easyMultiple ChoiceObjective-mapped
DP-203 Practice Question: A manufacturing company uses Azure Data Lake…
A manufacturing company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled and Azure Databricks for analytics. The security team requires that all data stored in the 'raw' container be encrypted at rest using customer-managed keys. The data is ingested via Azure Data Factory. What should the data engineer configure to meet the requirement?
⚠ Common exam trap
A common mix-up: candidates confuse encryption at rest (which is always enabled by default) with the specific requirement for customer-managed keys, leading them to pick Azure Policy or 'require secure transfer' as a catch-all security measure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the storage account to use Azure Key Vault for customer-managed key encryption.
Azure Data Lake Storage Gen2 with hierarchical namespace supports encryption at rest using customer-managed keys (CMK) via Azure Key Vault. To meet the security requirement, the data engineer must configure the storage account's encryption settings to use a key from Azure Key Vault, which allows the organization to control and rotate the encryption keys independently of Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign an Azure Policy that requires encryption at rest.
Why it's wrong here
Policy can enforce the setting but does not configure the key.
- ✗
Enable Azure Information Protection on the storage account.
Why it's wrong here
Azure Information Protection is for data classification, not encryption at rest.
- ✓
Configure the storage account to use Azure Key Vault for customer-managed key encryption.
Why this is correct
This enables encryption at rest with a customer-managed key.
- ✗
Enable the 'require secure transfer' setting on the storage account.
Why it's wrong here
This enforces HTTPS, not encryption at rest.
Go deeper
Related to this question
Learn chapter
Introduction to Azure Data Engineering
Key term
Azure Databricks
Azure Databricks is a fast, easy, and collaborative Apache Spark-based analytics platform optimized for Azure that lets data teams prepare data, run machine learning models, and build data pipelines using a single workspace.
Key term
Azure Data Factory
Azure Data Factory is a cloud-based data integration service that lets you create, schedule, and orchestrate data pipelines to move and transform data from various sources to destinations.
About these practice questions
One of 760 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.