DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 2 — 15 Questions

Question 1

Your organization needs to ensure that all data stored in Azure Data Lake Storage Gen2 is encrypted at rest using Microsoft-managed keys. What is the default encryption method?

Accepted Answer

Storage Service Encryption (SSE) with Microsoft-managed keys.. Azure Storage automatically encrypts all data at rest using Storage Service Encryption (SSE) with Microsoft-managed keys by default. Option B is incorrect because Transparent Data Encryption (TDE) is a feature for Azure SQL databases, not for Azure Storage accounts. Option C is incorrect because client-side encryption is not the default; it is an additional option. Option D is incorrect because Azure Disk Encryption is used for encrypting OS and data disks on virtual machines, not for storage accounts.

Answer

Transparent Data Encryption (TDE) on the storage account.

Answer

Client-side encryption with keys stored in Azure Key Vault.

Answer

Azure Disk Encryption on the storage nodes.

Question 2

Your Azure Stream Analytics job is failing to start because the job's storage account is configured to allow access from selected networks. The job uses managed identity for authentication. What should you do to resolve the issue?

Accepted Answer

Add the Stream Analytics job's managed identity as a trusted service in the storage account firewall.. The Stream Analytics job's managed identity must be added as a trusted service to bypass the network restrictions. Option A is wrong because firewall rules apply to all services; managed identity must be explicitly allowed. Option B is wrong because private endpoints require additional configuration and are not required. Option D is wrong because SAS tokens are not needed with managed identity.

Answer

Create a private endpoint for the Stream Analytics job to access the storage account.

Answer

Disable the firewall on the storage account to allow all networks.

Answer

Generate a SAS token for the storage account and configure the job to use it.

Question 3

You are responsible for securing an Azure Synapse Analytics workspace. The workspace is integrated with a Git repository for source control. You need to ensure that only authorized users can publish changes from the Git branch to the live Synapse service. What should you configure?

Accepted Answer

Assign the 'Synapse Artifact Publisher' role to specific users in the Synapse RBAC.. To control who can publish changes from a Git branch to the live Synapse service, you use Synapse RBAC. The 'Synapse Artifact Publisher' role grants permission to publish artifacts. This role can be assigned to specific users or groups. Option A is correct. Option B is wrong because Git branch permissions control repository merge operations, not publishing to Synapse. Option C is wrong because Azure Policy enforces compliance rules, not fine-grained access control for publishing. Option D is wrong because Microsoft Entra ID Conditional Access policies manage authentication conditions, not specific publish permissions.

Answer

Use Microsoft Entra ID Conditional Access policies to require multi-factor authentication for publishing.

Answer

Create an Azure Policy to deny publishing if the user is not in an approved group.

Answer

Configure branch permissions in the Git repository to restrict who can merge to the collaboration branch.

Question 4

Which TWO Azure services can you use to monitor data processing pipelines in Azure Data Factory?

Accepted Answer

Log Analytics workspace. Azure Monitor is the primary monitoring service for Azure resources, providing metrics, alerts, and diagnostics for Azure Data Factory pipelines. Log Analytics workspace enables querying and analyzing pipeline run logs, which is essential for deep monitoring and troubleshooting. Azure Sentinel (A) is a SIEM for security, not pipeline monitoring. Azure Dashboard (C) is a visualization tool that can display metrics but is not a monitoring service itself. Azure Service Health (D) tracks Azure platform health, not individual pipeline runs.

Answer

Azure Sentinel

Answer

Azure Dashboard

Answer

Azure Service Health

Question 5

You are designing a data processing solution using Azure Databricks. The solution must use Delta Lake for ACID transactions and must optimize storage costs by automatically compacting small files. Which feature should you enable?

Accepted Answer

Enable auto-optimize on the Delta table.. Delta Lake's auto-optimize feature automatically compacts small files during writes. Option A is wrong because OPTIMIZE is a manual command that requires scheduling; it is not automatic. Option B is wrong because vacuum is used to clean up old files, not to compact small files. Option C is wrong because Z-order indexing improves data skipping for queries but does not perform file compaction.

