CCNA Secure, monitor, and optimize data storage and data processing Questions

Option A is correct because private endpoints ensure data traffic does not traverse the public internet. Option C is correct because ACLs provide fine-grained access control at the directory/file level. Option B is wrong because cross-origin resource sharing (CORS) is for web applications, not security.

Option D is wrong because a default ACL of 'read' for all authenticated users would grant broad access. Option E is wrong because large file shares are for Azure Files, not ADLS Gen2.

Option A is correct because Azure Monitor alerts can be configured on Data Factory metrics like 'Failed pipeline runs'. Option B is wrong because custom logging in a sink requires additional effort. Option C is wrong because diagnostic settings send logs to a workspace, but alerts are easier with metrics.

Option D is wrong because Application Insights is not natively integrated with Data Factory for pipeline runs.

Correct answers: A and C. A: Managed identity is a recommended method for Azure services. C: Service principal is another common method.

B is wrong because storage account key is not recommended for production due to security risks. D is wrong because SAS tokens are less secure and have expiration. E is wrong because user password is not supported.

Option B is correct because Azure Storage lifecycle management policies can automatically delete blobs based on age. Option A is wrong because Azure Purview is for governance, not deletion. Option C is wrong because Azure Data Factory can be scheduled to delete, but lifecycle management is simpler.

Option D is wrong because Azure Policy enforces rules, not automated deletion.

Option D is correct because Azure Storage encryption with customer-managed keys in Key Vault provides control and logging. Option A is wrong because Microsoft-managed keys are the default but do not provide customer control. Option B is wrong because client-side encryption requires managing keys on the client side.

Option C is wrong because infrastructure encryption adds a second layer but does not use customer-managed keys.

Option C is correct because the Stream Analytics job's managed identity must be added as a trusted service to bypass the network restrictions. Option A is wrong because firewall rules apply to all services; managed identity must be explicitly allowed. Option B is wrong because private endpoints require additional configuration and are not required.

Option D is wrong because SAS tokens are not needed with managed identity.

Option C is correct because RBAC permissions are additive. The user has Storage Blob Data Contributor at the root scope, which grants read/write access to all directories. The reader role at the directory scope does not override the broader contributor role.

Option A is wrong because the user has write access via the root scope. Option B is wrong because the user has read access from the root scope already. Option D is wrong because the user has explicit permissions.

Option B is correct because Azure Monitor alerts on pipeline run metrics can trigger notifications based on failure conditions. Option A is wrong because Azure Log Analytics itself does not send alerts; it stores logs. Option C is wrong because Azure Service Health alerts are for Azure service issues, not pipeline failures.

Option D is wrong because Microsoft Defender XDR is for security, not pipeline monitoring.

Option A is correct because Azure Data Lake Storage Gen2 supports soft delete for blobs. Option B is wrong because Azure Backup is for VM and other sources, not for Data Lake. Option C is wrong because versioning is different from soft delete.

Option D is wrong because Azure Resource Manager locks prevent resource deletion, not data deletion.

Option D is correct because cluster policies in Azure Databricks allow admins to define rules (e.g., auto-termination) while allowing users to choose different values within allowed limits. Option A is wrong because manual termination is not automatic. Option B is wrong because cluster policies are not enforced by Azure Policy.

Option C is wrong because auto-termination is a cluster-level setting, not a global policy.

Option C is correct because Microsoft Entra ID authentication is required, and diagnostic settings audit API calls. Option A is wrong because VNet injection is for network isolation, not authentication or auditing. Option B is wrong because personal access tokens bypass Entra ID.

Option D is wrong because Azure Private Link is for private connectivity.

Option A is correct because enabling secure output prevents sensitive data from being written to logs. Option B is wrong because data flow debug logs are for debugging, not for masking. Option C is wrong because Azure Key Vault stores secrets but does not mask pipeline logs.

Option D is wrong because setting a TTL does not prevent sensitive data exposure.

Option A is correct because Purview's scanning and classification rules automatically detect sensitive data. Option B is wrong because sensitivity labels in Microsoft Purview Information Protection are applied manually or via policy, not automatically by Purview scanning. Option C is wrong because Azure Policy enforces resource compliance, not data classification.

Option D is wrong because Defender for Cloud is for security posture, not data classification.

Option D is correct because Delta Lake's auto-optimize feature automatically compacts small files during writes. Option A is wrong because OPTIMIZE is a manual command. Option B is wrong because Z-order is for data skipping, not compaction.

