You are monitoring an Azure Data Lake Storage Gen2 account using Metrics and Audit logs. You notice that the 'Ingress' metric shows a sudden spike but the 'Egress' metric remains stable. There are no new storage events in the audit log. What is the most likely cause?
Writes increase ingress, and if the pipeline is using staging or intermediate storage, it may not log each write as a separate storage event.
Why this answer
Option C is correct because an Azure Data Factory pipeline writing intermediate results to the storage account would cause a spike in 'Ingress' (data written into the account) without a corresponding increase in 'Egress' (data read from the account). The absence of new storage events in the audit log suggests the writes are not triggering blob-level events (e.g., BlobCreated events), which is consistent with Data Factory writing intermediate files using the Azure Blob Storage REST API or SDK without enabling event grid notifications for those specific operations.
Exam trap
The trap here is that candidates confuse 'Ingress' with 'Egress' or assume any write operation must generate a storage event, but Azure Storage events are opt-in and not all write operations (e.g., Data Factory intermediate writes) are configured to emit them.
How to eliminate wrong answers
Option A is wrong because geo-redundant storage (GRS) replication is asynchronous and occurs at the storage system level, not as user-visible 'Ingress' or 'Egress' metrics; replication traffic is internal and does not appear in the account's ingress/egress metrics. Option B is wrong because a Spark job reading data in parallel would increase 'Egress' (data read from storage), not 'Ingress', and the question states Egress remains stable. Option D is wrong because an Azure Function triggered by blob creation events would generate new storage events in the audit log (e.g., BlobCreated events), but the question explicitly states there are no new storage events.