DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 19 — 15 Questions

Question 1

You need to monitor an Azure Data Factory pipeline for failures and send an email notification when a pipeline run fails. Which Azure service should you use to create an alert based on the pipeline run metrics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor. Azure Monitor can create alerts based on ADF metrics like 'Failed pipeline runs'. Option A is wrong because Microsoft Sentinel is for security. Option C is wrong because Azure Service Health monitors Azure service health, not pipeline runs. Option D is wrong because Azure Log Analytics is for log queries, not alerting.

Answer

Microsoft Sentinel

Answer

Azure Service Health

Answer

Azure Log Analytics

Question 2

You have an Azure Synapse Analytics dedicated SQL pool that is used for reporting. You notice that the tempdb database is growing rapidly and causing queries to fail. Which two actions should you take to mitigate the issue? (Select two.)

Accepted Answer

Reduce the degree of parallelism (MAXDOP) for the workload.. The correct actions are C and E. Reducing MAXDOP lowers the degree of parallelism, which directly reduces the number of concurrent tempdb allocations per query, and optimizing queries that perform large sorts or hash joins minimizes the spills to tempdb that cause it to grow rapidly. Increasing DWU (B) scales compute resources but does not reduce tempdb consumption per query, and it can even increase parallelism. Enabling result-set caching (A) is not a feature of dedicated SQL pools in this context and does not address tempdb growth from sorts and hash joins. Moving tempdb to a separate storage account (D) is not supported in Azure Synapse dedicated SQL pools, as tempdb is managed by the service.

Answer

Enable result-set caching to reduce query reruns.

Answer

Increase the service level (DWU) of the dedicated SQL pool.

Answer

Move tempdb to a separate storage account.

Question 3

Your organization uses Azure Purview for data governance. You need to automatically scan an Azure Data Lake Storage Gen2 account and classify sensitive data such as credit card numbers and social security numbers. What should you configure?

Accepted Answer

A new scan rule set in Purview with classification rules for sensitive data types. In Azure Purview, to automatically scan and classify sensitive data, you create a scan rule set that includes classification rules for the specific sensitive data types (e.g., credit card numbers, SSNs). The scan rule set is applied to the scan of the Azure Data Lake Storage Gen2 account, and Purview uses built-in or custom classification rules to identify and tag sensitive data.

Answer

Azure Information Protection (AIP) scanner

Answer

Microsoft Defender for Cloud

Answer

Azure Policy with built-in guest configuration

Question 4

Your team is troubleshooting slow query performance on a dedicated SQL pool in Azure Synapse Analytics. The query uses a hash-distributed fact table with 60 distributions. After reviewing the execution plan, you notice a high number of data moves. Which action would most likely reduce data movement?

Accepted Answer

Redistribute the fact table on the join column using hash distribution.. Redistributing the fact table on the join column using hash distribution will most likely reduce data movement. In a dedicated SQL pool, hash distribution on the join column ensures that rows with the same join key are colocated on the same distribution, minimizing the need to shuffle data during joins.

Answer

Change the distribution type to round-robin.

Answer

Update statistics on all columns used in joins.

Answer

Increase the number of distributions to 120.

Question 5

Your organization uses Microsoft Purview to catalog data assets. You need to ensure that sensitive data such as credit card numbers are automatically detected and labeled. Which Purview feature should you configure?

Accepted Answer

Configure a scan rule set with built-in classification rules for sensitive data types.. Microsoft Purview automatically detects sensitive data types such as credit card numbers through classification rules that are part of a scan rule set. When you configure a scan rule set and include the built-in system classification rules (e.g., Credit Card Number, which matches patterns like 16-digit numbers with Luhn validation), Purview applies those classifications during scans and can then apply sensitivity labels. This is the native mechanism for automated sensitive data detection and labeling in Purview.

Answer

Create an Azure Policy to enforce tagging.

Answer

Enable the Data Catalog self-service search.

Answer

Enable Microsoft Information Protection for the data sources.

Question 6

You are monitoring an Azure Data Lake Storage Gen2 account using Azure Monitor. You need to be alerted when the number of storage account requests exceeds 20,000 per hour. What is the most efficient way to set up this alert?

