DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 9 — 15 Questions

Question 1

You run the PowerShell command shown in the exhibit for an Azure Synapse Analytics dedicated SQL pool. Which configuration will be applied?

Accepted Answer

The SQL pool is set to auto-pause after 15 minutes of inactivity.. The PowerShell command Set-AzSynapseSqlPool with the -AutoPauseDelayInMinutes parameter configures the dedicated SQL pool to automatically pause after 15 minutes of inactivity. This feature is supported for dedicated SQL pools in Azure Synapse Analytics. Therefore, option C is correct. Option A is incorrect because transactional replication is not configured by this command. Option B is incorrect because dedicated SQL pools do support auto-pause. Option D is incorrect because partitioning is not involved.

Answer

The SQL pool is configured with transactional replication and auto-pause.

Answer

The command fails because dedicated SQL pools do not support auto-pause.

Answer

The SQL pool is partitioned into 10 partitions with automatic cleanup.

Question 2

You have an Azure Databricks workspace with a cluster that uses a Standard_LRS managed disk. You need to ensure that data at rest is encrypted using a customer-managed key (CMK). What should you configure?

Accepted Answer

Enable double encryption with a customer-managed key in Azure Disk Encryption. Azure Databricks managed disks support double encryption with a customer-managed key (CMK) using Azure Disk Encryption. This provides two layers of encryption: server-side encryption with a platform-managed key and additional encryption with a customer-managed key. Option A (Azure Storage Service Encryption) applies to Azure Storage accounts, not to Azure Databricks managed disks. Option C (TDE) is for Azure SQL Database. Option D (Azure Purview) is a data governance service, not an encryption solution.

Answer

Configure Azure Storage Service Encryption with a customer-managed key

Answer

Enable Transparent Data Encryption (TDE) in Azure SQL Database

Answer

Use Azure Purview to classify and encrypt data

Question 3

You are configuring Microsoft Purview to scan an Azure Data Explorer (ADX) cluster. You define the JSON shown in the exhibit. However, the scan fails with an authentication error. What is the most likely cause?

Accepted Answer

The ADX cluster does not have a managed identity enabled for Purview.. Purview requires a system-assigned managed identity (or user-assigned) to be enabled on the ADX cluster and granted permissions. Option A (firewall) could be a cause, but the error is authentication specifically. Option B (region mismatch) is not a common issue. Option D (incorrect database) would cause a different error.

Answer

The ADX cluster is behind a firewall and Purview cannot connect.

Answer

The database name in the scan configuration is incorrect.

Answer

The region of the ADX cluster does not match the Purview account region.

Question 4

You are running an Azure Stream Analytics job that reads from an Event Hub and writes to a Power BI dataset. The job is falling behind and processing latency is increasing. What should you do to improve performance?

Accepted Answer

Increase the number of Streaming Units (SUs) allocated to the job.. Increasing the number of Streaming Units (SUs) allocates more compute resources to the Azure Stream Analytics job, directly improving throughput and reducing processing latency. Option B (use reference data) does not address throughput; it is used for enriching streams with static data. Option C (change output to Blob Storage) avoids Power BI throughput limits but does not fix the job's compute performance. Option D (decrease event size) is not typically under the control of the job configuration and may not be feasible.

Answer

Use a reference data input to filter events.

Answer

Change the output to Azure Blob Storage instead of Power BI.

Answer

Decrease the size of events sent to the Event Hub.

Question 5

Which TWO actions should you take to secure data in transit between an Azure Synapse Analytics serverless SQL pool and a client application?

Accepted Answer

Configure the serverless SQL pool to enforce TLS 1.2 connections.. The correct answers are B and C. Enforcing TLS 1.2 ensures encryption in transit using a modern, secure protocol (B). Using Azure Virtual Network service endpoints for the SQL pool keeps traffic within the Azure backbone network, adding a layer of network security (C). Option A (Azure RBAC) controls authentication and authorization, not encryption. Option D (disable SSL) would expose data in transit. Option E (ExpressRoute) provides private connectivity but does not inherently encrypt data; it's more for network isolation.

Answer

Use Azure RBAC to restrict access to the SQL pool.

Answer

Disable SSL encryption to reduce latency.

Answer

Use Azure ExpressRoute to connect to the SQL pool.

Question 6

Which THREE methods can you use to monitor and optimize the performance of an Azure Data Lake Storage Gen2 account?

