DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. You deploy the ARM template to create a storage account. After deployment, a developer reports that they cannot access the storage account from an Azure Databricks notebook running in the same virtual network as specified in the subnet rule. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Databricks cluster is not using a managed virtual network with a service endpoint to the storage account.. For an Azure Databricks cluster to reach a storage account over a private path, the cluster must be deployed into a managed VNet with a service endpoint (or private endpoint) to the storage account. A subnet rule on the storage firewall only restricts traffic to that subnet; it does not automatically give the Databricks cluster a private route to the storage account. Without the managed VNet + service endpoint configuration, traffic from the cluster egresses via a public IP that is not permitted by the firewall.

Answer

The storage account uses customer-managed keys from Key Vault, which requires additional permissions.

Answer

The firewall default action is Deny, and there are no IP rules allowing the Databricks cluster's public IP.

Answer

The storage account has hierarchical namespace enabled, which blocks non-ADLS Gen2 tools.

Question 2

You are designing a data processing solution using Azure Stream Analytics. You need to ensure that the output to Azure SQL Database is optimized to minimize the number of write operations. Which output configuration should you use?

Accepted Answer

Use a windowed aggregation to batch writes.. Azure Stream Analytics outputs to Azure SQL Database can be optimized to minimize write operations by batching multiple rows into a single insert. Using a windowed aggregation groups events over a time window, producing fewer output rows and thus fewer write operations. This reduces the frequency of writes and improves efficiency.

Answer

Use a partitioned output to distribute writes across multiple tables.

Answer

Set the compatibility level to 1.2.

Answer

Increase the event serialization format batch size.

Question 3

You are designing a data ingestion pipeline for Azure Data Lake Storage Gen2 using Azure Databricks. The source is an on-premises SQL Server database with incremental changes captured via change data capture (CDC). The requirement is to ensure exactly-once semantics for each row while minimizing latency. Which approach should you recommend?

Accepted Answer

Use Spark Structured Streaming in Azure Databricks to read CDC changes and write to Delta Lake.. Spark Structured Streaming in Azure Databricks, combined with Delta Lake, provides exactly-once semantics through checkpointing and transaction logs, and it is designed for low-latency streaming ingestion—ideal for CDC data. Option A is incorrect: Azure Data Factory with a tumbling window is a batch-based approach and cannot achieve exactly-once semantics for streaming data with low latency. Option B is incorrect: PolyBase is used for bulk loading data into Azure Synapse, not for streaming CDC ingestion. Option C is incorrect: Auto Loader and COPY INTO are designed for incremental batch loads of files, not for streaming row-level changes from a database.

Answer

Use Azure Data Factory with a tumbling window trigger to copy data every 5 minutes.

Answer

Use PolyBase to create external tables and run T-SQL MERGE statements.

Answer

Use Azure Databricks Auto Loader with COPY INTO command.

Question 4

Your company uses Azure SQL Database and needs to audit all data modifications, including SELECT operations on sensitive columns, for compliance. Which feature should you enable?

Accepted Answer

Enable SQL auditing and configure to log SELECT operations.. Azure SQL Database auditing captures database events including SELECT statements. Option B is wrong because TDE encrypts data at rest, not audit. Option C is wrong because Azure Defender for SQL provides security alerts but not detailed audit logs. Option D is wrong because vulnerability assessment scans for security issues but does not audit.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable Azure Defender for SQL.

Answer

Enable SQL vulnerability assessment.

Question 5

You are monitoring an Azure Synapse Analytics dedicated SQL pool and notice that queries are experiencing excessive wait time due to concurrency slots being exhausted. What is the recommended approach to improve concurrency without increasing cost?

Accepted Answer

Classify queries using workload classification and assign lower importance to reduce concurrency slot usage.. Workload classification with lower importance (via workload groups and the IMPORTANCE parameter) allows the dedicated SQL pool to prioritize critical queries while letting lower-importance queries wait or be deferred, effectively freeing concurrency slots for high-priority workloads without adding compute cost. This is the documented Synapse approach for managing concurrency pressure: classify requests, assign them to workload groups, and tune importance/resource allocation rather than scaling.

Answer

Create additional workload groups and assign queries to them.

Answer

Scale up the dedicated SQL pool to a higher service level.

Answer

Change the distribution type of tables to round-robin.

Question 6

You are designing a data pipeline that uses Azure Data Factory to copy data from an Azure SQL database to Azure Data Lake Storage Gen2. The data contains personally identifiable information (PII) that must be masked. Which Data Factory feature should you use?

