DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 5 — 15 Questions

Question 1

You are optimizing a Slowly Changing Dimension (SCD) Type 2 load in Azure Synapse Analytics. The dimension table has 10 million rows. Which table distribution strategy minimizes data movement during the merge operation?

Accepted Answer

Hash distribution on the business key. Option D is correct because Hash distribution on the business key (surrogate key source) ensures that matching rows are co-located, reducing data movement during MERGE. Option A is wrong because Round-robin distributes randomly, causing data movement. Option B is wrong because Replicated works for small tables, not 10 million rows. Option C is wrong because Hash on an unrelated column does not help.

Answer

Round-robin distribution

Answer

Hash distribution on the surrogate key

Answer

Replicated distribution

Question 2

You are reviewing an ARM template for Azure SQL Database security alert policy. Based on the exhibit, which threats will trigger an alert?

Accepted Answer

SQL Injection Vulnerability and Data Exfiltration. Option B is correct because the disabledAlerts list includes 'Sql_Injection' and 'Access_Anomaly', so those are suppressed. The remaining enabled alerts (e.g., SQL Injection Vulnerability, Data Exfiltration, Unsafe Action) will trigger alerts. Option A is wrong because SQL Injection is disabled. Option C is wrong because Access Anomaly is disabled. Option D is wrong because the policy is enabled, so some alerts are active.

Answer

All alerts except SQL Injection and Access Anomaly

Answer

No alerts will be triggered because the policy is disabled

Answer

SQL Injection and Access Anomaly

Question 3

You have an Azure Data Lake Storage Gen2 account that stores parquet files. You need to ensure that files containing personally identifiable information (PII) are automatically classified and tagged. Which Azure service should you integrate?

Accepted Answer

Microsoft Purview. Option B is correct because Microsoft Purview provides automated data classification and labeling for Azure Storage. Option A is wrong because Microsoft Sentinel is a SIEM, not for classification. Option C is wrong because Microsoft Defender for Cloud is for security posture, not data classification. Option D is wrong because Azure Policy enforces rules but does not classify content.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 4

Which TWO actions should you take to secure access to Azure Data Lake Storage Gen2 when using Azure Synapse Analytics serverless SQL pools? (Choose two.)

Accepted Answer

Enable firewall rules and virtual network service endpoints for the storage account.. Options A and D are correct. A: Enabling firewall and virtual network rules restricts network access. D: Using managed identity for authentication avoids storing credentials. Option B is wrong because Azure AD passthrough is only for dedicated SQL pools, not serverless. Option C is wrong because service principal is less secure than managed identity. Option E is wrong because shared access signatures should be avoided for security.

Answer

Use a service principal with a client secret to access the storage account.

Answer

Generate a shared access signature (SAS) token for the storage account and store it securely.

Answer

Use Azure Active Directory (Azure AD) passthrough authentication for the serverless pool.

Question 5

Which THREE metrics should you monitor to optimize the performance of an Azure Synapse Analytics dedicated SQL pool? (Choose three.)

Accepted Answer

Queued queries. Options A, C, and D are correct. A: DWU usage indicates overall resource utilization. C: Queued queries indicate concurrency throttling. D: TempDB usage can cause performance degradation if high. Option B is wrong because storage space is not a performance metric (though important for capacity). Option E is wrong because login failures are security-related, not performance.

Answer

Storage space used

Answer

Login failures

Question 6

Which TWO Azure features can be used to encrypt data at rest in Azure Blob Storage? (Choose two.)

Accepted Answer

Customer-managed keys in Azure Key Vault. Options A and C are correct. A: Storage Service Encryption (SSE) encrypts data at rest by default. C: Customer-managed keys in Azure Key Vault provide additional control over encryption keys. Option B is wrong because Azure Disk Encryption is for VMs. Option D is wrong because TLS is for data in transit. Option E is wrong because Azure Information Protection is for classification, not encryption at rest.

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Answer

Transport Layer Security (TLS)

Question 7

You are reviewing an Azure Data Factory pipeline JSON. Based on the exhibit, what will be the behavior of the Copy activity when copying files from a source folder that contains subfolders?

Accepted Answer

All files from all subfolders will be copied into a single folder in the sink.. Option B is correct because recursive: true ensures all files from subfolders are copied, and FlattenHierarchy writes them to the sink without preserving the folder structure. Option A is wrong because recursive is true. Option C is wrong because FlattenHierarchy does not preserve structure. Option D is wrong because staging is disabled.

Answer

The copy will use staging to improve performance.

Answer

Only files in the root folder will be copied.

Answer

Files will be copied preserving the source folder structure.

Question 8

You need to monitor resource utilization for an Azure Synapse Analytics dedicated SQL pool. Which Azure Monitor metric shows the percentage of allocated DWU being used?

Accepted Answer

DWU used. Option C is correct because 'DWU used' metric shows the percentage of allocated DWU consumed. Option A is wrong because 'CPU percentage' is not a standard metric for Synapse. Option B is wrong because 'Data IO percentage' is not the primary metric. Option D is wrong because 'Memory percentage' is not directly DWU.

Answer

Memory percentage

Answer

Data IO percentage

Answer

CPU percentage

Question 9

You are reviewing a script to create an external data source in Azure Synapse Analytics serverless SQL pool. Based on the exhibit, what is the purpose of the SAS token?

