DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 7 — 15 Questions

Question 1

You are monitoring an Azure Data Factory pipeline that runs hourly. You notice that the pipeline has been failing intermittently with an error indicating 'Activity timeout'. Which Azure Monitor metric should you set an alert on to proactively detect such failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Failed pipeline runs metric. The 'Failed pipeline runs' metric directly captures the number of pipeline runs that have failed, including those due to timeout errors, making it the most appropriate metric for alerting on such failures. Option A is incorrect because 'Integration runtime queue depth' indicates how many activities are queued for execution, not failures. Option B is incorrect because 'Pipeline duration' shows how long the pipeline runs, but a timeout is a specific failure type that would be captured by failed runs. Option C is incorrect because 'Data read and data written' measure data throughput and are unrelated to pipeline failures.

Answer

Integration runtime queue depth metric

Answer

Pipeline duration metric

Answer

Data read and data written metrics

Question 2

Your Azure Databricks workspace contains sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the workspace, and all access must be logged and monitored. You also need to audit data access at the table level. What should you implement?

Accepted Answer

Enable Unity Catalog and assign the Databricks workspace to use Entra ID as the identity provider. Configure audit logs for the workspace. Azure Databricks with Unity Catalog provides fine-grained access control at the table level and integrates with Entra ID for authentication, and audit logs capture access events. Option A is wrong because SCIM provisioning only syncs users, not access control. Option B is wrong because IP access lists control network access, not data access. Option D is wrong because Microsoft Defender XDR is for security monitoring across Microsoft 365, not specifically for Databricks table-level auditing.

Answer

Configure SCIM provisioning to sync the Entra ID group to Databricks and assign the group to the workspace

Answer

Set up IP access lists to restrict workspace access to the corporate network and enable diagnostic logs

Answer

Use Microsoft Defender XDR to monitor access to the Databricks workspace

Question 3

Your team has deployed an Azure Stream Analytics job that reads from an Event Hubs input and writes to Azure Synapse Analytics. The job is falling behind, causing a growing backlog in Event Hubs. You have already scaled the Stream Analytics job to maximum streaming units. What should you do to improve throughput?

Accepted Answer

Partition the input Event Hubs and the output Synapse table, and adjust the Stream Analytics query to use PARTITION BY. Partitioning the input Event Hubs and the output Synapse table, and using PARTITION BY in the query, increases parallelism and allows the Stream Analytics job to process more data simultaneously. Option A is incorrect because the job is already at maximum streaming units. Option B is incorrect because a late arrival window handles out-of-order events, not throughput issues. Option C is incorrect because while increasing Event Hubs throughput units could help if Event Hubs is the bottleneck, the most likely bottleneck is the output sink (Azure Synapse Analytics), and partitioning the output is a more direct solution.

Answer

Increase the streaming units further

Answer

Configure a late arrival window to drop late events

Answer

Increase the throughput units of the Event Hubs namespace

Question 4

You need to secure data at rest for an Azure Data Lake Storage Gen2 account that contains sensitive financial data. Which configuration should you enable to ensure that data is encrypted using a customer-managed key stored in Azure Key Vault, and that access to the key is logged?

Accepted Answer

Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable Key Vault logging. Azure Storage encryption with customer-managed keys in Key Vault provides control and logging. Option A is wrong because Microsoft-managed keys are the default but do not provide customer control. Option B is wrong because client-side encryption requires managing keys on the client side. Option C is wrong because infrastructure encryption adds a second layer but does not use customer-managed keys.

Answer

Enable Azure Storage encryption with Microsoft-managed keys

Answer

Implement client-side encryption using Azure Key Vault

Answer

Enable infrastructure encryption for double encryption

Question 5

You have an Azure Synapse Analytics dedicated SQL pool that handles both high-priority real-time queries and low-priority batch jobs. You need to ensure that high-priority queries always get the resources they need, while batch jobs do not starve. What should you configure?

Accepted Answer

Create workload groups for high-priority and low-priority queries, assigning appropriate importance and resource percentages. Workload management with workload groups allows you to set importance and resource allocation. Option A is wrong because result-set caching does not prioritize queries. Option B is wrong because data compression reduces storage but does not affect prioritization. Option D is wrong because materialized views improve performance but do not prioritize.