Option C is wrong because vacuum removes old files, not compacts.

Option C is correct because 'Queued queries' metric directly shows the number of queries waiting due to concurrency limits. Option A is wrong because DWU percentage shows resource usage, not queuing. Option B is wrong because active queries show running queries.

Option D is wrong because memory percentage shows memory pressure.

Option C is correct because using workload classification and assigning a lower importance to background queries can allow critical queries to run while reducing slot consumption for non-critical ones. Option A is wrong because scaling up increases cost and may not be necessary. Option B is wrong because workload groups can limit resources but do not directly increase concurrency slots.

Option D is wrong because changing distribution does not affect concurrency slots.

Option A is correct because Synapse Studio provides monitoring dashboards for serverless SQL pool. Option B is wrong because Azure Monitor Metrics can show some metrics but not query-level details. Option C is wrong because Log Analytics can be used but requires diagnostic settings.

Option D is wrong because Query Performance Insight is for dedicated SQL pool.

Option C is correct because the existence condition checks if a diagnostic setting of category 'StorageRead' exists, but the policy should check for any diagnostic setting. Option A is wrong because the policy type is custom, but that doesn't cause the issue. Option B is wrong because the effect is parameterized and default is AuditIfNotExists, which should work.

Option D is wrong because the field check for type is correct.

Option B is correct because enabling pipeline logging to a storage account captures all activity, and retry policy in activities handles transient failures. Option A is wrong because Azure Monitor can monitor but does not log pipeline activities. Option C is wrong because Azure SQL Database audit is for database access, not pipeline.

Option D is wrong because event-based trigger does not provide logging or retry.

Option C is correct because a partitioned table on the date column allows partition elimination. Option A is wrong because a clustered columnstore index is good for scans but partition elimination is more effective for filtering. Option B is wrong because round-robin distribution does not help with filtering.

Option D is wrong because a nonclustered index on date may help but partition elimination is more effective for large scans.

Options B and D are correct. DMVs provide detailed query execution statistics, and Azure Monitor with Log Analytics can store and analyze performance data. Option A is wrong because Azure Advisor provides recommendations but not real-time monitoring.

Option C is wrong because SQL Data Sync is for synchronization. Option E is wrong because Azure Policy is for governance.

Option D is correct because ACLs provide granular permissions at the file and directory level. Option A is wrong because Azure RBAC is at the subscription/resource group level, not granular. Option B is wrong because shared keys provide full access.

Option C is wrong because SAS tokens with stored access policies provide limited granularity but are not as flexible as ACLs.

Option D is correct because sys.dm_pdw_exec_requests contains the total_request_memory_granted column that can be used to identify queries with large memory grants. Option A is wrong because it shows only waits, not memory grants. Option B is wrong because it shows resource class membership, not current memory usage.

Option C is wrong because it shows workload group settings, not actual grants.

Options A, C, and E are correct. Using Parquet improves compression and query performance; partitioning by date allows partition pruning; using a naming convention that avoids high cardinality directories prevents throttling. Option B is wrong because hierarchical namespace is required for ADLS Gen2 and is not a best practice to disable.

Option D is wrong because a deep directory structure can cause performance issues.

Option A is correct because using a self-hosted integration runtime with staging via Azure Blob Storage allows you to stage the data in Azure and then copy to Synapse, which is faster over limited bandwidth. Option B (copy activity directly) is slower. Option C (Azure Data Lake Storage) is similar but staging is more efficient.

Option D (Azure ExpressRoute) requires additional setup and cost.

Option D is correct because increasing the Streaming Units (SUs) allocates more compute resources to the job, improving throughput. Option A (change output to blob) changes architecture. Option B (decrease event size) is not always possible.

Option C (use reference data) does not affect throughput.

Option C is correct because ADLS Gen2 supports encryption at rest with customer-managed keys via Azure Key Vault. Option A is wrong because Azure Information Protection is for labeling, not encryption at rest. Option B is wrong because Azure Disk Encryption is for VMs.

Option D is wrong because Azure Storage Service Encryption uses Microsoft-managed keys by default; customer-managed keys require Key Vault.

Option A is correct because blob soft delete allows recovery of deleted blobs within a specified retention period. Option B is wrong because container soft delete is for entire containers, not individual blobs. Option C is wrong because Azure Backup is for VM backups, not blob recovery.

Option D is wrong because snapshots are manual and not automatic.