Accepted Answer

To provide read access to the container for querying data.. Option B is correct because the SAS token provides delegated access to the storage account for reading (sp=r) and listing (sp=l). Option A is wrong because the SAS is for a container, not a specific file. Option C is wrong because the SAS does not have write permission (sp=rl). Option D is wrong because the SAS is used in the credential for the external data source.

Answer

To provide write access to the container for storing query results.

Answer

To encrypt the connection between the serverless pool and storage.

Answer

To authenticate the user to the serverless SQL pool.

Question 10

Your Azure Synapse Analytics dedicated SQL pool is experiencing performance degradation. You notice that some queries are being queued due to resource class conflicts. What should you implement to optimize performance and reduce queuing?

Accepted Answer

Configure workload management with workload groups and classifiers. Option C is correct because workload management in Synapse allows you to assign queries to different workload groups with resource classes, preventing conflicts. Option A is wrong because scaling the pool adds cost and may not resolve the specific resource class conflict. Option B is wrong because result-set caching does not address concurrency issues. Option D is wrong because materialized views improve query performance but do not resolve queuing.

Answer

Scale the dedicated SQL pool to a higher DWU level

Answer

Create materialized views for the most common aggregations

Answer

Enable result-set caching for frequently run queries

Question 11

Your company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to ensure that only the 'data-scientists' group can read files in the 'processed' container, while denying access to all other users. You have already configured the storage account firewall to allow access only from your corporate network. What should you do next?

Accepted Answer

Configure access control lists (ACLs) on the 'processed' container to grant read and execute permissions to the data-scientists group and set the default ACL to deny all. Option B is correct because ACLs are the mechanism to grant granular permissions to specific users/groups in ADLS Gen2 with hierarchical namespace. Option A is wrong because RBAC roles grant access at the storage account or container level, and a single deny assignment would block everyone. Option C is wrong because private endpoints control network access, not identity-based permissions. Option D is wrong because managed identity is used for service-to-service authentication, not for granting read access to a specific group.

Answer

Create a private endpoint for the storage account and assign the data-scientists group to the private endpoint's access policy

Answer

Assign the Storage Blob Data Reader role to the data-scientists group at the storage account level and add a deny assignment for all other users

Answer

Use a managed identity for the data-scientists group and assign the Storage Blob Data Contributor role to the managed identity

Question 12

You are monitoring an Azure Data Factory pipeline that runs hourly. You notice that the pipeline has been failing intermittently with an error indicating 'Activity timeout'. Which Azure Monitor metric should you set an alert on to proactively detect such failures?

Accepted Answer

Failed pipeline runs metric. Option A is correct because 'Failed runs' metric directly indicates pipeline failures. Option B is wrong because 'Data read' and 'Data written' measure data throughput, not failures. Option C is wrong because 'Duration' shows runtime, but a timeout is a specific failure type. Option D is wrong because 'Queue depth' is for integration runtimes, not pipeline failures.

Answer

Integration runtime queue depth metric

Answer

Pipeline duration metric

Answer

Data read and data written metrics

Question 13

Your Azure Databricks workspace contains sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the workspace, and all access must be logged and monitored. You also need to audit data access at the table level. What should you implement?

Accepted Answer

Enable Unity Catalog and assign the Databricks workspace to use Entra ID as the identity provider. Configure audit logs for the workspace. Option C is correct because Azure Databricks with Unity Catalog provides fine-grained access control at the table level and integrates with Entra ID for authentication, and audit logs capture access events. Option A is wrong because SCIM provisioning only syncs users, not access control. Option B is wrong because IP access lists control network access, not data access. Option D is wrong because Microsoft Defender XDR is for security monitoring across Microsoft 365, not specifically for Databricks table-level auditing.

Answer

Configure SCIM provisioning to sync the Entra ID group to Databricks and assign the group to the workspace

Answer

Set up IP access lists to restrict workspace access to the corporate network and enable diagnostic logs

Answer

Use Microsoft Defender XDR to monitor access to the Databricks workspace

Question 14

Your team has deployed an Azure Stream Analytics job that reads from an Event Hubs input and writes to Azure Synapse Analytics. The job is falling behind, causing a growing backlog in Event Hubs. You have already scaled the Stream Analytics job to maximum streaming units. What should you do to improve throughput?

Accepted Answer

Partition the input Event Hubs and the output Synapse table, and adjust the Stream Analytics query to use PARTITION BY. Option A is correct because partitioning the input and output can increase parallelism. Option B is wrong because late arrival events deal with out-of-order data, not throughput. Option C is wrong because the job is already at maximum streaming units. Option D is wrong because increasing Event Hubs throughput units may not help if the bottleneck is the output sink.

Answer

Increase the streaming units further

Answer

Configure a late arrival window to drop late events

Answer

Increase the throughput units of the Event Hubs namespace

Question 15

You need to secure data at rest for an Azure Data Lake Storage Gen2 account that contains sensitive financial data. Which configuration should you enable to ensure that data is encrypted using a customer-managed key stored in Azure Key Vault, and that access to the key is logged?

Accepted Answer

Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable Key Vault logging. Option D is correct because Azure Storage encryption with customer-managed keys in Key Vault provides control and logging. Option A is wrong because Microsoft-managed keys are the default but do not provide customer control. Option B is wrong because client-side encryption requires managing keys on the client side. Option C is wrong because infrastructure encryption adds a second layer but does not use customer-managed keys.

Answer

Enable Azure Storage encryption with Microsoft-managed keys

Answer

Implement client-side encryption using Azure Key Vault

Answer

Enable infrastructure encryption for double encryption