DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 3 — 15 Questions

Question 1

Your Azure Data Factory pipeline uses Copy Activity to ingest data from Azure Blob Storage to Azure Synapse Analytics. You need to minimize network latency and data transfer costs. Which data integration approach should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Azure integration runtime in the same region as the data stores. Using Azure IR in the same region as the source and sink ensures data movement stays within Azure backbone, minimizing egress costs. Option A (staging) adds cost due to an extra hop. Option B (PolyBase) loads directly but still requires the Azure IR for orchestration. Option C (self-hosted IR) is designed for on-premises or private network scenarios, not optimized for cloud-to-cloud transfers in the same region.

Answer

Use a staging copy with Azure Blob as intermediate

Answer

Use PolyBase to load data directly from Blob Storage

Answer

Use a self-hosted integration runtime in the same region

Question 2

You need to secure access to an Azure Storage account that hosts sensitive data. Which TWO methods provide encryption in transit?

Accepted Answer

Enforce HTTPS for REST API calls. HTTPS and SMB over encryption ensure data is encrypted in transit. Option A (SSE) is at rest. Option D (Azure Disk Encryption) is for VMs. Option E (IPSec) is not supported by Azure Storage directly.

Answer

Enable Azure Storage Service Encryption (SSE)

Answer

Enable Azure Disk Encryption on client VMs

Answer

Configure an IPsec policy between clients and storage

Question 3

Your organization uses Azure Synapse Analytics dedicated SQL pool. You need to ensure that all data at rest in the SQL pool is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault provides the required encryption for data at rest in Azure Synapse Analytics dedicated SQL pool. Option A is wrong because Always Encrypted protects data in transit and at rest in application logic, not at rest in the database. Option B is wrong because Dynamic Data Masking does not encrypt data; it obfuscates it for users. Option C is wrong because Azure Storage Service Encryption is for Azure Storage accounts, not for SQL pools.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Answer

Configure Dynamic Data Masking to obfuscate sensitive data.

Answer

Enable Azure Storage Service Encryption with a customer-managed key.

Question 4

You are designing a data processing solution in Azure Databricks that uses Unity Catalog. The security team requires that all users authenticate using Microsoft Entra ID and that access to tables is governed by attribute-based access control (ABAC) using table tags. Which feature should you enable?

Accepted Answer

Table tags with access control lists (ACLs) in Unity Catalog. [CORRECT]. In Unity Catalog, attribute-based access control (ABAC) is implemented through table tags combined with access control lists (ACLs). Table tags allow data to be classified, and ACLs can then be configured based on those tags to enforce attribute-based access. This directly satisfies the requirement of using table tags for ABAC. Option B (dynamic views with user context functions) can provide similar controls but does not inherently leverage table tags and is not the dedicated ABAC feature in Unity Catalog.

Answer

Column-level security masks. [wrong]

Answer

Dynamic views with user context functions. [wrong]

Answer

Row-level security filters. [wrong]

Question 5

You have an Azure Databricks workspace that uses a managed resource group. The security team requires that all cluster nodes use no public IP addresses and that all outbound traffic goes through a firewall. What should you configure?

Accepted Answer

Deploy the workspace in a VNet with forced tunneling enabled and a firewall.. Deploying the Azure Databricks workspace in a VNet with forced tunneling enabled and a firewall ensures that cluster nodes have no public IP addresses and all outbound traffic is routed through the firewall. Option A is incorrect because service endpoints do not prevent public IPs on cluster nodes. Option C is incorrect because NSGs alone do not force traffic through a firewall; forced tunneling requires a route table with default route to the firewall. Option D is incorrect because Azure Private Link only provides private connectivity to the workspace, but does not control outbound traffic from cluster nodes.

Answer

Configure service endpoints for Azure Storage and Azure Data Lake Storage.

Answer

Apply network security groups (NSGs) to the subnet that restrict outbound traffic.

Answer

Enable Azure Private Link for the Databricks workspace.

Question 6

Refer to the exhibit. You are creating an Azure Storage account using an ARM template with the above snippet. After deployment, a security auditor reviews the configuration and notes that the storage account is not using a customer-managed key for encryption. What is the most likely reason?