Option C is correct because enabling staged copy with staging storage can improve performance by allowing parallel uploads and retries. Option A is wrong because increasing DIUs may increase cost. Option B is wrong because increasing the number of concurrent connections on SQL Server might not be the bottleneck.

Option D is wrong because using PolyBase is for loading into Azure Synapse or SQL DW, not Blob Storage.

Option D is correct because DLT pipelines support exactly-once processing and handle late data via watermarking and append-only or update modes. Option A is wrong because 'Trigger once' processes data one time only, not continuous. Option B is wrong because 'Continuous' mode processes data as it arrives but may not guarantee exactly-once without proper configuration.

Option C is wrong because 'File arrival' is not a DLT setting.

Option A is correct because Azure SQL Database auditing captures database events including SELECT statements. Option B is wrong because vulnerability assessment scans for security issues but does not audit. Option C is wrong because TDE encrypts data at rest.

Option D is wrong because Azure Defender for SQL provides security alerts but not detailed audit logs.

Options A, B, and D are correct. A ensures data is encrypted at rest using AES-256. B provides data integrity for data in transit.

D provides network-level security. C is wrong because Azure Information Protection is for classification, not a built-in storage security feature. E is wrong because Azure Policy is for governance, not data protection.

Option D is correct because the default action is Deny, and only traffic from the specified subnet is allowed. The developer's Databricks notebook might be using a cluster that is not using a managed virtual network or is not in that subnet. Option A is wrong because HNS enabled does not block access.

Option B is wrong because firewall is correctly set to Deny with a rule for the subnet. Option C is wrong because the key vault encryption doesn't block access.

Options A and C are correct. File pruning reduces data scanned by skipping irrelevant files. Partition elimination reduces data scanned by skipping irrelevant partitions.

Option B is wrong because materialized views store pre-computed data but do not reduce scan on source. Option D is wrong because result-set caching caches query results but does not reduce data scanned for new queries. Option E is wrong because enabling auto-optimize is for Delta Lake, not serverless SQL.

Azure RBAC roles like Storage Blob Data Contributor grant read/write/delete permissions. To differentiate write and delete, you need ACLs that allow read/execute on the container and read/write on the directory, but not delete. Option A (Storage Blob Data Contributor) includes delete.

Option B (Storage Blob Data Reader) is read-only. Option D (Storage Blob Delegator) is not a built-in role.

Options A, C, and E are correct. Option A: DWU usage indicates how much of the allocated resources are used. Option C: Queued queries indicate concurrency bottlenecks.

Option E: tempdb usage can cause performance issues. Option B is wrong because storage size is capacity, not performance. Option D is wrong because login failures are security, not performance.

Option C is correct because ACLs (Access Control Lists) can be set at the folder level in ADLS Gen2 to grant granular permissions to specific directories. Option A is wrong because RBAC roles at the container level apply to the entire container. Option B is wrong because SAS tokens grant access at the container or file level, not folder level.

Option D is wrong because shared key is account-level access.

Option A is correct because using a user-assigned managed identity for Databricks to access storage eliminates the need for access keys. Option B is wrong because key rotation would disrupt jobs that rely on keys. Option C is wrong because SAS tokens with expiry still require token management and rotation.

Option D is wrong because storing keys in Key Vault does not prevent job interruption during rotation.

Option C is correct because Azure Monitor provides metrics and alerts for Stream Analytics jobs. Option A is wrong because Azure Log Analytics ingests logs but is not primarily for real-time metric alerts. Option B is wrong because Microsoft Sentinel is a SIEM.

Option D is wrong because Azure Advisor provides recommendations but not real-time monitoring and alerts for resource utilization.

Azure Monitor provides metrics and logs for ADF, and Log Analytics allows querying and alerting based on logs. Option C is wrong because Microsoft Sentinel is a SIEM that ingests from Log Analytics, not directly. Option D is wrong because Azure Policy is for governance.

Option E is wrong because Azure Advisor provides recommendations, not monitoring.

Option D is correct because Azure Synapse Analytics dedicated SQL pool does not support auto-pause; auto-pause is only for serverless SQL pools. Option A (auto-pause setting) is for serverless. Option B (Azure Automation runbook) could work but is not a built-in feature.

Option C (Azure Functions) is custom. The correct answer is that you cannot configure auto-pause for dedicated SQL pool.

