DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 4 — 15 Questions

Question 1

You are using Azure Data Explorer to monitor real-time sensor data. You run the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

To visualize the count of events every 5 minutes over the last hour. The query uses `summarize count()` with `bin(Timestamp, 5m)` to count events in 5-minute intervals and then renders a timechart, effectively visualizing the count of events every 5 minutes over the last hour. Option A is incorrect because detecting anomalies would require functions like `series_decompose_anomalies`. Option B is incorrect because the query does not calculate an average; it counts events. Option D is incorrect because it does not filter by a specific sensor; it aggregates all events.

Answer

To detect anomalies in the sensor data

Answer

To calculate the average value of a numeric column over time

Answer

To filter events from a specific sensor

Question 2

You are reviewing an ARM template that assigns a role. What role is being assigned, and at what scope?

Accepted Answer

Storage Blob Data Contributor at the resource group scope. The roleDefinitionId in the ARM template corresponds to 'Storage Blob Data Contributor' and the scope is set to the resource group. Option A is wrong because the scope is not subscription level. Option B is wrong because the role is not 'Storage Blob Data Reader' (the GUID for that role is different). Option D is wrong because the scope is the resource group, not the storage account.

Answer

Storage Blob Data Owner at the subscription scope

Answer

Storage Blob Data Reader at the resource group scope

Answer

Storage Blob Data Contributor at the storage account scope

Question 3

Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only authorized users can access the data via the serverless SQL endpoint, while minimizing administrative overhead. What should you use?

Accepted Answer

Enable Microsoft Entra ID authentication and grant users permissions via Azure RBAC on the storage account.. For serverless SQL pools in Azure Synapse querying ADLS Gen2, the recommended approach for least-privilege access with minimal admin overhead is to enable Microsoft Entra ID authentication and grant users permissions via Azure RBAC on the storage account. This centralizes identity, supports conditional access and MFA, and avoids managing secrets. It aligns with Azure's recommended passwordless, identity-based access model.

Answer

Use managed identities for the serverless SQL pool.

Answer

Use storage account access keys for authentication.

Answer

Use shared access signatures (SAS) tokens generated for each user.

Question 4

You are monitoring an Azure Data Factory pipeline that runs daily to load data from an on-premises SQL Server to Azure Synapse Analytics. The pipeline has been failing intermittently with timeout errors. You need to configure alerts to notify the team when the pipeline fails. What is the most efficient way to achieve this?

Accepted Answer

Create an alert rule in Azure Monitor using the 'Pipeline failed runs' metric.. The most efficient way to alert on pipeline failures is to create an alert rule in Azure Monitor using the 'Pipeline failed runs' metric (Option C). This metric is specific to Data Factory and allows direct alerting without additional logging setup. Option A is inefficient because it requires enabling diagnostic settings and creating a log search alert, adding latency and cost. Option B, Azure Service Health alerts, only notify about Azure service health issues, not pipeline failures. Option D, Microsoft Defender XDR, is a security solution unrelated to pipeline monitoring.

Answer

Enable diagnostic settings to send pipeline logs to a Log Analytics workspace and create a log search alert.

Answer

Use Azure Service Health alerts to notify when Data Factory is unhealthy.

Answer

Configure Microsoft Defender XDR to monitor pipeline activities.

Question 5

Your company uses Azure Databricks to process large datasets stored in Azure Data Lake Storage Gen2. You need to implement a solution that automatically rotates the storage account access keys every 90 days without interrupting running jobs. The solution should use managed identities where possible. What should you do?

Accepted Answer

Configure Azure Databricks to use a user-assigned managed identity for authentication to Azure Data Lake Storage Gen2.. A user-assigned managed identity lets Azure Databricks authenticate to ADLS Gen2 via Microsoft Entra ID tokens, eliminating storage account keys entirely. Because no keys are stored or rotated, the 90-day rotation requirement becomes moot and running jobs are never interrupted by credential changes. This is the only option that satisfies the 'use managed identities where possible' constraint.

Answer

Use Azure Policy to automatically rotate keys and update Databricks cluster configurations.

Answer

Use Azure Key Vault to store the storage account keys and configure a lifecycle policy to rotate them every 90 days. Update Databricks secrets accordingly.

Answer

Generate a SAS token with a 90-day expiry and update the Databricks secret before expiry.

Question 6

You are optimizing an Azure Synapse Analytics dedicated SQL pool that is experiencing high concurrency and frequent resource class contention. You need to improve query performance and reduce contention without changing the workload. Which two actions should you take? (Choose two.)