Answer

Run OPTIMIZE command in a scheduled job.

Answer

Set retention duration for vacuum to 7 days.

Answer

Enable Z-order indexing on the Delta table.

Question 6

You are designing a data processing solution in Azure Synapse Analytics. The solution must ensure that sensitive columns containing personally identifiable information (PII) are masked at query time for users without explicit permissions. Which Azure Synapse Analytics feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct feature because it obfuscates sensitive data in query results for users without the UNMASK permission. Option A (Row-Level Security) is incorrect because it restricts rows based on user identity, not columns. Option B (Transparent Data Encryption) is incorrect because it encrypts the entire database at rest, not at query time. Option C (Dynamic Data Masking) is correct as described. Option D (Always Encrypted) is incorrect because it protects data at rest and in transit but requires client-side changes.

Answer

Row-Level Security

Answer

Transparent Data Encryption

Answer

Always Encrypted

Question 7

You are optimizing an Azure Synapse Analytics dedicated SQL pool. The pool has a large fact table distributed by hash on CustomerID. Most queries filter on OrderDate. You need to improve query performance for date-range queries without changing the distribution. What should you do?

Accepted Answer

Partition the table on OrderDate. Partitioning the table on OrderDate enables partition elimination, which significantly reduces the amount of data scanned for date-range queries, improving performance without altering the distribution. Option A is incorrect because changing to round-robin distribution would increase data movement during joins and aggregations. Option B is incorrect because materialized views are pre-aggregated and not optimized for row-level date filtering; they involve storage and maintenance overhead. Option D is incorrect because non-clustered indexes can be used in dedicated SQL pool but are not as effective as partition elimination for large fact tables scanned sequentially, and they require additional storage and maintenance.

Answer

Change the distribution to round-robin on OrderDate

Answer

Create a materialized view on OrderDate

Answer

Create a non-clustered index on OrderDate

Question 8

Which TWO actions should you take to secure data at rest in Azure Data Lake Storage Gen2?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) for data at rest. To secure data at rest in Azure Data Lake Storage Gen2, enable Azure Storage Service Encryption (SSE) for automatic encryption of stored data, and use Azure RBAC to enforce least privilege access to the storage account. SSE protects data at rest at the storage layer, while RBAC controls who can access the data, preventing unauthorized access. Option B (diagnostic settings) is for auditing, not encryption. Option C (firewall rules) is network-level security. Option D (soft delete) is for recovery, not data-at-rest protection. Thus, the correct answers are A and E.

Answer

Enable diagnostic settings to audit access

Answer

Configure firewall rules to restrict network access

Answer

Enable soft delete for blobs

Question 9

You are optimizing an Azure Synapse Analytics dedicated SQL pool. The pool experiences high concurrency and frequent data skew. Which indexing strategy should you recommend to improve query performance for large fact tables?

Accepted Answer

Use round-robin distributed tables with clustered columnstore indexes.. Round-robin distribution spreads data evenly across distributions, minimizing data skew in high-concurrency scenarios. Clustered columnstore indexes provide high compression and query performance for large fact tables. Option A is incorrect because hash-distributed tables can still suffer from skew if the distribution column is poorly chosen. Option C is incorrect because replicated tables are best for small dimension tables, not large fact tables. Option D is incorrect because heap tables lack indexing and are typically used for staging, not optimized for querying large fact tables.

Answer

Use hash-distributed tables with clustered columnstore indexes.

Answer

Use replicated tables with clustered indexes.

Answer

Use heap tables with non-clustered indexes.

Question 10

You need to monitor the health of your Azure Data Lake Storage Gen2 account. Which metric should you use to track the number of successful and failed requests?

Accepted Answer

Transactions.. Transactions metric tracks all requests. Option B is wrong because Success E2E Latency measures latency, not count. Option C is wrong because Blob Capacity measures storage size. Option D is wrong because Ingress is about data incoming, not request count.

Answer

Success E2E Latency.

Answer

Blob Capacity.

