DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 9 — 15 Questions

Question 1

You are reviewing an Azure Data Factory JSON definition for a linked service. The linked service uses a service principal to connect to Azure Data Lake Storage Gen1. What is a security concern with this configuration?

Accepted Answer

The service principal key is stored as a SecureString but is visible in the JSON definition.. Option B is correct because storing the service principal key as plain text in the JSON is insecure. Option A is wrong because using Data Lake Storage Gen1 is not a security concern. Option C is wrong because service principal authentication is acceptable. Option D is wrong because subscription and resource group are necessary for resource management.

Answer

The subscription ID and resource group are specified.

Answer

The linked service uses a service principal instead of a managed identity.

Answer

Using Azure Data Lake Storage Gen1 instead of Gen2.

Question 2

Your team is running a critical Azure Stream Analytics job that writes results to Azure SQL Database. Recently, the job has been failing with high latency and occasional data loss. You need to monitor the job's performance and set up alerts for when the watermark delay exceeds a threshold. What should you use?

Accepted Answer

Azure Monitor metrics for the Stream Analytics job.. Option A is correct because Azure Stream Analytics provides job metrics in Azure Monitor, including watermark delay. Option B is wrong because Log Analytics can store logs but not directly show Stream Analytics metrics. Option C is wrong because Application Insights is for application monitoring, not Stream Analytics. Option D is wrong because Azure Data Explorer is not for monitoring Stream Analytics.

Answer

Application Insights SDK integration in the job.

Answer

Azure Log Analytics workspace connected to the job diagnostics logs.

Answer

Azure Data Explorer for querying job performance data.

Question 3

You are configuring Azure Synapse Analytics dedicated SQL pool. To optimize query performance for a large fact table that is frequently filtered on date and region columns, which table distribution and indexing strategy should you recommend?

Accepted Answer

Hash distribution on region column with clustered columnstore index.. Option B is correct because hash distribution on region spreads data evenly if region has high cardinality, and clustered columnstore index is optimal for large fact tables. Option A is wrong because round-robin distribution is for staging tables. Option C is wrong because heap index is for temporary data. Option D is wrong because replicated distribution is for small dimension tables.

Answer

Hash distribution on date column with clustered index.

Answer

Replicated distribution with heap index.

Answer

Round-robin distribution with clustered index.

Question 4

Your company uses Azure Purview for data governance. You need to ensure that sensitive data in Azure Data Lake Storage Gen2 is automatically detected and classified. What should you configure in Purview?

Accepted Answer

Create a scan rule set that includes built-in classification rules for sensitive data types.. Option A is correct because Purview's scanning and classification rules automatically detect sensitive data. Option B is wrong because sensitivity labels in Microsoft Purview Information Protection are applied manually or via policy, not automatically by Purview scanning. Option C is wrong because Azure Policy enforces resource compliance, not data classification. Option D is wrong because Defender for Cloud is for security posture, not data classification.

Answer

Apply sensitivity labels to the storage account using Microsoft Purview Information Protection.

Answer

Enable Microsoft Defender for Cloud's data sensitivity discovery.

Answer

Use Azure Policy to enforce tagging of resources containing sensitive data.

Question 5

You are reviewing an Azure PowerShell script that sets permissions on a directory in Azure Data Lake Storage Gen2. The script sets a default ACL for a user on the path 'sales/2024/01/'. What is the effect of the -DefaultScope parameter?

Accepted Answer

The ACL is inherited by all new child items created under this directory.. Option C is correct because default ACLs are inherited by new child items created under that directory. Option A is wrong because default ACLs do not affect existing items. Option B is wrong because default ACLs apply to both files and directories. Option D is wrong because default ACLs are separate from access ACLs.

Answer

The ACL replaces the existing access ACL on the directory.

Answer

The ACL is applied to all existing files and subdirectories recursively.

Answer

The ACL is applied only to files, not subdirectories.

Question 6

You are monitoring Azure Data Factory pipelines. You need to set up an alert when a pipeline run fails. What is the most efficient way to achieve this?

Accepted Answer

Create an Azure Monitor alert based on the 'Failed pipeline runs' metric.. Option A is correct because Azure Monitor alerts can be configured on Data Factory metrics like 'Failed pipeline runs'. Option B is wrong because custom logging in a sink requires additional effort. Option C is wrong because diagnostic settings send logs to a workspace, but alerts are easier with metrics. Option D is wrong because Application Insights is not natively integrated with Data Factory for pipeline runs.

Answer

Add an activity in each pipeline to log failures to a custom table in Log Analytics.

Answer

Enable diagnostic settings to send pipeline runs to a Log Analytics workspace and create a log alert.

Answer

Use Application Insights to monitor pipeline executions.

Question 7

Which TWO actions should you take to secure access to an Azure Data Lake Storage Gen2 account using Microsoft Entra ID?

Accepted Answer

Assign Azure RBAC roles such as Storage Blob Data Contributor to users or groups.. Options A and B are correct. Option A: Enabling hierarchical namespace is required for ACLs. Option B: RBAC roles like Storage Blob Data Contributor provide coarse-grained access. Option C is wrong because storage account keys bypass identity. Option D is wrong because SAS tokens also bypass identity. Option E is wrong because firewall rules do not use Entra ID.

Answer

Generate a shared access signature (SAS) token with limited permissions.

Answer

Configure a storage firewall to allow only specific IP addresses.

Answer

Use storage account access keys for authentication.

Question 8

Which THREE metrics should you monitor for an Azure Synapse Analytics dedicated SQL pool to ensure optimal performance?