Accepted Answer

Use a mapping data flow to apply a mask transformation on PII columns.. Mapping Data Flows in Azure Data Factory provide built-in transformations for data masking, such as the Mask transformation, which can obfuscate PII columns during the data flow. Option A is incorrect because a copy activity with a query can only filter columns but does not support masking; it simply selects a subset of columns without transformation. Option B is incorrect because while a stored procedure activity can execute masking logic on the source, it requires additional setup and does not integrate seamlessly with Data Factory's native transformation capabilities. Option C is incorrect because staging with PolyBase is used to improve bulk copy performance, not for data masking.

Answer

Use a copy activity with a query to select only non-PII columns.

Answer

Use a stored procedure activity to mask data in the source before copy.

Answer

Enable staging on the copy activity to use PolyBase.

Question 7

Which TWO actions should you take to ensure that data at rest is encrypted in Azure Synapse Analytics dedicated SQL pool?

Accepted Answer

Enable infrastructure-level encryption using double encryption.. Option E is correct because Azure Synapse Analytics dedicated SQL pools have Transparent Data Encryption (TDE) enabled by default, and using service-managed keys ensures data at rest is encrypted without additional key management overhead, satisfying the requirement directly. Option B is correct because enabling infrastructure-level encryption (double encryption) adds a second layer of encryption at the infrastructure level, further protecting data at rest in the dedicated SQL pool. Option A is not correct because Always Encrypted with secure enclaves protects data in use and in transit between client and server, not specifically data at rest in the dedicated SQL pool. Option C is not correct because ENCRYPTBYPASSPHRASE is a manual column-level encryption function that does not provide the comprehensive at-rest encryption required for the pool. Option D is not correct because creating a customer-managed key in Azure Key Vault is optional for TDE key management and does not by itself ensure encryption is enabled; TDE must still be configured.

Answer

Enable Always Encrypted with secure enclaves.

Answer

Apply column-level encryption using ENCRYPTBYPASSPHRASE.

Answer

Create a customer-managed key in Azure Key Vault.

Question 8

Which THREE metrics from Azure Monitor should you use to evaluate the performance of an Azure Data Lake Storage Gen2 account?

Accepted Answer

Ingress. Ingress (A) is correct because it measures the volume of incoming data written to the Data Lake Storage Gen2 account, directly reflecting write throughput and workload demand. Success E2E Latency (C) is correct because it captures the end-to-end latency of successful requests, which is a key indicator of storage responsiveness and performance for read/write operations. Blob Count (E) is correct because it reports the number of blobs stored in the account, helping assess capacity growth and its potential impact on listing and management operations. CPU Usage (B) is not a storage account metric; it applies to compute resources such as VMs or App Services. Available Storage Capacity (D) is not a metric exposed for Azure Storage accounts, since storage is elastic and capacity is not a monitored performance counter in Azure Monitor.

Answer

CPU Usage

Answer

Available Storage Capacity

Question 9

You are optimizing cost for an Azure Data Lake Storage Gen2 account that stores historical data. The data is accessed infrequently after 30 days and must be retained for 7 years. Which lifecycle management rule should you apply?

Accepted Answer

Move blobs to cool tier after 30 days, then to archive tier after 1 year.. The correct rule moves blobs to cool tier after 30 days (since data is accessed infrequently after that point) and then to archive tier after 1 year, balancing cost and retention for the 7-year requirement. Cool tier is cheaper than hot for infrequent access, and archive is the lowest-cost tier for long-term retention. This staged approach avoids early deletion penalties and premature archival costs.

Answer

Move blobs to archive tier immediately after 30 days.

Answer

Delete blobs after 30 days.

Answer

Move blobs to premium tier after 30 days.

Question 10

You are designing a data ingestion pipeline for Azure Synapse Analytics. The pipeline will load sensitive financial data from an on-premises SQL Server to a dedicated SQL pool. The data must be encrypted at rest and in transit. Which combination of features should you use?

Accepted Answer

Use Azure Synapse Transparent Data Encryption (TDE) and enforce TLS 1.2 for connections.. Transparent Data Encryption (TDE) encrypts data at rest in the dedicated SQL pool, and enforcing TLS 1.2 ensures encryption in transit. Option A is wrong because Always Encrypted is for column-level encryption, not for the entire pipeline. Option B is wrong because Azure Disk Encryption is for IaaS VMs, not for Azure Synapse. Option C is wrong because client-side encryption is not built-in for Synapse ingestion.

Answer

Use Always Encrypted in SQL Server and Azure Key Vault for column encryption.

Answer

Enable Azure Disk Encryption on the source server and use a VPN gateway.

Answer

Implement client-side encryption using Azure Storage client library and store keys in Microsoft Purview.