Accepted Answer

The 'keyVersion' is missing a specific version, so Azure Storage defaults to Microsoft-managed key.. In the ARM template snippet, the 'keyVersion' property is empty. Azure Storage requires a specific key version to use a customer-managed key; if omitted, Azure defaults to Microsoft-managed keys if the key is not found or the vault is inaccessible. Option B is incorrect because 'keySource' should be 'Microsoft.Keyvault' for customer-managed keys, not 'Microsoft.Storage'. Option C is incorrect because infrastructure encryption (double encryption) is independent of the key source. Option D is incorrect because enabling 'infrastructureEncryption' does not override the key source; it can be used with customer-managed keys.

Answer

The 'keySource' should be 'Microsoft.Storage' for customer-managed key.

Answer

The storage account requires double encryption to use customer-managed key.

Answer

The 'infrastructureEncryption' setting is enabled, which overrides customer-managed key.

Question 7

You are monitoring an Azure Synapse Analytics dedicated SQL pool and notice that some queries are taking longer than expected. You need to identify queries that are experiencing significant memory pressure. Which dynamic management view (DMV) should you query?

Accepted Answer

sys.dm_pdw_exec_requests. Sys.dm_pdw_exec_requests provides information about queries including their memory grant size, which can be used to identify queries experiencing memory pressure. Option B is incorrect because sys.dm_pdw_wait_stats shows wait statistics, not memory pressure. Option C is incorrect because sys.dm_pdw_query_stats_xe is for extended events, not directly for memory grants. Option D is incorrect because sys.dm_pdw_nodes_os_performance_counters shows OS-level performance counters, not query-level memory information.

Answer

sys.dm_pdw_wait_stats

Answer

sys.dm_pdw_query_stats_xe

Answer

sys.dm_pdw_nodes_os_performance_counters

Question 8

You have an Azure Stream Analytics job that writes output to Azure Synapse Analytics. You need to ensure that the job can authenticate to Synapse Analytics using a managed identity. What should you do?

Accepted Answer

Enable system-assigned managed identity on the Stream Analytics job and configure the output to use it.. To authenticate to Azure Synapse Analytics using a managed identity, you should enable the system-assigned managed identity on the Stream Analytics job (it is enabled by default) and then configure the output to use managed identity authentication. Option A is correct. Option B is incorrect because a SAS token is not a managed identity. Option C is incorrect because while a user-assigned managed identity could be used, the system-assigned managed identity is sufficient and is the simpler option. Option D is incorrect because SQL Server authentication does not use managed identity and is less secure than managed identity authentication.

Answer

Generate a shared access signature (SAS) token for the Synapse Analytics workspace.

Answer

Create a user-assigned managed identity and assign it to the Stream Analytics job.

Answer

Configure the output to use SQL Server authentication with a username and password.

Question 9

Your team uses Azure Data Factory to orchestrate data movement. You need to monitor pipeline runs and set up alerts when a pipeline fails more than three times in an hour. What is the most efficient approach?

Accepted Answer

Create an Azure Monitor metric alert for the 'Failed pipeline runs' metric with a threshold of 3 in 1 hour.. Azure Monitor alerts can be configured based on metrics like Failed pipeline runs with a threshold of 3 in 1 hour. Option A is wrong because Alert rules in Data Factory are limited. Option B is wrong because diagnostic settings send logs to Log Analytics, but you would need to create a log alert, which is less efficient than a metric alert. Option C is wrong because a logic app is not the most efficient for simple threshold alerts.

Answer

Create an alert rule in Azure Data Factory based on the 'Failed pipeline runs' metric.

Answer

Configure diagnostic settings to send logs to Log Analytics and create a log alert.

Answer

Use a Logic App to periodically check the pipeline run status and send notifications.

Question 10

You are optimizing the performance of an Azure Synapse Analytics dedicated SQL pool. Which TWO actions can help reduce data movement during query execution?

Accepted Answer

Use replicated tables for small dimension tables.. Options B and E are correct. Using replicated tables for small dimension tables avoids data movement during joins because the table is copied to all distributions. Distributing fact tables on the join key columns ensures that matching rows are co-located, reducing shuffling. Option A is incorrect: using hash distribution on a column not used in joins increases data movement because data is redistributed unnecessarily. Option C is incorrect: round-robin distribution distributes rows evenly but often requires data movement for joins. Option D is incorrect: increasing the resource class allocates more resources but does not directly reduce data movement.

Answer

Use hash distribution on a column that is not used in joins.

Answer

Use round-robin distribution for large fact tables.