Accepted Answer

tempdb usage. Options A, C, and E are correct. Option A: DWU usage indicates how much of the allocated resources are used. Option C: Queued queries indicate concurrency bottlenecks. Option E: tempdb usage can cause performance issues. Option B is wrong because storage size is capacity, not performance. Option D is wrong because login failures are security, not performance.

Answer

Login failures

Answer

Total storage size

Question 9

Which TWO methods can you use to optimize the cost of storing data in Azure Data Lake Storage Gen2?

Accepted Answer

Configure lifecycle management policies to move older data to the cool or archive tier.. Options A and C are correct. Option A: Lifecycle management policies can move data to cooler tiers. Option C: Using Azure Blob Storage access tiers (hot, cool, archive) directly reduces cost. Option B is wrong because redundancy options like GRS increase cost. Option D is wrong because enabling soft delete adds storage overhead. Option E is wrong because encryption does not affect storage cost.

Answer

Use customer-managed keys for encryption.

Answer

Enable soft delete for blobs.

Answer

Enable geo-redundant storage (GRS) for disaster recovery.

Question 10

You are reviewing an Azure Data Factory pipeline JSON that copies data from Azure Blob Storage to Azure SQL Database using a stored procedure. The pipeline fails with a 'Parameter supplied for object is not valid' error. What is the most likely cause?

Accepted Answer

The stored procedure parameters are not mapped to source columns.. Option B is correct because the stored procedure parameter 'Param1' is defined with a static string value 'value1', but the copy activity should map source columns to stored procedure parameters. Option A is wrong because the source type is valid. Option C is wrong because dataset references are correctly structured. Option D is wrong because the error is about parameters, not dataset names.

Answer

The source type 'BlobSource' is not compatible with Azure Blob Storage.

Answer

The SQL table type 'dbo.InsertType' does not exist.

Answer

The dataset references are incorrect.

Question 11

You are designing a data processing solution using Azure Databricks with Delta Live Tables (DLT). The solution must handle late-arriving data and ensure that updates to the delta table are processed exactly once. Which DLT pipeline setting should you configure?

Accepted Answer

Configure the DLT pipeline with 'Delta Live Tables' and use 'APPLY CHANGES INTO' with a watermark.. Option D is correct because DLT pipelines support exactly-once processing and handle late data via watermarking and append-only or update modes. Option A is wrong because 'Trigger once' processes data one time only, not continuous. Option B is wrong because 'Continuous' mode processes data as it arrives but may not guarantee exactly-once without proper configuration. Option C is wrong because 'File arrival' is not a DLT setting.

Answer

Set the pipeline mode to 'Trigger once'.

Answer

Set the pipeline mode to 'Continuous' and enable 'Exactly once' delivery.

Answer

Use Auto Loader with 'file arrival' mode.

Question 12

Your company uses Azure Data Lake Storage Gen2. You need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable 'Azure Storage encryption' with customer-managed keys in the storage account's encryption blade.. Option A is correct because Azure Storage encryption with customer-managed keys is configured at the storage account level. Option B is wrong because infrastructure encryption is an additional layer. Option C is wrong because client-side encryption is done by the application, not at rest. Option D is wrong because Azure Policy can enforce encryption but does not configure it.

Answer

Use Azure Policy to audit storage accounts without encryption.

Answer

Implement client-side encryption in the application code.

Answer

Enable 'Infrastructure encryption' for double encryption.

Question 13

You are designing a data processing solution in Azure Synapse Analytics. The solution must ensure that sensitive columns containing personally identifiable information (PII) are masked at query time for users without explicit permissions. Which Azure Synapse Analytics feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct feature because it obfuscates sensitive data in query results for users without the UNMASK permission. Option A is wrong because Always Encrypted protects data at rest and in transit but requires client-side changes. Option C is wrong because Row-Level Security restricts rows, not columns. Option D is wrong because Transparent Data Encryption encrypts the entire database at rest.

Answer

Row-Level Security

Answer

Transparent Data Encryption

Answer

Always Encrypted

Question 14

Your Azure Data Lake Storage Gen2 account stores sensitive data. You need to audit who accesses the data and when, and you want to send the audit logs to a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Diagnostic settings on the storage account. Diagnostic settings on the storage account can stream audit logs (like read, write, delete) to Log Analytics. Option B is wrong because Azure Activity Logs capture control plane operations, not data plane access. Option C is wrong because Azure Monitor alerts are for notifications, not log collection. Option D is wrong because Microsoft Sentinel requires data ingestion from diagnostic settings first.

Answer

Azure Activity Logs

Answer

Microsoft Sentinel

Answer

Azure Monitor alerts

Question 15

You have an Azure Synapse Analytics dedicated SQL pool. You notice that some queries are taking longer than expected due to excessive data movement operations. You need to minimize data movement without changing the distribution columns. Which table design approach should you recommend?

Accepted Answer

Use replicated tables for small dimension tables. Using replicated tables for small dimension tables reduces data movement because the table is copied to all nodes, avoiding shuffles. Option A is wrong because hash-distributing large fact tables is already common; replicating large tables is not recommended due to storage overhead. Option C is wrong because round-robin distribution is for staging or temporary tables. Option D is wrong because partitioning does not directly reduce data movement for joins.

Answer

Use round-robin distribution for dimension tables

Answer

Use hash distribution for all tables

Answer

Use partitioning on join columns

DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 9 — 15 Questions

Exhibit

DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 9 — 15 Questions

Exhibit