DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 7 — 15 Questions

Question 1

Your organization uses Azure Data Lake Storage Gen2 and needs to prevent accidental deletion of data by enabling soft delete. You also need to ensure that deleted blobs are recoverable for 30 days. What should you configure?

Accepted Answer

Enable blob soft delete and set retention period to 30 days.. Option A is correct because blob soft delete allows recovery of deleted blobs within a specified retention period. Option B is wrong because container soft delete is for entire containers, not individual blobs. Option C is wrong because Azure Backup is for VM backups, not blob recovery. Option D is wrong because snapshots are manual and not automatic.

Answer

Enable blob snapshots and set them to expire after 30 days.

Answer

Use Azure Backup to create daily backups of the storage account.

Answer

Enable container soft delete with a retention period of 30 days.

Question 2

You are designing a security strategy for Azure Synapse Analytics. The solution must prevent users from accessing sensitive columns in a dedicated SQL pool, such as Social Security numbers, unless they have explicit permission. Which feature should you use?

Accepted Answer

Column-level security.. Option B is correct because column-level security restricts access to specific columns. Option A is wrong because row-level security filters rows, not columns. Option C is wrong because dynamic data masking obfuscates data but does not prevent access. Option D is wrong because Azure Purview is for data discovery and governance, not access control.

Answer

Azure Purview data classification.

Answer

Dynamic data masking.

Answer

Row-level security (RLS).

Question 3

Your company uses Azure Data Factory to orchestrate data movement. You need to monitor pipeline runs across multiple factories and create a dashboard that shows success and failure rates over the past 30 days. What is the most efficient approach?

Accepted Answer

Configure diagnostic settings for each Data Factory to send logs to a Log Analytics workspace, then create a workbook using KQL queries.. Option B is correct because sending diagnostic logs to a Log Analytics workspace allows querying and visualizing data from multiple factories in a single dashboard. Option A is wrong because Azure Monitor alerts are for notifications, not historical dashboards. Option C is wrong because Azure Data Factory monitoring views are per factory. Option D is wrong because Azure Storage Analytics is for storage metrics, not pipeline runs.

Answer

Use the Data Factory monitoring UI to view runs for each factory individually.

Answer

Enable Azure Storage Analytics and query the logs stored in a storage account.

Answer

Create alert rules in Azure Monitor for each pipeline failure and aggregate manually.

Question 4

You are optimizing an Azure Synapse Analytics dedicated SQL pool that runs a mix of reporting and ETL workloads. The ETL jobs often encounter resource wait times due to concurrent reporting queries. You need to ensure that ETL jobs always get the resources they need. Which two actions should you take? (Choose two.)

Accepted Answer

Assign HIGH importance to the ETL workload classifier.. Options A and C are correct. Workload isolation with separate resource pools ensures ETL gets dedicated resources. Assigning HIGH importance ensures ETL queries are prioritized. Option B is wrong because increasing DWU adds resources but does not guarantee priority. Option D is wrong because result set caching benefits reporting, not ETL. Option E is wrong because materialized views improve query performance but do not guarantee resource allocation.

Answer

Increase the DWU (Data Warehouse Units) to provide more overall resources.

Answer

Enable result set caching for reporting queries.

Answer

Create materialized views for common reporting aggregations.

Question 5

Your organization needs to ensure that all data stored in Azure Data Lake Storage Gen2 is encrypted at rest using Microsoft-managed keys. What is the default encryption method?

Accepted Answer

Storage Service Encryption (SSE) with Microsoft-managed keys.. Option A is correct because Azure Storage automatically encrypts all data at rest using SSE with Microsoft-managed keys. Option B is wrong because CMK is optional. Option C is wrong because Azure Disk Encryption is for VMs. Option D is wrong because TDE is for SQL databases.

Answer

Transparent Data Encryption (TDE) on the storage account.

Answer

Client-side encryption with keys stored in Azure Key Vault.