Answer

Enable result-set caching for the high-priority queries

Answer

Enable data compression on the tables used by batch jobs

Answer

Create materialized views for the batch job queries

Question 6

You need to monitor the performance of an Azure Data Factory pipeline that copies data from an on-premises SQL Server to Azure Blob Storage. The pipeline runs on a self-hosted integration runtime. Which metric is most important to monitor to ensure the self-hosted IR is not a bottleneck?

Accepted Answer

Queue depth for the self-hosted IR. Queue depth for the self-hosted IR is the most important metric to monitor because it indicates how many activities are queued waiting for the IR to process. A high queue depth suggests the IR is overloaded and becoming a bottleneck. In contrast, pipeline duration (A) reflects total time but does not isolate IR performance. Active connections (C) measure concurrent loads but not queuing. Data read/written (D) track throughput, but a bottleneck may appear even with high throughput if the IR cannot keep up.

Answer

Pipeline duration metric

Answer

Number of active connections to the IR

Answer

Data read and data written metrics for the pipeline

Question 7

You are securing an Azure Data Lake Storage Gen2 account that contains sensitive data. Which TWO of the following should you implement to protect data from unauthorized access?

Accepted Answer

Configure ACLs to grant least privilege to users and groups. ACLs provide fine-grained access control at the directory/file level, allowing you to grant least privilege to users and groups. Option B is correct because private endpoints ensure data traffic does not traverse the public internet, reducing exposure. Option C is wrong because a default ACL of 'read' for all authenticated users would grant broad access. Option D is wrong because CORS rules are for web applications, not security. Option E is wrong because large file shares are for Azure Files, not ADLS Gen2.

Answer

Set the default ACL to allow read access for all authenticated users

Answer

Enable CORS rules to allow only specific origins

Answer

Enable large file shares on the storage account

Question 8

You are optimizing the performance of an Azure Synapse Analytics dedicated SQL pool. Which THREE of the following actions will most likely improve query performance?

Accepted Answer

Create materialized views for frequently used aggregations. Materialized views precompute and store aggregated results, reducing the need to scan large tables on every query. Option C is correct because partitioning large fact tables on a date column enables partition elimination, which reduces the amount of data scanned for queries that filter on the partition key. Option D is correct because result-set caching allows repeated queries to return cached results directly without recomputation. Option B is incorrect: using a smaller distribution column does not necessarily improve data distribution and can cause data skew if the column has low cardinality. Option E is incorrect: converting all tables to heap tables removes indexes, which typically degrades query performance; heaps are primarily used for staging or loading data, not for performance optimization.

Answer

Use a smaller distribution column to improve data distribution

Answer

Convert all tables to heap tables to avoid index maintenance

Question 9

You are monitoring an Azure Stream Analytics job that processes streaming data from Event Hubs to Azure Synapse Analytics. Which TWO Azure Monitor metrics should you set alerts on to detect data loss or processing delays?

Accepted Answer

InputEvents and OutputEvents metrics. The correct metrics for detecting data loss or processing delays in an Azure Stream Analytics job are InputEvents and OutputEvents (Option A). By comparing these, you can determine if every event entering the job is being output; a mismatch indicates potential data loss. Backlogged input events (Option E) directly measures the number of events waiting to be processed, and a high or growing value signals processing delays. Option B (Duration) is not a direct indicator of data loss or processing delays in Stream Analytics. Option C (Data read/written) is not a metric for Stream Analytics. Option D (Pipeline run count) is not applicable to Stream Analytics streaming jobs.

Answer

Duration metric

Answer

Data read and data written metrics

Answer

Pipeline run count metric

Question 10

You are reviewing the ARM template above. The storage account is created with hierarchical namespace enabled (isHnsEnabled: true). After deployment, you need to ensure that the 'data-engineers' group can execute but not read the contents of the root directory. What should you do?

Accepted Answer

Use the Azure portal to set ACLs on the root directory, granting execute permission to the data-engineers group without read permission. In Azure Data Lake Storage Gen2 (with hierarchical namespace enabled), ACLs are used to set granular permissions at the directory or file level. To grant only execute permission on the root directory without read, you must set an ACL entry that specifically grants execute (--x) to the 'data-engineers' group. Option A is incorrect because disabling hierarchical namespace would change the storage type and not achieve the desired ACL-based permission. Option B is incorrect because the Storage Blob Data Reader role grants read and list access, not just execute. Option C is incorrect because firewall rules control network access, not permissions on directories.