Answer

Ingress.

Question 11

You are designing a data processing solution using Azure Stream Analytics. You need to ensure that the output to Azure SQL Database is optimized to minimize the number of write operations. Which output configuration should you use?

Accepted Answer

Use a windowed aggregation to batch writes.. Using windowed aggregation (e.g., TumblingWindow, HoppingWindow, SlidingWindow) allows Stream Analytics to collect events over a time window and emit the aggregate result as a single row, significantly reducing the number of write operations to the SQL Database. Option A is incorrect because partitioning increases parallelism but does not batch writes; it may even increase write operations if each partition writes separately. Option B is incorrect because the compatibility level does not affect write batching behavior. Option C is incorrect because the event serialization format batch size is used for input deserialization, not for output write batching.

Answer

Use a partitioned output to distribute writes across multiple tables.

Answer

Set the compatibility level to 1.2.

Answer

Increase the event serialization format batch size.

Question 12

Your company uses Azure SQL Database and needs to audit all data modifications, including SELECT operations on sensitive columns, for compliance. Which feature should you enable?

Accepted Answer

Enable SQL auditing and configure to log SELECT operations.. Azure SQL Database auditing captures database events including SELECT statements. Option B is wrong because TDE encrypts data at rest, not audit. Option C is wrong because Azure Defender for SQL provides security alerts but not detailed audit logs. Option D is wrong because vulnerability assessment scans for security issues but does not audit.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable Azure Defender for SQL.

Answer

Enable SQL vulnerability assessment.

Question 13

You are configuring Azure Data Lake Storage Gen2 for a new data lake. You need to ensure that all data written to the 'raw' container is automatically encrypted at rest. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption (SSE). Azure Storage Service Encryption (SSE) is enabled by default for all Azure Storage accounts, including Data Lake Storage Gen2, and encrypts data at rest using AES-256. Option A (Azure Key Vault) is wrong because it is used for managing keys, not the encryption itself. Option B (Azure Disk Encryption) is wrong because it is for VMs, not for storage. Option D (Azure Purview) is wrong because it is for data governance.

Answer

Azure Key Vault

Answer

Azure Disk Encryption

Answer

Azure Purview

Question 14

You are designing access control for Azure Data Lake Storage Gen2. You need to allow a group of data scientists to read and write files in the 'processed' directory but prevent them from deleting files. Which authorization method should you use?

Accepted Answer

Assign the Storage Blob Data Contributor role at the container level and use ACLs to deny delete on the directory. Azure RBAC roles like Storage Blob Data Contributor grant read/write/delete permissions. To differentiate write and delete, you need ACLs that allow read/execute on the container and read/write on the directory, but not delete. Option A (Storage Blob Data Contributor) includes delete. Option B (Storage Blob Delegator) is not a built-in role for data operations. Option D (Storage Blob Data Reader) is read-only, and adding ACLs for write would be complex and not best practice. Option C correctly combines Storage Blob Data Contributor at the container level (which includes delete) but then uses ACLs to explicitly deny delete on the target directory, effectively preventing deletion while allowing read and write.

Answer

Assign the Storage Blob Data Contributor role at the container level

Answer

Assign the Storage Blob Delegator role at the container level

Answer

Assign the Storage Blob Data Reader role and use ACLs to grant write

Question 15

You need to monitor resource usage for an Azure Synapse Analytics dedicated SQL pool. Which dynamic management view (DMV) should you query to see current query execution status?

Accepted Answer

sys.dm_pdw_exec_requests. sys.dm_pdw_exec_requests provides information about all requests currently executing or recently executed in the dedicated SQL pool. Option A (sys.dm_pdw_nodes_db_size) is for database sizes, Option B (sys.dm_pdw_os_performance_counters) is for OS performance counters, Option D (sys.dm_pdw_nodes_resource_usage) is for resource usage.

Answer

sys.dm_pdw_nodes_db_size

Answer

sys.dm_pdw_os_performance_counters

Answer

sys.dm_pdw_nodes_resource_usage