Accepted Answer

Implement workload isolation to separate critical queries into dedicated resource groups.. Option B is correct because workload isolation in a dedicated SQL pool lets you create workload groups with dedicated MIN_PERCENTAGE_RESOURCE and CAP_PERCENTAGE_RESOURCE allocations, so critical queries run in their own resource group and are shielded from contention with other workloads. Option D is correct because workload classification (via the CLASSIFIER function in a workload classifier) assigns incoming requests to workload groups and sets IMPORTANCE (e.g., high/medium/low), which controls scheduling priority and resource allocation to reduce contention without altering the queries themselves. Option A is not correct because increasing DWU scales resources for the whole pool but does not by itself resolve resource class contention or prioritize competing queries, and it changes cost rather than managing concurrency. Option C is not correct because materialized views pre-compute and store aggregated results to speed specific queries, but they do not address concurrency or resource class contention. Option E is not correct because result set caching only helps when identical queries are repeated and the cache is valid; it does not manage resource allocation or contention among concurrent queries.

Answer

Increase the DWU (Data Warehouse Units) to allocate more resources.

Answer

Create materialized views to pre-aggregate data.

Answer

Enable result set caching to reduce repeated query execution.

Question 7

You are optimizing an Azure Synapse Analytics dedicated SQL pool that runs a mix of reporting and ETL workloads. The ETL jobs often encounter resource wait times due to concurrent reporting queries. You need to ensure that ETL jobs always get the resources they need. Which two actions should you take? (Choose two.)

Accepted Answer

Assign HIGH importance to the ETL workload classifier.. Option B is correct because in Azure Synapse dedicated SQL pools, workload classification lets you assign a priority (such as HIGH importance) to the ETL workload via CREATE WORKLOAD CLASSIFIER, so ETL sessions are scheduled ahead of lower-priority reporting queries when resources are contended. Option E is correct because creating a dedicated workload group with a MIN_PERCENTAGE_RESOURCE guarantees a minimum share of resources reserved for ETL, ensuring those jobs always receive the resources they need regardless of concurrent reporting activity. Option A is not correct because increasing DWU raises overall capacity but does not guarantee ETL prioritization; reporting queries can still consume the added resources and cause waits. Option C is not correct because result set caching only speeds up repeated reporting queries and does nothing to prioritize or reserve resources for ETL. Option D is not correct because materialized views improve reporting query performance but do not address resource contention or guarantee ETL resources.

Answer

Increase the DWU (Data Warehouse Units) to provide more overall resources.

Answer

Enable result set caching for reporting queries.

Answer

Create materialized views for common reporting aggregations.

Question 8

You are using Azure Data Factory to ingest data from a REST API into Azure Synapse Analytics. The API has a rate limit of 100 requests per minute. You need to ensure that the pipeline respects the rate limit and retries on failure. Which two settings should you configure in the copy activity? (Choose two.)

Accepted Answer

Set the 'Throttle' property to limit the number of concurrent connections.. Option C is correct because the copy activity's 'Throttle' (degree of copy parallelism / concurrent connections) setting controls how many simultaneous requests the activity issues against the REST source, so limiting it keeps the pipeline within the API's 100 requests-per-minute rate limit. Option D is correct because setting the 'Retry' property to a value greater than 0 makes the copy activity automatically re-attempt the request when a transient failure occurs, satisfying the retry-on-failure requirement. Option A is not needed because staging is only relevant for polybase/bulk copy scenarios into Synapse, not for honoring an API rate limit. Option B is wrong because 'Batch size' controls rows per batch in the sink, not the number of API calls per minute. Option E is wrong because increasing 'Timeout' only extends how long a single request may run before failing; it does not enforce rate limiting or retries.

Answer

Enable 'Enable staging' to use a staging blob.

Answer

Configure the 'Batch size' to 100.

Answer

Increase the 'Timeout' value to 10 minutes.

Question 9

Your Azure Stream Analytics job is failing to start because the job's storage account is configured to allow access from selected networks. The job uses managed identity for authentication. What should you do to resolve the issue?

Accepted Answer

Enable the 'Allow trusted Microsoft services' exception on the storage account firewall.. Azure Stream Analytics uses the 'Allow trusted Microsoft services' exception to bypass storage firewall restrictions when authenticating with a managed identity. Enabling this exception on the storage account lets the Stream Analytics service reach the storage account without opening the firewall to all networks or adding private endpoints.

Answer

Create a private endpoint for the Stream Analytics job to access the storage account.

