DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 20 — 15 Questions

Question 1

You are monitoring Azure Stream Analytics job performance. The job is falling behind in processing real-time data. You notice that the SU (Streaming Unit) utilization is consistently at 90% or higher. What is the most appropriate action to improve throughput?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the number of Streaming Units (SUs). Streaming Unit (SU) utilization consistently at 90% or higher indicates the job is resource-constrained. Increasing the number of SUs allocates more compute resources, which can improve throughput and reduce backlog. This is the most direct and appropriate action to scale the job.

Answer

Change the output to use a partition scheme

Answer

Reduce the window duration in the query

Answer

Decrease the event ordering tolerance

Question 2

You are troubleshooting an Azure Databricks job that writes data to Azure Data Lake Storage Gen2. The job fails with '403 Forbidden' error. The Databricks workspace uses a managed identity (system-assigned) for authentication. What should you verify?

Accepted Answer

The managed identity has 'Storage Blob Data Contributor' role assigned to the storage account. The 403 Forbidden error indicates that authentication succeeded but authorization failed. For a managed identity to write data to Azure Data Lake Storage Gen2, it must be assigned the 'Storage Blob Data Contributor' RBAC role on the storage account. This role grants read, write, and delete permissions for blobs and directories. Without this role assignment, the managed identity cannot write data, resulting in a 403 error. Even if the storage account name is correct (A), the firewall is configured (B), or a private endpoint exists (C), the missing RBAC role assignment will cause the failure.

Answer

The storage account name is correct

Answer

The storage account firewall is configured to allow Azure services

Answer

A private endpoint is configured between Databricks and the storage account

Question 3

Which TWO actions should you take to secure sensitive data in Azure Data Lake Storage Gen2? (Choose two.)

Accepted Answer

Use access control lists (ACLs) to restrict access to specific directories. Option B is correct because Azure Data Lake Storage Gen2 supports POSIX-style access control lists (ACLs) that let you grant or deny read/write/execute permissions at the directory and file level, which is essential for least-privilege access to sensitive data. Option E is correct because enabling encryption at rest with customer-managed keys stored in Azure Key Vault gives you control over the key lifecycle and satisfies compliance requirements for protecting sensitive data at rest. Option A is wrong because enabling public network access from all networks exposes the storage account to the internet and increases attack surface. Option C is wrong because allowing anonymous access permits unauthenticated reads and is a security risk, not a protection measure. Option D is wrong because disabling soft delete removes a recovery safeguard and does nothing to secure sensitive data.

Answer

Enable public network access from all networks for ease of use

Answer

Allow anonymous access to enable sharing

Answer

Disable soft delete to prevent accidental retention of deleted data

Question 4

You are monitoring an Azure Data Factory pipeline that runs hourly. The pipeline executes a stored procedure in an Azure SQL Database. Recently, you have observed that the pipeline occasionally fails with a 'Deadlock' error when the stored procedure runs. The Azure SQL Database is configured with the 'Read Committed Snapshot' isolation level enabled. You need to resolve the deadlock issue with minimal impact on performance. The stored procedure updates multiple tables in a single transaction and is critical for reporting. What should you do?

Accepted Answer

Add retry logic in the Data Factory pipeline for the stored procedure activity. Adding retry logic in the Data Factory pipeline for the stored procedure activity is the least invasive fix. Deadlocks are transient by nature — SQL Server chooses a victim and rolls back its transaction — so retrying the activity typically succeeds on the next attempt without changing isolation levels or query semantics.

Answer

Change the stored procedure to use NOLOCK hints

Answer

Remove the transaction from the stored procedure

Answer

Disable the 'Read Committed Snapshot' isolation level

Question 5

You are responsible for managing an Azure Data Lake Storage Gen2 account that stores parquet files for analytics. You need to implement a data retention policy that automatically deletes files older than 90 days in the 'logs' container. Additionally, you need to ensure that no data is lost due to accidental deletion; you want to be able to recover deleted files within 30 days. You also need to monitor the storage account for unusual access patterns. The solution must minimize administrative effort. What should you do?

Accepted Answer

Enable soft delete with a retention period of 30 days and configure a lifecycle management rule to delete blobs older than 90 days. Enabling soft delete with a 30-day retention period allows recovery of accidentally deleted blobs within that window. A lifecycle management rule automatically deletes blobs older than 90 days, meeting the retention policy with minimal administrative effort.