Question 11

You are monitoring an Azure Synapse Analytics dedicated SQL pool that is experiencing performance degradation during peak hours. You notice that some queries are being queued due to resource contention. You need to optimize query performance without scaling the Data Warehouse Units (DWUs). Which action should you take?

Accepted Answer

Configure result-set caching for the dedicated SQL pool.. Result-set caching can significantly reduce query time for repeated queries by storing results in SSD, reducing resource contention. Option A is wrong because increasing DWUs changes the scale, which is not allowed per the requirement. Option B is wrong because materialized views help but do not directly address contention from repeated queries. Option D is wrong because workload classification manages concurrency but does not reduce resource usage for repeated queries.

Answer

Increase the DWU setting to allocate more resources.

Answer

Create materialized views for frequently joined tables.

Answer

Implement workload classification and assign the queries to a higher importance level.

Question 12

You have an Azure Data Lake Storage Gen2 account that stores sensitive customer data. You need to implement security controls to prevent data exfiltration by a malicious insider who has Contributor role access. Which Azure feature should you use?

Accepted Answer

Apply an Azure Policy that denies data access from unapproved locations.. Azure Policy can enforce conditions on data-plane and control-plane operations, and with the 'deny' effect it can block access from unapproved locations (for example, restricting storage access to specific regions or networks). Because the concern is a malicious insider with Contributor role, a policy-based guardrail that denies access from unapproved locations constrains what even a privileged user can do, which is the appropriate control.

Answer

Enable diagnostic settings to log all access to the storage account.

Answer

Remove the Contributor role and assign a custom role with read-only permissions.

Answer

Configure network firewall rules to allow only trusted IP addresses.

Question 13

You are optimizing an Azure Data Factory pipeline that moves data from Azure Blob Storage to Azure SQL Database. The pipeline currently uses a Copy activity with a staging setting enabled. You notice high DTU consumption on the Azure SQL Database during the copy operation. How can you reduce the impact on the source database?

Accepted Answer

Configure the Copy activity to use staging with Azure Blob Storage and then use a stored procedure to bulk insert.. Staging the copy to Azure Blob Storage and then using a stored procedure for bulk insert reduces the direct load on Azure SQL Database, lowering DTU consumption during the copy. Option B is incorrect because PolyBase is designed for Azure Synapse Analytics, not Azure SQL Database. Option C (parallel copy) can increase throughput but also increases DTU usage, not reducing it. Option D (increasing DTU) is a scaling measure, not a reduction technique.

Answer

Use PolyBase to load data directly from Blob Storage to Azure SQL Database.

Answer

Enable parallel copy in the Copy activity settings.

Answer

Increase the DTU of the Azure SQL Database to handle the load.

Question 14

You have an Azure Synapse Analytics workspace with Apache Spark pools. You need to monitor Spark application performance and identify stages that are taking the longest time. Which tool should you use?

Accepted Answer

Use the Spark UI available in Synapse Studio.. The Spark UI provides detailed information about stages, tasks, and executors. Option B is wrong because Azure Monitor metrics provide aggregate metrics but not stage-level details. Option C is wrong because Log Analytics queries can analyze logs but not as directly as Spark UI. Option D is wrong because Synapse Studio provides a job view but not as granular as Spark UI.

Answer

Run KQL queries in Log Analytics against Spark logs.

Answer

Query Azure Monitor metrics for the Spark pool.

Answer

Use the Synapse Pipeline monitoring view.

Question 15

Which TWO actions should you take to secure data at rest in Azure Data Lake Storage Gen2? (Choose TWO)

Accepted Answer

Use Azure RBAC to grant least-privilege access to the storage account.. Option A is correct because Azure RBAC enforces least-privilege authorization on the storage account, ensuring only approved identities can read or modify the data stored in Data Lake Storage Gen2, which directly protects data at rest from unauthorized access. Option C is correct because Azure Storage Service Encryption (SSE) automatically encrypts data at rest in the storage account using 256-bit AES encryption, with keys managed by Microsoft or by the customer via Key Vault, which is the core mechanism for securing data at rest. Option B is not correct because dynamic data masking applies to query results in services such as Azure SQL Database and Synapse, not to files stored in Data Lake Storage Gen2. Option D is not correct because firewall rules restrict network access to the account, which is a network-perimeter control rather than encryption or authorization of the stored data itself. Option E is not correct because audit logging provides visibility and monitoring of access, but it does not by itself secure or encrypt data at rest.

Answer

Apply dynamic data masking to sensitive columns.

Answer

Configure firewall rules to restrict network access.

Answer

Enable audit logging for the storage account.