Answer

Disable the firewall on the storage account to allow all networks.

Answer

Generate a SAS token for the storage account and configure the job to use it.

Question 10

You are responsible for securing an Azure Synapse Analytics workspace. The workspace is integrated with a Git repository for source control. You need to ensure that only authorized users can publish changes from the Git branch to the live Synapse service. What should you configure?

Accepted Answer

Assign the 'Synapse Artifact Publisher' role to specific users in the Synapse RBAC.. In Azure Synapse Analytics, publishing artifacts from a Git branch to the live service is controlled by the Synapse Artifact Publisher RBAC role. Assigning this role to specific users ensures only they can publish, while other contributors can still edit in the collaboration branch without deploying to live.

Answer

Use Microsoft Entra ID Conditional Access policies to require multi-factor authentication for publishing.

Answer

Create an Azure Policy to deny publishing if the user is not in an approved group.

Answer

Configure branch permissions in the Git repository to restrict who can merge to the collaboration branch.

Question 11

You need to ensure that an Azure Data Factory pipeline can copy data from an Azure SQL Database that is behind a private endpoint. The Data Factory should use a managed virtual network. What should you configure?

Accepted Answer

Enable managed virtual network for the Data Factory and create a managed private endpoint for the SQL Database.. A managed private endpoint in the Data Factory's managed virtual network allows secure access to the SQL Database's private endpoint. Option A is wrong because the integration runtime must be in the same virtual network. Option B is wrong because self-hosted IR is for on-premises data sources. Option D is wrong because Azure Bastion is for VM access, not data factory.

Answer

Install a self-hosted integration runtime on a VM in the same virtual network.

Answer

Use the default Azure integration runtime.

Answer

Use Azure Bastion to connect the Data Factory to the SQL Database.

Question 12

You have an Azure Synapse Analytics dedicated SQL pool that stores sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the data, and all access must be logged for auditing. What should you implement?

Accepted Answer

Row-level security (RLS) with a security policy. Row-level security (RLS) with a security policy is correct because it restricts data access at the row level based on user identity or role, and access can be logged via auditing. In Synapse dedicated SQL pools, RLS is implemented with a predicate function and a security policy, allowing fine-grained control that aligns with Entra ID roles.

Answer

Dynamic data masking

Answer

Azure RBAC at the SQL pool level

Answer

Column-level security

Question 13

Your company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to optimize costs for a large dataset that is accessed only once a month for reporting. The data must be retained for 7 years. Which storage tier and lifecycle management rule should you configure?

Accepted Answer

Cool tier with lifecycle policy to Archive after 30 days. Cool tier is cost-effective for data accessed infrequently (once a month), and a lifecycle policy to move data to Archive after 30 days further reduces costs while meeting the 7-year retention requirement. Option A (Hot tier) is expensive for infrequent access. Option C (Premium tier) is designed for high-throughput workloads, not cost optimization. Option D (Archive tier with no lifecycle) incurs high retrieval costs for monthly access and doesn't leverage tiering.

Answer

Hot tier with no lifecycle policy

Answer

Premium tier with lifecycle policy to Cool after 30 days

Answer

Archive tier with no lifecycle policy

Question 14

You are monitoring an Azure Data Factory pipeline that runs hourly. You notice that the pipeline occasionally fails due to transient errors. Which monitoring solution should you use to get alerts on failures and analyze trends over time?

Accepted Answer

Azure Monitor with Log Analytics workspace. Azure Monitor with alerts and Log Analytics provides historical analysis and alerting. Option A (Data Factory Monitor) is for real-time monitoring but lacks long-term trend analysis. Option C (Azure Dashboard) is a visualization tool. Option D (Event Grid) is for event-driven notifications, not analysis.

Answer

Azure Event Grid subscription for pipeline failures

Answer

Azure Dashboard pinned with pipeline metrics

Answer

Azure Data Factory Monitor in the Azure portal

Question 15

You are an Azure administrator. You apply the Azure Policy shown in the exhibit to a management group. What is the outcome of this policy?

Accepted Answer

It denies storage accounts that allow public network access.. The Azure Policy definition shown in the exhibit uses a deny effect that evaluates the publicNetworkAccess property on Microsoft.Storage/storageAccounts and blocks any storage account where public network access is enabled. This is the standard built-in policy 'Storage accounts should disable public network access' and it prevents creation or update of accounts that expose a public endpoint.

Answer

It allows storage accounts only if they have a firewall rule.

Answer

It requires all storage accounts to use HTTPS only.

Answer

It denies the creation of any new storage account.