Option C is correct because Transparent Data Encryption (TDE) encrypts data at rest in the dedicated SQL pool, and TLS ensures encryption in transit. Option A is wrong because Always Encrypted is for column-level encryption, not for the entire pipeline. Option B is wrong because Azure Disk Encryption is for IaaS VMs, not for Azure Synapse.

Option D is wrong because client-side encryption is not built-in for Synapse ingestion.

Option B is correct because sys.dm_pdw_exec_requests provides query execution details including memory and duration. Option A is wrong because sys.dm_pdw_nodes is for node-level info. Option C is wrong because sys.dm_pdw_resource_waits shows waits, not memory usage.

Option D is wrong because sys.dm_pdw_waits shows wait types, not memory consumption.

Options A and D are correct. A: Enabling firewall and virtual network rules restricts network access. D: Using managed identity for authentication avoids storing credentials.

Option B is wrong because Azure AD passthrough is only for dedicated SQL pools, not serverless. Option C is wrong because service principal is less secure than managed identity. Option E is wrong because shared access signatures should be avoided for security.

Option A is correct because sys.dm_exec_requests shows currently executing requests in serverless SQL pool. Option B is wrong because sys.dm_exec_sessions shows sessions, not executing queries. Option C is wrong because sys.dm_exec_query_stats shows cumulative statistics.

Option D is wrong because sys.dm_resource_governor_workload_groups shows workload group configuration.

Option C is correct because Purview requires a system-assigned managed identity (or user-assigned) to be enabled on the ADX cluster and granted permissions. Option A (firewall) could be a cause, but the error is authentication specifically. Option B (region mismatch) is not a common issue.

Option D (incorrect database) would cause a different error.

Option B is correct because Data Factory data flows allow column-level transformations including data masking. Option A is wrong because copy activity only copies data without transformation. Option C is wrong because stored procedures run on the source, not during copy.

Option D is wrong because staging is for bulk copy performance, not masking.

Options B and C are correct. Diagnostic settings in storage accounts capture logs, and Azure Monitor integrates with Microsoft Sentinel for security monitoring. Option A is wrong because Azure Policy is for compliance, not auditing data access.

Option D is wrong because Microsoft Entra ID is for identity, not logging. Option E is wrong because Azure Backup is for data protection, not auditing.

Option D is correct because diagnostic settings send logs to Log Analytics, and Azure Monitor alerts can be created to detect unauthorized access. Option A is wrong because Azure Policy is for governance, not real-time alerts. Option B is wrong because RBAC is for access control, not monitoring.

Option C is wrong because Azure Sentinel is for SIEM, but simpler solution is Log Analytics alerts.

Options A and D are correct. Azure Monitor is the primary service for monitoring and alerts; Azure Data Factory metrics and logs are sent to Azure Monitor. Option B is wrong because Azure Sentinel is for security, not pipeline monitoring.

Option C is wrong because Log Analytics is part of Azure Monitor but not the service name for alerting. Option E is wrong because Azure Automation is for automation, not monitoring.

Option B is correct because Azure Monitor with alerts and Log Analytics provides historical analysis and alerting. Option A (Data Factory Monitor) is for real-time monitoring but lacks long-term trend analysis. Option C (Azure Dashboard) is a visualization tool.

Option D (Event Grid) is for event-driven notifications, not analysis.

Option A is correct: Transparent Data Encryption (TDE) encrypts data at rest without application changes. Option D is correct: Always Encrypted protects sensitive columns with client-side encryption. Option B (Dynamic Data Masking) is for masking data in query results, not at rest.

Option C (Azure RBAC) is for access control, not encryption. Option E (Column-level security) is for access control, not encryption.

Option A is correct because partitioning the data in the lake and using partition elimination reduces data read. Option B is wrong because OPENROWSET with CSV reads all files; it does not reduce data read. Option C is wrong because CETAS is for creating external tables, not for improving query performance directly.

Option D is wrong because increasing the number of compute nodes is not possible in serverless; it's auto-scaling.

Options A and C are correct. A: Storage Service Encryption (SSE) encrypts data at rest by default. C: Customer-managed keys in Azure Key Vault provide additional control over encryption keys.

Option B is wrong because Azure Disk Encryption is for VMs. Option D is wrong because TLS is for data in transit. Option E is wrong because Azure Information Protection is for classification, not encryption at rest.

Option A is correct because partitioning large tables can reduce data scanned. Option B is correct because materialized views precompute aggregations. Option D is correct because result-set caching speeds up repeated queries.