Accepted Answer

Enable Azure Monitor metrics for the storage account.. Options B, C, and E are correct. Azure Monitor metrics (B) provide performance data such as latency and throughput for the storage account. Lifecycle management policies (C) optimize costs by automatically moving data to cooler tiers based on access patterns, which can improve performance for frequently accessed data. Storage Analytics logs (E) capture detailed information about read and write requests, helping to identify performance bottlenecks. Option A (Azure Advisor) offers recommendations but is not a direct monitoring method; it is an advisory tool. Option D (Azure SQL Analytics) is designed for monitoring Azure SQL Database, not Azure Data Lake Storage Gen2.

Answer

Use Azure Advisor to get performance recommendations.

Answer

Use Azure SQL Analytics to query storage logs.

Question 7

Your organization uses Azure Synapse Analytics to run large-scale queries. You need to implement a solution that automatically pauses the dedicated SQL pool when no activity is detected for a specified period, and resumes it when a connection is attempted. What should you configure?

Accepted Answer

You cannot configure auto-pause for a dedicated SQL pool.. Azure Synapse Analytics dedicated SQL pool does not support auto-pause; auto-pause is only available for serverless SQL pools. Option B (Azure Automation runbook) could be used as a custom solution but is not a built-in feature. Option C (Azure Functions) also provides a custom approach but is not a native configuration. Option D (setting auto-pause delay) applies only to serverless SQL pools, not dedicated SQL pools. Therefore, the only accurate statement is that you cannot configure auto-pause for a dedicated SQL pool.

Answer

Use Azure Automation to run a PowerShell script that pauses and resumes the pool.

Answer

Create an Azure Function that pauses the pool on a schedule.

Answer

Set the auto-pause delay in the SQL pool properties.

Question 8

You deploy the Azure Security Center automation shown in the exhibit. What is the purpose of this automation?

Accepted Answer

It sends high-severity security alerts to an Event Hub for further processing.. Azure Security Center automation can be configured to send high-severity security alerts to an Event Hub for further processing, enabling integration with SIEM systems or custom workflows. Option A is incorrect because Azure Monitor logging is not configured by this automation; it's about forwarding alerts. Option B is incorrect because Azure Policy is used for compliance enforcement, not for remediating alerts via automation. Option D is incorrect because creating incidents in Azure Sentinel is a separate action, not directly triggered by this automation; it forwards alerts to Event Hub.

Answer

It configures Azure Monitor to log high-severity alerts.

Answer

It applies an Azure Policy to remediate high-severity alerts.

Answer

It creates incidents in Azure Sentinel for high-severity alerts.

Question 9

You are using Azure Data Factory to load data from an on-premises SQL Server to Azure Synapse Analytics. The data size is 500 GB, and you need to minimize the load time. The network bandwidth is limited. Which approach should you use?

Accepted Answer

Use a self-hosted integration runtime and stage the data in Azure Blob Storage before loading to Synapse.. Using a self-hosted integration runtime with staging via Azure Blob Storage allows you to stage the data in Azure before loading to Synapse, which is faster over limited bandwidth. Option A (copy directly) is slower due to the bandwidth limitation. Option C (Azure ExpressRoute) requires additional setup and cost, but the question asks for the approach that minimizes load time with limited bandwidth, and staging is the most efficient. Option D (Azure Data Lake Storage) is similar to staging but not as optimized for the scenario.

Answer

Use a self-hosted integration runtime and copy directly to Synapse.

Answer

Use Azure ExpressRoute to improve network bandwidth.

Answer

Use an Azure integration runtime and copy to Azure Data Lake Storage, then to Synapse.

Question 10

You need to audit all queries run against an Azure Synapse Analytics serverless SQL pool. What should you enable?

Accepted Answer

Azure SQL Auditing on the serverless SQL pool endpoint. Azure SQL Auditing is the correct feature to audit all queries against an Azure Synapse Analytics serverless SQL pool. It captures query logs at the server level, providing detailed information about database activities, including the actual query text. Option B (Azure Monitor diagnostic settings) is for collecting metrics and logs but not specific query text for auditing. Option C (Azure Policy) is used for enforcing compliance rules, not auditing queries. Option D (Microsoft Purview) is for data cataloging and governance, not query auditing.

Answer

Microsoft Purview to scan and catalog queries

Answer

Azure Policy to enforce auditing

Answer

Azure Monitor diagnostic settings

Question 11

Your organization uses Azure Synapse Analytics with serverless SQL pools. You need to ensure that only users with specific Microsoft Entra ID roles can query external tables referencing Azure Data Lake Storage Gen2. What should you configure?