Answer

Create an Azure Policy to enforce tag-based retention and use Azure Monitor to alert on access

Answer

Enable versioning and configure a retention policy in Azure Policy

Answer

Use Azure Backup for the storage account and manually delete old files

Question 6

You are configuring Azure Data Lake Storage Gen2 for a new data lake. You need to ensure that all data written to the 'raw' container is automatically encrypted at rest. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption (SSE). Azure Storage Service Encryption (SSE) is the feature that automatically encrypts data at rest in Azure Storage, including ADLS Gen2. It is enabled by default for all storage accounts and uses 256-bit AES encryption, ensuring that all data written to the 'raw' container is encrypted without any application changes. This directly satisfies the requirement for automatic encryption at rest.

Answer

Azure Key Vault

Answer

Azure Disk Encryption

Answer

Azure Purview

Question 7

Your Azure Synapse Analytics dedicated SQL pool is experiencing performance degradation. Queries that previously completed in seconds now take minutes. You notice high queue wait times in sys.dm_pdw_exec_requests. What is the most likely cause?

Accepted Answer

Concurrency throttling due to insufficient resources. High queue wait times in sys.dm_pdw_exec_requests typically indicate that queries are waiting for resources due to concurrency limits. In Azure Synapse dedicated SQL pools, each DWU level supports a fixed number of concurrent queries and slots; when the number of concurrent queries exceeds this limit, additional queries are queued. Therefore, the most likely cause is concurrency throttling due to insufficient resources, making option C correct.

Answer

Outdated statistics

Answer

A single long-running query blocking others

Answer

Data skew in distribution

Question 8

You have an Azure Data Factory pipeline that loads data from an on-premises SQL Server to Azure Synapse Analytics. The pipeline fails intermittently with network connectivity errors. You need to ensure reliable data transfer with minimal latency. Which solution should you recommend?

Accepted Answer

Deploy a self-hosted IR with high availability on two nodes. A self-hosted Integration Runtime (IR) is required for Azure Data Factory to reach on-premises SQL Server, and deploying it with high availability across two nodes eliminates the single point of failure causing intermittent connectivity errors. The self-hosted IR runs inside the corporate network, so it uses the existing network path rather than requiring new VPN infrastructure, and HA mode ensures failover if one node goes down. This directly addresses both reliability and minimal latency.

Answer

Set up a site-to-site VPN gateway

Answer

Stage data in Azure Blob Storage using sharded files

Answer

Use an Azure Integration Runtime instead

Question 9

Your Azure Synapse Analytics workspace uses serverless SQL pools for ad-hoc querying. Users report that queries are slow. You examine the execution plan and see that the query scans multiple partitions in the openrowset. What is the best way to improve performance?

Accepted Answer

Add a WHERE clause on the partition column. In serverless SQL pools, partition elimination only occurs when the query includes a filter predicate on the partition column. Adding a WHERE clause on the partition column lets the engine skip irrelevant partitions in the OPENROWSET scan, dramatically reducing I/O and query time. Without that predicate, the engine must scan every partition even if the data is partitioned.

Answer

Increase the MAXDOP setting

Answer

Create materialized views on the external tables

Answer

Partition the underlying data by a frequently filtered column

Question 10

You are using Azure Purview to scan an Azure Data Lake Storage Gen2 account. After scanning, you notice that some files are not classified. What is the most likely reason?

Accepted Answer

The file types are not included in the scan rule set. Azure Purview scans use a scan rule set that defines which file types are included for classification. If a file's extension or type is not listed in the rule set, Purview skips classification for that file even though the scan completes. This is the most common reason specific files remain unclassified after a successful scan.

Answer

The storage account is not registered in Purview

Answer

The files are in Parquet format

Answer

The classification rules are disabled

Question 11

You have an Azure Data Lake Storage Gen2 account that stores sensitive customer data. You need to prevent data exfiltration to unauthorized external IP addresses. Which TWO actions should you take?

Accepted Answer

Use private endpoints for the storage account. Option A is correct because private endpoints assign the storage account a private IP address inside your virtual network via Azure Private Link, so traffic to the account never traverses the public internet and cannot be reached from unauthorized external IP addresses. Option D is correct because configuring the storage account firewall (network rules) to allow only specific virtual networks restricts access to those trusted VNets and blocks all other public IPs, directly preventing exfiltration to unauthorized external addresses. Option B is incorrect because Azure Firewall is a network security service deployed in a virtual network or hub, not a feature you enable on a storage account. Option C is incorrect because SAS tokens grant scoped access to data but do not by themselves block outbound exfiltration to arbitrary external IP addresses. Option E is incorrect because geo-redundant storage only replicates data across regions for durability and availability, and has no role in controlling network access or preventing exfiltration.

