DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 8 — 15 Questions

Question 1

You are an Azure administrator. You apply the Azure Policy shown in the exhibit to a management group. What is the outcome of this policy?

Accepted Answer

It denies storage accounts that allow public network access.. Option D is correct because the policy denies storage accounts where the default network access is set to 'Allow' (i.e., public access). Option A (denies creation only) is not true; it applies to existing accounts as well via auditing/deny. Option B (allows only HTTPS) is unrelated. Option C (requires firewall) is not stated.

Answer

It allows storage accounts only if they have a firewall rule.

Answer

It requires all storage accounts to use HTTPS only.

Answer

It denies the creation of any new storage account.

Question 2

You run the PowerShell command shown in the exhibit for an Azure Synapse Analytics dedicated SQL pool. Which configuration will be applied?

Accepted Answer

The SQL pool is set to auto-pause after 15 minutes of inactivity.. Option B is correct because the command sets auto-pause delay to 15 minutes, but the property 'IsTransactional' is not a valid property for Set-AzSynapseSqlPool; it will be ignored. Auto-pause is a serverless SQL pool feature, but for dedicated SQL pool, it's not supported; however, the command will attempt to set it but fail silently or be ignored. In practice, auto-pause delay is only for serverless SQL pools. The most accurate answer is that auto-pause is set, but other properties are invalid.

Answer

The SQL pool is configured with transactional replication and auto-pause.

Answer

The command fails because dedicated SQL pools do not support auto-pause.

Answer

The SQL pool is partitioned into 10 partitions with automatic cleanup.

Question 3

You have an Azure Databricks workspace with a cluster that uses a Standard_LRS managed disk. You need to ensure that data at rest is encrypted using a customer-managed key (CMK). What should you configure?

Accepted Answer

Enable double encryption with a customer-managed key in Azure Disk Encryption. Option A is correct because Azure Databricks supports CMK encryption via Azure Disk Encryption or by using a key vault key for the managed disk. Option B (Azure Storage Service Encryption) is for storage accounts, not managed disks. Option C (Azure SQL Database TDE) is irrelevant. Option D (Azure Purview) is for data governance, not encryption.

Answer

Configure Azure Storage Service Encryption with a customer-managed key

Answer

Enable Transparent Data Encryption (TDE) in Azure SQL Database

Answer

Use Azure Purview to classify and encrypt data

Question 4

You are configuring Microsoft Purview to scan an Azure Data Explorer (ADX) cluster. You define the JSON shown in the exhibit. However, the scan fails with an authentication error. What is the most likely cause?

Accepted Answer

The ADX cluster does not have a managed identity enabled for Purview.. Option C is correct because Purview requires a system-assigned managed identity (or user-assigned) to be enabled on the ADX cluster and granted permissions. Option A (firewall) could be a cause, but the error is authentication specifically. Option B (region mismatch) is not a common issue. Option D (incorrect database) would cause a different error.

Answer

The ADX cluster is behind a firewall and Purview cannot connect.

Answer

The database name in the scan configuration is incorrect.

Answer

The region of the ADX cluster does not match the Purview account region.

Question 5

You are running an Azure Stream Analytics job that reads from an Event Hub and writes to a Power BI dataset. The job is falling behind and processing latency is increasing. What should you do to improve performance?

Accepted Answer

Increase the number of Streaming Units (SUs) allocated to the job.. Option D is correct because increasing the Streaming Units (SUs) allocates more compute resources to the job, improving throughput. Option A (change output to blob) changes architecture. Option B (decrease event size) is not always possible. Option C (use reference data) does not affect throughput.

Answer

Use a reference data input to filter events.

Answer

Change the output to Azure Blob Storage instead of Power BI.

Answer

Decrease the size of events sent to the Event Hub.

Question 6

Which TWO actions should you take to secure data in transit between an Azure Synapse Analytics serverless SQL pool and a client application?

Accepted Answer

Configure the serverless SQL pool to enforce TLS 1.2 connections.. Options A and C are correct. Enforcing TLS 1.2 ensures a modern secure protocol; using VNet service endpoints keeps traffic within Azure. Option B (disable SSL) is insecure. Option D (use Azure RBAC) is for auth, not encryption. Option E (use ExpressRoute) provides private connectivity but does not encrypt data by itself; it's more for network security.

Answer

Use Azure RBAC to restrict access to the SQL pool.

Answer

Disable SSL encryption to reduce latency.

Answer

Use Azure ExpressRoute to connect to the SQL pool.

Question 7

Which THREE methods can you use to monitor and optimize the performance of an Azure Data Lake Storage Gen2 account?

Accepted Answer

Enable Azure Monitor metrics for the storage account.. Options A, C, and D are correct. Azure Monitor metrics provide performance data; Storage Analytics logs (classic) give request details; lifecycle management optimizes costs by tiering. Option B (Azure SQL Analytics) is for SQL databases. Option E (Azure Advisor) provides recommendations but is not a monitoring method per se; it's an advisory tool.

Answer

Use Azure Advisor to get performance recommendations.

Answer

Use Azure SQL Analytics to query storage logs.

Question 8

Which TWO Azure services can you use to monitor data processing pipelines in Azure Data Factory?

Accepted Answer

Log Analytics workspace. Options B and C are correct. Azure Monitor provides metrics and alerts; Log Analytics workspace enables querying pipeline run logs. Option A (Azure Sentinel) is a SIEM, not typically for pipeline monitoring. Option D (Azure Dashboard) is a visualization tool, not a monitoring service. Option E (Azure Service Health) monitors Azure service health, not pipelines.