Accepted Answer

Create a metric alert on the 'Transactions' metric with a threshold of 20,000 and aggregation granularity of 1 hour.. The 'Transactions' metric in Azure Monitor can be used to count the number of requests to the storage account, and you can set a metric alert with a threshold of 20,000 aggregated over an hour. This is the most efficient method as it directly uses the metric without needing complex queries. Option A is wrong because it requires creating a Log Analytics workspace and writing a KQL query, which is more complex and less efficient than a metric alert. Option B is wrong because Activity Log alerts are for management events like 'List Storage Account Keys', not for data transaction counts. Option D is wrong because Azure Advisor provides recommendations, not custom alerting on specific metric thresholds.

Answer

Create a Log Analytics workspace and write a KQL query to count requests.

Answer

Create an Activity Log alert for 'List Storage Account Keys' events.

Answer

Use Azure Advisor to recommend scaling.

Question 7

Which TWO Azure services can be used to monitor and analyze query performance in Azure Synapse Analytics dedicated SQL pool?

Accepted Answer

Azure Monitor with Log Analytics. Azure Monitor with Log Analytics (D) is correct because dedicated SQL pool emits diagnostic logs and metrics (e.g., DmvLogs, QueryStoreRuntimeStatistics, ExecRequests) that can be routed to a Log Analytics workspace, where KQL queries and workbooks are used to monitor and analyze query performance over time. Dynamic Management Views (E) are correct because T-SQL DMVs such as sys.dm_pdw_exec_requests, sys.dm_pdw_exec_sessions, sys.dm_pdw_request_steps, and sys.dm_pdw_sql_requests expose real-time execution details, wait statistics, and step-level timings for queries running in the dedicated SQL pool. SQL Data Sync (A) is incorrect because it is a data synchronization service for Azure SQL Database and SQL Managed Instance, not a query performance monitoring tool for Synapse dedicated SQL pools. Azure Policy (B) is incorrect because it enforces governance and compliance rules on resources, not query performance analysis. Azure Advisor (C) is incorrect because it provides general best-practice recommendations (cost, reliability, performance) at the resource level, not detailed query-level monitoring or analysis for dedicated SQL pools.

Answer

SQL Data Sync

Answer

Azure Policy

Answer

Azure Advisor

Question 8

Your company uses Azure Databricks for data processing. You need to ensure that spark jobs cannot access certain storage accounts. What is the most secure approach?

Accepted Answer

Use Azure RBAC to grant specific storage account permissions to the Azure Databricks managed identity.. Using Azure RBAC to grant specific storage account permissions to the Azure Databricks managed identity is the most secure approach because it eliminates the need to store or transmit storage account keys, and it enforces least-privilege access through Microsoft Entra ID identities. The managed identity is automatically managed by Azure, so credentials are rotated and never exposed to notebooks or code. This aligns with the principle of avoiding long-lived secrets and centralizing access control.

Answer

Store storage account keys in Azure Key Vault and retrieve them in notebooks.

Answer

Use shared access keys and restrict their usage.

Answer

Disable public network access on storage accounts.

Question 9

You need to ensure that data stored in Azure Data Lake Storage Gen2 is encrypted at rest using customer-managed keys. Which Azure service should you use to manage the keys?

Accepted Answer

Azure Key Vault. Azure Key Vault is the service used to store and manage customer-managed keys (CMK) for Azure Storage encryption at rest. You create a key in Key Vault (or Managed HSM) and configure the storage account to use that key via the encryption settings, enabling CMK.

Answer

Microsoft Purview

Answer

Azure Confidential Computing

Answer

Microsoft Entra ID

Question 10

You have an Azure Data Factory pipeline that uses a Self-Hosted Integration Runtime (SHIR) to copy data from an on-premises Oracle database to Azure Blob Storage. The pipeline is failing with a connectivity error. You have verified that the SHIR is running and the network firewall allows outbound traffic to Azure. What is the most likely cause of the failure?

Accepted Answer

The SHIR cannot reach the Oracle database due to a network firewall.. The most likely cause is that the SHIR cannot reach the on-premises Oracle database due to a network firewall. While the SHIR can connect to Azure outbound, the connection from the SHIR to the Oracle database must also be allowed through any on-premises firewalls. Option A is incorrect because if the SHIR were not registered, you would see a different error. Option C is incorrect because the SHIR only requires outbound connectivity to Azure, not inbound. Option D is incorrect because Azure Key Vault is not required for basic connectivity; it is used for storing credentials.