Answer

Azure Disk Encryption on the storage nodes.

Question 6

You are using Azure Data Factory to ingest data from a REST API into Azure Synapse Analytics. The API has a rate limit of 100 requests per minute. You need to ensure that the pipeline respects the rate limit and retries on failure. Which two settings should you configure in the copy activity? (Choose two.)

Accepted Answer

Set the 'Throttle' property to limit the number of concurrent connections.. Options A and C are correct. Setting 'Retry' to handle transient failures and 'Throttle' to limit concurrent connections help respect rate limits. Option B is wrong because 'Batch size' is for bulk operations, not rate limiting. Option D is wrong because 'Timeout' cancels the activity, not retries. Option E is wrong because 'Enable staging' is for large data transfers, not rate limiting.

Answer

Enable 'Enable staging' to use a staging blob.

Answer

Configure the 'Batch size' to 100.

Answer

Increase the 'Timeout' value to 10 minutes.

Question 7

Your Azure Stream Analytics job is failing to start because the job's storage account is configured to allow access from selected networks. The job uses managed identity for authentication. What should you do to resolve the issue?

Accepted Answer

Add the Stream Analytics job's managed identity as a trusted service in the storage account firewall.. Option C is correct because the Stream Analytics job's managed identity must be added as a trusted service to bypass the network restrictions. Option A is wrong because firewall rules apply to all services; managed identity must be explicitly allowed. Option B is wrong because private endpoints require additional configuration and are not required. Option D is wrong because SAS tokens are not needed with managed identity.

Answer

Create a private endpoint for the Stream Analytics job to access the storage account.

Answer

Disable the firewall on the storage account to allow all networks.

Answer

Generate a SAS token for the storage account and configure the job to use it.

Question 8

You are responsible for securing an Azure Synapse Analytics workspace. The workspace is integrated with a Git repository for source control. You need to ensure that only authorized users can publish changes from the Git branch to the live Synapse service. What should you configure?

Accepted Answer

Assign the 'Synapse Artifact Publisher' role to specific users in the Synapse RBAC.. Option B is correct because Synapse RBAC roles like 'Synapse Artifact Publisher' control who can publish changes. Option A is wrong because Git permissions control access to the repository, not publishing to Synapse. Option C is wrong because Azure Policy enforces compliance rules, not access control. Option D is wrong because Microsoft Entra ID is for identity, not specific publish permissions.

Answer

Use Microsoft Entra ID Conditional Access policies to require multi-factor authentication for publishing.

Answer

Create an Azure Policy to deny publishing if the user is not in an approved group.

Answer

Configure branch permissions in the Git repository to restrict who can merge to the collaboration branch.

Question 9

You need to monitor the performance of an Azure Stream Analytics job that processes real-time IoT data. Which metric indicates the number of events that are being dropped or delayed due to insufficient processing capacity?

Accepted Answer

Backlogged input events.. Option B is correct because 'Backlogged input events' indicates events that are waiting to be processed. Option A is wrong because 'Input events' is the total received. Option C is wrong because 'Output events' is the total sent. Option D is wrong because 'Watermark delay' measures latency.

Answer

Watermark delay.

Answer

Output events.

Answer

Input events.

Question 10

Your company uses Azure Data Lake Storage Gen2 and needs to implement a data retention policy that automatically deletes files older than 90 days in a specific container. What should you use?

Accepted Answer

Azure Storage lifecycle management rule with a filter for the container and a delete action after 90 days.. Option B is correct because Azure Storage lifecycle management policies can automatically delete blobs based on age. Option A is wrong because Azure Purview is for governance, not deletion. Option C is wrong because Azure Data Factory can be scheduled to delete, but lifecycle management is simpler. Option D is wrong because Azure Policy enforces rules, not automated deletion.

Answer

Azure Data Factory pipeline with a Delete activity scheduled to run daily.

Answer

Azure Policy with a deny effect for files older than 90 days.