Answer

Azure Sentinel

Answer

Azure Dashboard

Answer

Azure Service Health

Question 9

Your organization uses Azure Synapse Analytics to run large-scale queries. You need to implement a solution that automatically pauses the dedicated SQL pool when no activity is detected for a specified period, and resumes it when a connection is attempted. What should you configure?

Accepted Answer

You cannot configure auto-pause for a dedicated SQL pool.. Option D is correct because Azure Synapse Analytics dedicated SQL pool does not support auto-pause; auto-pause is only for serverless SQL pools. Option A (auto-pause setting) is for serverless. Option B (Azure Automation runbook) could work but is not a built-in feature. Option C (Azure Functions) is custom. The correct answer is that you cannot configure auto-pause for dedicated SQL pool.

Answer

Use Azure Automation to run a PowerShell script that pauses and resumes the pool.

Answer

Create an Azure Function that pauses the pool on a schedule.

Answer

Set the auto-pause delay in the SQL pool properties.

Question 10

You deploy the Azure Security Center automation shown in the exhibit. What is the purpose of this automation?

Accepted Answer

It sends high-severity security alerts to an Event Hub for further processing.. Option B is correct because Security Center automations trigger actions (like sending to Event Hub) when specific security alerts or recommendations occur. Option A (Azure Sentinel) is incorrect because the automation is not creating incidents; it's forwarding alerts. Option C (Azure Monitor) is not involved. Option D (Azure Policy) is for compliance, not alerting.

Answer

It configures Azure Monitor to log high-severity alerts.

Answer

It applies an Azure Policy to remediate high-severity alerts.

Answer

It creates incidents in Azure Sentinel for high-severity alerts.

Question 11

You are using Azure Data Factory to load data from an on-premises SQL Server to Azure Synapse Analytics. The data size is 500 GB, and you need to minimize the load time. The network bandwidth is limited. Which approach should you use?

Accepted Answer

Use a self-hosted integration runtime and stage the data in Azure Blob Storage before loading to Synapse.. Option A is correct because using a self-hosted integration runtime with staging via Azure Blob Storage allows you to stage the data in Azure and then copy to Synapse, which is faster over limited bandwidth. Option B (copy activity directly) is slower. Option C (Azure Data Lake Storage) is similar but staging is more efficient. Option D (Azure ExpressRoute) requires additional setup and cost.

Answer

Use a self-hosted integration runtime and copy directly to Synapse.

Answer

Use Azure ExpressRoute to improve network bandwidth.

Answer

Use an Azure integration runtime and copy to Azure Data Lake Storage, then to Synapse.

Question 12

You need to audit all queries run against an Azure Synapse Analytics serverless SQL pool. What should you enable?

Accepted Answer

Azure SQL Auditing on the serverless SQL pool endpoint. Option B is correct because auditing is configured at the server level for SQL pools, capturing query logs. Option A (Azure Monitor) is for metrics, not query text. Option C (Azure Policy) is for compliance. Option D (Azure Purview) is for data cataloging.

Answer

Microsoft Purview to scan and catalog queries

Answer

Azure Policy to enforce auditing

Answer

Azure Monitor diagnostic settings

Question 13

Your organization uses Azure Synapse Analytics with serverless SQL pools. You need to ensure that only users with specific Microsoft Entra ID roles can query external tables referencing Azure Data Lake Storage Gen2. What should you configure?

Accepted Answer

Grant SELECT permission on the external table to specific Microsoft Entra ID users or groups.. Option B is correct because Azure Synapse workspace firewall controls network access, but for data access, you need to grant specific permissions on the external data source. Option A is wrong because storage account firewall controls network access, not user identity. Option C is wrong because managed identity for the serverless pool is not user-specific. Option D is wrong because RBAC on the storage account alone does not restrict query access through Synapse.

Answer

Assign a managed identity to the serverless SQL pool and grant it Storage Blob Data Reader on the storage account.

Answer

Use Azure RBAC to assign Storage Blob Data Reader role to the users on the storage account.

Answer

Configure a storage account firewall to allow only the Synapse workspace IP range.

Question 14

You are designing a data processing solution using Azure Databricks. The solution must use Delta Lake for ACID transactions and must optimize storage costs by automatically compacting small files. Which feature should you enable?

Accepted Answer

Enable auto-optimize on the Delta table.. Option D is correct because Delta Lake's auto-optimize feature automatically compacts small files during writes. Option A is wrong because OPTIMIZE is a manual command. Option B is wrong because Z-order is for data skipping, not compaction. Option C is wrong because vacuum removes old files, not compacts.

Answer

Run OPTIMIZE command in a scheduled job.

Answer

Set retention duration for vacuum to 7 days.

Answer

Enable Z-order indexing on the Delta table.

Question 15

A company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. They need to restrict a specific application's access to only write files in a particular directory without being able to read or list files. Which type of permission should be assigned?

Accepted Answer

Configure an access control list (ACL) that grants execute and write permissions to the application's service principal.. Option C is correct because POSIX-style ACLs allow granular permissions like write-only. Option A is wrong because RBAC roles like Storage Blob Data Contributor include read and list permissions. Option B is wrong because SAS tokens can be scoped but not to write-only at directory level easily. Option D is wrong because firewall rules control network access, not permissions.

Answer

Configure a firewall rule to allow only the application's IP address.

Answer

Generate a shared access signature (SAS) with write and list permissions.

Answer

Assign the Storage Blob Data Contributor role at the storage account level.

DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 8 — 15 Questions

Exhibit

DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 8 — 15 Questions

Exhibit