Answer

Enable Azure Firewall on the storage account

Answer

Use shared access signatures (SAS) with limited permissions

Answer

Enable geo-redundant storage (GRS)

Question 12

Your organization has an Azure Synapse Analytics dedicated SQL pool that stores sensitive customer data. You need to ensure that only authorized users can access the data, and auditing must be enabled to track all access attempts. What should you do first?

Accepted Answer

Configure Microsoft Entra ID authentication and use RBAC to grant only necessary permissions.. Before implementing column-level security, dynamic data masking, or auditing, you must first establish who the authorized users are by configuring Microsoft Entra ID authentication and applying RBAC to grant only the necessary permissions. This foundational identity and access control step ensures that subsequent security features (masking, column-level security, auditing) operate against a properly authenticated and authorized user base.

Answer

Implement column-level security to restrict sensitive columns.

Answer

Enable auditing on the SQL pool and configure a storage account for audit logs.

Answer

Apply dynamic data masking to the sensitive columns.

Question 13

You have an Azure Data Factory pipeline that copies data from an FTP server to Azure Blob Storage. The pipeline runs successfully most of the time, but occasionally fails with a 'FTP server connection refused' error during peak hours. You need to minimize these failures with minimal cost. What should you do?

Accepted Answer

Add a retry policy to the copy activity with a backoff interval.. A retry policy with a backoff interval on the copy activity handles transient 'connection refused' errors during peak hours by automatically reattempting after a delay, smoothing over temporary FTP server saturation. It is the lowest-cost, least-invasive fix and directly targets intermittent failures without infrastructure changes.

Answer

Set up Azure ExpressRoute to improve network reliability.

Answer

Migrate the FTP server to SFTP.

Answer

Increase the parallel copy count in the copy activity.

Question 14

Which THREE measures should you implement to monitor and optimize the performance of Azure Data Lake Storage Gen2?

Accepted Answer

Enable Storage Insights to monitor capacity and transactions.. Option B is correct because Azure Storage Insights (part of Azure Monitor) provides built-in dashboards for monitoring ADLS Gen2 capacity, transactions, latency, and availability metrics, which is essential for tracking and optimizing storage performance. Option D is correct because Storage Analytics logging captures detailed per-request records (including latency, request rate, and operation type) for blob and Data Lake Gen2 endpoints, enabling granular performance analysis. Option E is correct because Azure Monitor diagnostic settings route resource logs (such as StorageRead, StorageWrite, and StorageDelete) and metrics to Log Analytics, Event Hubs, or Storage, allowing you to query read/write request patterns and diagnose performance bottlenecks. Option A is not correct because NSG flow logs capture IP-level network traffic metadata for security and connectivity troubleshooting, not storage performance or capacity metrics. Option C is not correct because lifecycle management policies optimize cost by tiering or deleting data based on age, not by monitoring or optimizing performance.

Answer

Enable Network Security Group flow logs for the storage account subnet.

Answer

Configure lifecycle management policies to move cold data to archive tier.

Question 15

Which TWO configurations are recommended to secure data processing in Azure Synapse Pipelines?

Accepted Answer

Store connection strings and secrets in Azure Key Vault and reference them via linked services.. Storing connection strings and secrets in Azure Key Vault and referencing them via linked services ensures secrets are stored securely and not exposed in pipeline definitions. Option D is correct: Enabling Managed Virtual Network (VNet) isolates data flows within a managed network boundary, preventing public network access. Option A is incorrect: Configuring a self-hosted integration runtime on a public cloud VM does not necessarily improve security; it may expose the runtime to the public internet. Option B is incorrect: Using the default Auto-resolve Integration Runtime is not recommended for secure data processing because it may use public endpoints and lacks network isolation. Option E is incorrect: Allowing all public IP addresses to access the Azure Synapse workspace exposes the workspace to potential security threats.

Answer

Configure a self-hosted integration runtime on a public cloud VM.

Answer

Use the default Auto-resolve Integration Runtime for all data flows.

Answer

Allow all public IP addresses to access the Azure Synapse workspace.