Answer

Azure Purview data lifecycle policy.

Question 11

You are designing a disaster recovery plan for an Azure Synapse Analytics dedicated SQL pool. The primary region becomes unavailable. You need to fail over to a secondary region with minimal data loss. The recovery point objective (RPO) is 1 hour. What should you configure?

Accepted Answer

Enable geo-backup on the dedicated SQL pool.. Option D is correct because the geo-backup feature automatically takes snapshots and replicates them to a paired region with a default RPO of 1 hour. Option A is wrong because the restore point is manual. Option B is wrong because active geo-replication is for Azure SQL Database, not Synapse dedicated SQL pool. Option C is wrong because automatic restore points are local, not in another region.

Answer

Configure active geo-replication to the secondary region.

Answer

Use automatic restore points and copy them to the secondary region using Azure Data Factory.

Answer

Create user-defined restore points every hour and store them in the secondary region.

Question 12

You need to ensure that an Azure Data Factory pipeline can copy data from an Azure SQL Database that is behind a private endpoint. The Data Factory should use a managed virtual network. What should you configure?

Accepted Answer

Enable managed virtual network for the Data Factory and create a managed private endpoint for the SQL Database.. Option C is correct because a managed private endpoint in the Data Factory's managed virtual network allows secure access to the SQL Database's private endpoint. Option A is wrong because the integration runtime must be in the same virtual network. Option B is wrong because self-hosted IR is for on-premises data sources. Option D is wrong because Azure Bastion is for VM access, not data factory.

Answer

Install a self-hosted integration runtime on a VM in the same virtual network.

Answer

Use the default Azure integration runtime.

Answer

Use Azure Bastion to connect the Data Factory to the SQL Database.

Question 13

You have an Azure Synapse Analytics dedicated SQL pool that stores sensitive customer data. You need to ensure that only users with a specific Microsoft Entra ID role can access the data, and all access must be logged for auditing. What should you implement?

Accepted Answer

Row-level security (RLS) with a security policy. Option B is correct because row-level security (RLS) controls access at the row level based on user context, and it can be integrated with Microsoft Entra ID roles. Option A (column-level security) restricts columns, not rows. Option C (dynamic data masking) obfuscates data but does not restrict access. Option D (Azure RBAC) controls resource management, not data access inside the SQL pool.

Answer

Dynamic data masking

Answer

Azure RBAC at the SQL pool level

Answer

Column-level security

Question 14

Your company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to optimize costs for a large dataset that is accessed only once a month for reporting. The data must be retained for 7 years. Which storage tier and lifecycle management rule should you configure?

Accepted Answer

Cool tier with lifecycle policy to Archive after 30 days. Option C is correct because Cool storage is cost-effective for infrequent access, and a lifecycle policy moving to Archive after 30 days minimizes costs while retaining data for 7 years. Option A (Hot) is expensive for infrequent access. Option B (Premium) is for high throughput. Option D (Archive immediately) incurs high retrieval costs for monthly access.

Answer

Hot tier with no lifecycle policy

Answer

Premium tier with lifecycle policy to Cool after 30 days

Answer

Archive tier with no lifecycle policy

Question 15

You are monitoring an Azure Data Factory pipeline that runs hourly. You notice that the pipeline occasionally fails due to transient errors. Which monitoring solution should you use to get alerts on failures and analyze trends over time?

Accepted Answer

Azure Monitor with Log Analytics workspace. Option B is correct because Azure Monitor with alerts and Log Analytics provides historical analysis and alerting. Option A (Data Factory Monitor) is for real-time monitoring but lacks long-term trend analysis. Option C (Azure Dashboard) is a visualization tool. Option D (Event Grid) is for event-driven notifications, not analysis.

Answer

Azure Event Grid subscription for pipeline failures

Answer

Azure Dashboard pinned with pipeline metrics

Answer

Azure Data Factory Monitor in the Azure portal