Answer

Increase the resource class for the loading user.

Question 11

You need to secure access to an Azure Data Lake Storage Gen2 account. Which THREE methods can you use to authenticate and authorize access?

Accepted Answer

Shared access signatures (SAS).. Shared access signatures (SAS), access control lists (ACLs), and Azure RBAC roles are all valid methods to authenticate and authorize access to Azure Data Lake Storage Gen2. SAS tokens provide delegated access, ACLs control permissions at the file/directory level, and RBAC roles provide role-based permissions at the storage account or container level. SQL connection strings are used for Azure SQL Database, not ADLS Gen2. Managed identities are identities, not authorization methods; they can be used with RBAC but are not a direct method themselves.

Answer

SQL connection strings.

Answer

Managed identities.

Question 12

You are monitoring the performance of an Azure Data Factory pipeline that uses a Copy activity to load data into Azure Synapse Analytics. Which THREE metrics should you monitor to identify potential performance bottlenecks?

Accepted Answer

Throughput (data read/written per second).. Options A, D, and E are correct. Throughput (data read/written per second), Copy activity duration, and Data read and written metrics are direct indicators of performance bottlenecks in the Copy activity. Option B is incorrect because Integration runtime CPU utilization is not a standard metric exposed by Azure Data Factory for monitoring Copy activity performance; it reflects runtime resource usage but not directly the data transfer performance. Option C is incorrect because Pipeline run duration includes overhead from orchestration, such as pipeline activity scheduling and coordination, and is not a precise measure of the Copy activity's data transfer performance.

Answer

Integration runtime CPU utilization.

Answer

Pipeline run duration.

Question 13

Refer to the exhibit. You are reviewing the workload classifier configuration for an Azure Synapse Analytics dedicated SQL pool. You notice that the 'HeavyLoader' classifier has a queryExecutionTimeoutSeconds of 0. What is the implication of this setting?

Accepted Answer

Queries classified as 'HeavyLoader' will not have a timeout.. When queryExecutionTimeoutSeconds is set to 0, it means no timeout is enforced. Queries classified as 'HeavyLoader' can run indefinitely without being terminated by the timeout mechanism. Option A is incorrect because a value of 0 does not mean indefinite waiting for resources; it refers to the timeout duration. Option B is incorrect; 0 is a valid configuration that disables the timeout. Option D is incorrect; a timeout of 0 does not cause immediate timeout but rather no timeout.

Answer

Queries classified as 'HeavyLoader' will wait indefinitely for resources.

Answer

The configuration is invalid; queryExecutionTimeoutSeconds must be greater than 0.

Answer

Queries classified as 'HeavyLoader' will timeout immediately.

Question 14

Refer to the exhibit. You are configuring an Azure Purview data policy for Azure Storage. The policy above is intended to audit all access events. However, the security team complains that not all read events are being audited. What is the most likely reason?

Accepted Answer

The storage account is not enabled for Purview policy enforcement.. The security team reports that not all read events are being audited. The policy uses 'ALL_ACTIONS' which should include read events, so the issue is not with the action group or predicate. The most likely reason is that the storage account has not been enabled for Purview policy enforcement. Azure Purview requires the 'AllowPurviewPolicyEnforcement' property to be enabled on the storage account for policies to take effect. Without this, no auditing events are captured, even if the policy is correctly defined.

Answer

The filter predicate is set to 'true', which only captures a subset of events.

Answer

The action group 'ALL_ACTIONS' does not include read events.

Answer

The policy excludes the 'Read' action by default.

Question 15

You have an Azure Synapse Analytics serverless SQL pool. You need to monitor the number of queries that are currently executing. Which dynamic management view should you query?

Accepted Answer

sys.dm_exec_requests. Sys.dm_exec_returns detailed information about each request currently executing on the serverless SQL pool, including its state, command, and session ID. This DMV is specifically designed for monitoring active queries.

Option A (sys.dm_resource_governor_workload_groups) shows workload group configuration and resource statistics, not current requests.

Option B (sys.dm_exec_query_stats) provides cumulative performance statistics for cached query plans, not currently executing queries.

Option D (sys.dm_exec_sessions) contains session-level information but does not indicate which sessions are actively executing a request.

Answer

sys.dm_resource_governor_workload_groups

Answer

sys.dm_exec_query_stats

Answer

sys.dm_exec_sessions