Answer

The SHIR is not registered with Azure Data Factory.

Answer

The SHIR requires inbound port 443 from Azure to on-premises.

Answer

The SHIR does not have access to Azure Key Vault.

Question 11

You are designing a data processing solution using Azure Synapse Analytics serverless SQL pool. The solution will query data stored in Parquet files in Azure Data Lake Storage Gen2. You need to ensure that the queries are optimized for performance. Which action should you take?

Accepted Answer

Partition the Parquet files by date and use partition pruning in the query.. In Azure Synapse serverless SQL pool, performance is dominated by how much data must be read from storage, since there is no persistent compute or indexing. Partitioning Parquet files by date and filtering on the partition column enables partition pruning, so the engine reads only the relevant folders instead of scanning the entire dataset. This dramatically reduces I/O and query time, making D the correct optimization.

Answer

Increase the MAXDOP setting in the query.

Answer

Convert the Parquet files to CSV format for faster parsing.

Answer

Create materialized views on the external tables.

Question 12

You need to monitor the performance of your Azure Synapse Analytics dedicated SQL pool. Which metric should you use to identify queued queries due to concurrency limits?

Accepted Answer

Queued queries. The 'Queued queries' metric in Azure Synapse Analytics dedicated SQL pool specifically counts queries waiting for resources due to concurrency limits, making it the direct indicator of queuing caused by insufficient concurrency slots. Monitoring this metric helps identify when the workload exceeds available concurrency and queries are being held in the queue.

Answer

DWU percentage

Answer

Active queries

Answer

Memory percentage

Question 13

Which THREE components are valid parts of the Microsoft Purview Data Map? (Choose THREE)

Accepted Answer

Scan rule sets. In Microsoft Purview Data Map, scan rule sets (A) are valid components because they define which file types and system types are scanned and which classification rules are applied during a scan. Data sources (D) are valid because the Data Map registers and stores metadata about sources such as Azure SQL Database, SQL Server, and Microsoft Fabric, which are then scanned and cataloged. Classifications (E) are valid because they are the built-in or custom classification definitions (for example, credit card number or passport number) that scans use to tag assets in the Data Map. Sensitivity labels (B) are not a Data Map component; they belong to Microsoft Purview Information Protection and are applied to content, not to the Data Map's scanning/cataloging structure. Data flows (C) are not a Data Map component either; data flows are associated with Azure Data Factory/Synapse pipelines rather than the Purview Data Map's scanning and metadata model.

Answer

Sensitivity labels

Answer

Data flows

Question 14

You are reviewing the ARM template snippet for an Azure Data Lake Storage Gen2 account. The template fails to deploy with an error that the encryption key cannot be accessed. What is the most likely cause?

Accepted Answer

The Data Lake Storage account does not have Get and Wrap Key permissions on the key vault.. When an ARM template configures customer-managed keys for Azure Data Lake Storage Gen2, the storage account's system-assigned or user-assigned managed identity must have Get, Wrap Key, and Unwrap Key permissions on the key vault. The error 'encryption key cannot be accessed' almost always indicates the access policy or RBAC role assignment is missing these permissions, so the storage service cannot retrieve the key. Soft-delete, key name/version, and URI formatting would produce different, more specific errors.

Answer

The key vault does not have soft-delete enabled.

Answer

The key name or version is incorrect.

Answer

The key vault URI is incorrectly formatted.

Question 15

Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to implement a security strategy that allows users to read only specific folders within a container. Which authorization method should you use?

Accepted Answer

Access control lists (ACLs) on the folder. ACLs (Access Control Lists) in Azure Data Lake Storage Gen2 can be applied to individual folders, enabling granular read permissions. Option A is incorrect because a storage account shared key grants full access to the entire account. Option B is incorrect because Azure RBAC roles like Storage Blob Data Contributor apply at the container level, affecting all folders within. Option C is incorrect because shared access signatures (SAS) can be scoped to a container or a file, but not to a specific folder within a container.

Answer

Storage account shared key

Answer

Azure RBAC roles (e.g., Storage Blob Data Contributor) at the container level

Answer

Shared access signatures (SAS) with folder-level permissions