) are correct because they can stream Data Lake Storage Gen2 resource logs—such as Read, Write, and Delete operations on blobs and ADLS Gen2 filesystems—to a Log Analytics workspace, storage account, or Event Hub, providing the raw audit trail of data access and changes. Azure Monitor and Microsoft Sentinel (D) are correct because Azure Monitor collects and queries those diagnostic logs (via Log Analytics/KQL) for auditing, while Microsoft Sentinel ingests the same storage/ADLS logs to detect, alert on, and investigate suspicious data-access activity. Microsoft Entra ID sign-in logs (A) only record authentication and token issuance events, not per-file data-plane operations, so they cannot audit data access or changes. Azure Backup reports (B) cover backup job status and protected-item health, not data-plane read/write/delete auditing. Azure Policy (E) evaluates and enforces resource configuration compliance (control plane), not individual data access or modification events.

Answer

Microsoft Entra ID sign-in logs.

Answer

Azure Backup reports.

Answer

Azure Policy.

Question 11

You are designing a data lake in Azure Data Lake Storage Gen2 for a large enterprise. You need to ensure that only authorized users can access the data, and you must implement the principle of least privilege. Which security mechanism should you use to grant fine-grained access to specific directories and files without modifying the underlying storage account firewall settings?

Accepted Answer

Azure RBAC roles combined with POSIX-like ACLs. Azure RBAC roles combined with POSIX-like ACLs is correct because Azure Data Lake Storage Gen2 supports a hierarchical namespace that enables POSIX-style access control lists (ACLs) at the directory and file level, allowing fine-grained permissions (read, write, execute) for specific Microsoft Entra ID principals. RBAC handles coarse-grained control at the management group, subscription, or storage account scope, while ACLs provide the granular, object-level authorization required for least privilege. This combination does not require altering the storage account firewall, which controls network access rather than identity-based permissions.

Answer

Managed identities for Azure resources

Answer

Storage account firewall rules

Answer

Shared access signatures (SAS)

Question 12

You need to monitor the performance of an Azure Stream Analytics job in real time. Which Azure service should you use to track the job's resource utilization (e.g., SU % utilization) and set up alerts when the job is approaching its capacity?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service for real-time monitoring of Azure Stream Analytics jobs, providing metrics such as SU % utilization, watermark delay, and input/output events. It allows you to create alert rules based on these metrics to notify when the job approaches capacity limits.

Answer

Azure Advisor

Answer

Microsoft Sentinel

Answer

Azure Log Analytics

Question 13

You need to ensure that sensitive data stored in Azure SQL Database is encrypted at rest. Which feature should you enable?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) should be enabled to ensure sensitive data stored in Azure SQL Database is encrypted at rest. TDE encrypts the database, backups, and log files at rest without requiring changes to the application.

Answer

Always Encrypted

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Question 14

You have an Azure Data Lake Storage Gen2 account that stores log files. You need to implement a data retention policy so that logs older than 90 days are automatically deleted. What should you use?

Accepted Answer

Lifecycle management policy. A lifecycle management policy can automatically delete blobs based on age. Option A is wrong because Azure Policy enforces compliance but does not delete. Option C is wrong because Azure Blob Storage inventory provides reports but does not delete. Option D is wrong because Azure Purview scopes metadata and data discovery, not lifecycle management.

Answer

Azure Policy

Answer

Azure Blob Storage inventory

Answer

Microsoft Purview

Question 15

You are monitoring an Azure Synapse Analytics dedicated SQL pool and notice that some queries are experiencing high wait times due to concurrency slots being exhausted. You need to optimize the workload to reduce contention. Which three actions should you take? (Select three.)

Accepted Answer

Create workload groups with different importance levels.. In an Azure Synapse dedicated SQL pool, concurrency-slot exhaustion is best addressed by workload management: creating workload groups with different importance levels (B) lets critical queries get priority, workload isolation (C) caps the resources a group can consume so one workload cannot starve others, and workload classification (D) routes incoming queries into the correct workload group based on labels, login, or time. Together these three actions directly reduce contention for the fixed number of concurrency slots. Increasing DWU (A) adds resources but does not manage contention among competing queries, and result-set caching (E) improves repeated-read latency but does not relieve concurrency-slot pressure.

Answer

Increase the data warehouse service level (DWU).

Answer

Enable result-set caching for frequently executed queries.