Accepted Answer

Grant SELECT permission on the external table to specific Microsoft Entra ID users or groups.. Granting SELECT permission on the external table directly controls which Microsoft Entra ID users or groups can query the data via the serverless SQL pool. This approach uses Azure AD authentication to restrict access at the query level, not at the storage layer. Option A is incorrect because assigning a managed identity to the serverless pool provides a service identity, but it does not restrict access per user. Option B is incorrect because Azure RBAC on the storage account grants data access at the storage level, not through the Synapse SQL engine, and does not limit querying via external tables. Option C is incorrect because the storage account firewall controls network access, not user identity, and does not prevent authorized users from other networks from querying.

Answer

Assign a managed identity to the serverless SQL pool and grant it Storage Blob Data Reader on the storage account.

Answer

Use Azure RBAC to assign Storage Blob Data Reader role to the users on the storage account.

Answer

Configure a storage account firewall to allow only the Synapse workspace IP range.

Question 12

A company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. They need to restrict a specific application's access to only write files in a particular directory without being able to read or list files. Which type of permission should be assigned?

Accepted Answer

Configure an access control list (ACL) that grants execute and write permissions to the application's service principal.. Azure Data Lake Storage Gen2 uses POSIX-style ACLs that allow granular permissions. To restrict an application to write-only access without read or list, you grant execute (for directory traversal) and write permissions on the target directory via an ACL entry for the application's service principal. Option A is incorrect because firewall rules control network access, not data permissions. Option C is incorrect because a SAS with list permission would allow listing; write-only SAS is not easily achievable at directory level. Option D is incorrect because the Storage Blob Data Contributor role at the account level grants read, write, and delete permissions, not write-only.

Answer

Configure a firewall rule to allow only the application's IP address.

Answer

Generate a shared access signature (SAS) with write and list permissions.

Answer

Assign the Storage Blob Data Contributor role at the storage account level.

Question 13

You are reviewing an Azure Data Factory JSON definition for a linked service. The linked service uses a service principal to connect to Azure Data Lake Storage Gen1. What is a security concern with this configuration?

Accepted Answer

The service principal key is stored as a SecureString but is visible in the JSON definition.. The service principal key is stored as a SecureString, but in the JSON definition it is visible as plain text, which is a security concern. Option A is incorrect because specifying the subscription ID and resource group is necessary for resource management and not a security issue. Option B is incorrect because using a service principal is a valid and secure authentication method when the key is properly stored. Option C is incorrect because the choice between Data Lake Storage Gen1 and Gen2 is a performance or feature decision, not a security concern.

Answer

The subscription ID and resource group are specified.

Answer

The linked service uses a service principal instead of a managed identity.

Answer

Using Azure Data Lake Storage Gen1 instead of Gen2.

Question 14

Your team is running a critical Azure Stream Analytics job that writes results to Azure SQL Database. Recently, the job has been failing with high latency and occasional data loss. You need to monitor the job's performance and set up alerts for when the watermark delay exceeds a threshold. What should you use?

Accepted Answer

Azure Monitor metrics for the Stream Analytics job.. Azure Monitor provides built-in metrics for Azure Stream Analytics jobs, including the watermark delay metric, which can be used to set up alerts. Option A is incorrect because Application Insights SDK integration is not supported for Stream Analytics jobs; monitoring is done via Azure Monitor metrics. Option B is incorrect because while Log Analytics can store diagnostics logs, it does not directly expose the watermark delay metric for alerting. Option D is incorrect because Azure Data Explorer is a data exploration service, not a monitoring tool for Stream Analytics.

Answer

Application Insights SDK integration in the job.

Answer

Azure Log Analytics workspace connected to the job diagnostics logs.

Answer

Azure Data Explorer for querying job performance data.

Question 15

You are configuring Azure Synapse Analytics dedicated SQL pool. To optimize query performance for a large fact table that is frequently filtered on date and region columns, which table distribution and indexing strategy should you recommend?

Accepted Answer

Hash distribution on region column with clustered columnstore index.. The best recommendation because hash distribution on the region column evenly distributes the data across distributions (assuming high cardinality), and clustering with a columnstore index provides excellent compression and query performance for large fact tables, especially when filtered on non-distribution columns like date. Option A (hash on date) risks data skew if date cardinality is low. Option B (replicated) is designed for small dimension tables, not large fact tables. Option C (round-robin) distributes rows randomly, preventing partition elimination and reducing filter performance.

Answer

Hash distribution on date column with clustered index.

Answer

Replicated distribution with heap index.

Answer

Round-robin distribution with clustered index.