Answer

Modify the ARM template to set the 'isHnsEnabled' property to false and redeploy

Answer

Assign the Storage Blob Data Reader role to the data-engineers group at the storage account level

Answer

Configure a firewall rule to allow only the data-engineers group's IP addresses

Question 11

You are using Azure Data Explorer to monitor real-time sensor data. You run the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

To visualize the count of events every 5 minutes over the last hour. The query uses `summarize count()` with `bin(Timestamp, 5m)` to count events in 5-minute intervals and then renders a timechart, effectively visualizing the count of events every 5 minutes over the last hour. Option A is incorrect because detecting anomalies would require functions like `series_decompose_anomalies`. Option B is incorrect because the query does not calculate an average; it counts events. Option D is incorrect because it does not filter by a specific sensor; it aggregates all events.

Answer

To detect anomalies in the sensor data

Answer

To calculate the average value of a numeric column over time

Answer

To filter events from a specific sensor

Question 12

You are reviewing an ARM template that assigns a role. What role is being assigned, and at what scope?

Accepted Answer

Storage Blob Data Contributor at the resource group scope. The roleDefinitionId in the ARM template corresponds to 'Storage Blob Data Contributor' and the scope is set to the resource group. Option A is wrong because the scope is not subscription level. Option B is wrong because the role is not 'Storage Blob Data Reader' (the GUID for that role is different). Option D is wrong because the scope is the resource group, not the storage account.

Answer

Storage Blob Data Owner at the subscription scope

Answer

Storage Blob Data Reader at the resource group scope

Answer

Storage Blob Data Contributor at the storage account scope

Question 13

Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only authorized users can access the data via the serverless SQL endpoint, while minimizing administrative overhead. What should you use?

Accepted Answer

Enable Microsoft Entra ID authentication and grant users permissions via Azure RBAC on the storage account.. Microsoft Entra ID authentication allows users to authenticate with their existing identities, and Azure RBAC on the storage account provides granular, identity-based access control without managing separate SQL logins or credentials, minimizing administrative overhead. Option B is incorrect because managed identities are designed for service-to-service authentication, not for individual users. Option C is incorrect because storage account access keys provide broad, shared access that does not support per-user identity and auditing. Option D is incorrect because SAS tokens require token generation and management per user, adding overhead.

Answer

Use managed identities for the serverless SQL pool.

Answer

Use storage account access keys for authentication.

Answer

Use shared access signatures (SAS) tokens generated for each user.

Question 14

You are monitoring an Azure Data Factory pipeline that runs hourly. You notice that the pipeline has been failing intermittently with an error indicating 'Activity timeout'. Which Azure Monitor metric should you set an alert on to proactively detect such failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an alert rule in Azure Monitor using the 'Pipeline failed runs' metric.. The most efficient way to alert on pipeline failures is to create an alert rule in Azure Monitor using the 'Pipeline failed runs' metric (Option C). This metric is specific to Data Factory and allows direct alerting without additional logging setup. Option A is inefficient because it requires enabling diagnostic settings and creating a log search alert, adding latency and cost. Option B, Azure Service Health alerts, only notify about Azure service health issues, not pipeline failures. Option D, Microsoft Defender XDR, is a security solution unrelated to pipeline monitoring.

Answer

Enable diagnostic settings to send pipeline logs to a Log Analytics workspace and create a log search alert.

Answer

Use Azure Service Health alerts to notify when Data Factory is unhealthy.

Answer

Configure Microsoft Defender XDR to monitor pipeline activities.

Question 15

You are designing a data processing solution in Azure Synapse Analytics. The solution must ensure that data at rest in a dedicated SQL pool is encrypted using customer-managed keys (CMK) stored in Azure Key Vault. The encryption should be enabled at the database level. What should you configure?

Accepted Answer

Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault provides database-level encryption for dedicated SQL pools in Azure Synapse Analytics. TDE encrypts data at rest, and using a customer-managed key (CMK) allows the organization to control the key lifecycle. Option B is incorrect because Azure Purview is for data governance and classification, not encryption. Option C is incorrect because Azure Disk Encryption encrypts VM disks, not the SQL pool database. Option D is incorrect because Always Encrypted is a column-level encryption feature, not for full database encryption.

Answer

Azure Purview data classification and encryption policies.

Answer

Azure Disk Encryption on the nodes hosting the dedicated SQL pool.

Answer

Always Encrypted with keys stored in Azure Key Vault.