Option C is wrong because smaller distribution columns can cause data skew. Option E is wrong because converting to heap table is for staging data, not performance optimization.

The retry property in activity policy sets the number of retries, and retryIntervalInSeconds sets the delay. Option B is wrong because there is no 'maxRetries' property; it's 'retry'. Option C is wrong because 'retryPolicy' is not a property; retry is at the activity level.

Option D is wrong because timeout is separate from retry.

Option D is correct because Hash distribution on the business key (surrogate key source) ensures that matching rows are co-located, reducing data movement during MERGE. Option A is wrong because Round-robin distributes randomly, causing data movement. Option B is wrong because Replicated works for small tables, not 10 million rows.

Option C is wrong because Hash on an unrelated column does not help.

Options A, B, and D are correct. A: Diagnostic settings stream logs to Log Analytics. B: Microsoft Sentinel provides advanced security analytics.

D: Microsoft Defender for Storage detects anomalies. Option C is wrong because Azure Monitor Metrics do not include access logs. Option E is wrong because Azure Policy is for governance, not monitoring.

Option B is correct because Azure Data Lake Storage Gen2 supports POSIX-like ACLs that can be set on directory paths to grant granular permissions. Option A is wrong because RBAC roles are scoped to the entire storage account or container, not subdirectories. Option C is wrong because SAS tokens are scoped to the entire storage account or container.

Option D is wrong because access policies are for shared access signatures, not granular directory permissions.

Option A and D are correct: RBAC provides coarse-grained access control, and firewall rules restrict network access. Option B is wrong because Azure AD (Microsoft Entra ID) is used for authentication, but it's not a security feature specific to data protection. Option C is wrong because Azure Policy is for governance, not direct data protection.

Option E is wrong because Azure Monitor is for monitoring, not security.

Workload isolation is achieved by creating separate workload groups with minimum resource allocation. By setting minimum resources for the reporting workload group, it ensures a baseline of resources even during heavy ETL. Option A (increase DWU) is costly and may not isolate.

Option B (importance) helps but without min resources, high concurrency can still starve. Option D (change classifier) does not guarantee resources.

Option A is correct because Azure Storage encryption with customer-managed keys is configured at the storage account level. Option B is wrong because infrastructure encryption is an additional layer. Option C is wrong because client-side encryption is done by the application, not at rest.

Option D is wrong because Azure Policy can enforce encryption but does not configure it.

Option D is correct because Azure RBAC with ACLs allows fine-grained permissions at the directory and file level. Option A is wrong because SAS tokens grant time-limited access but are not fine-grained. Option B is wrong because managed identities provide identity-based access but still require RBAC or ACLs for fine-grained control.

Option C is wrong because firewall rules apply at the account level, not directory/file level.

Option B is correct because hash distribution on region spreads data evenly if region has high cardinality, and clustered columnstore index is optimal for large fact tables. Option A is wrong because round-robin distribution is for staging tables. Option C is wrong because heap index is for temporary data.

Option D is wrong because replicated distribution is for small dimension tables.

Options B and D are correct. Workload isolation and workload classification help manage resource allocation and reduce contention. Option A is wrong because increasing DWU may help but does not address contention directly.

Option C is wrong because result set caching helps read workloads but not contention. Option E is wrong because materialized views improve performance but do not reduce contention.

Option A is correct because a private endpoint for the storage account, combined with disabling public network access, ensures only the Synapse workspace can access it via the managed identity. Option B is wrong because firewall rules alone do not restrict access to a specific service. Option C is wrong because allowing trusted Microsoft services is broader than just Synapse.

Option D is wrong because managed identity alone does not restrict network access.

Option C is correct because workload management in Synapse allows you to assign queries to different workload groups with resource classes, preventing conflicts. Option A is wrong because scaling the pool adds cost and may not resolve the specific resource class conflict. Option B is wrong because result-set caching does not address concurrency issues.

Option D is wrong because materialized views improve query performance but do not resolve queuing.

Option D is correct because adding a retry policy with a short delay handles transient connection issues. Option A is wrong because increasing the number of parallel copies does not solve connection refused errors. Option B is wrong because Azure ExpressRoute is costly and unnecessary for FTP.

Option C is wrong because migrating to SFTP may not resolve connection refused if the server is overloaded.

Option B is correct because partitioning the data by a commonly filtered column, such as date, allows the serverless SQL pool to use partition elimination, reducing the amount of data scanned. Option A is wrong because increasing MAXDOP may not help and can cause resource contention. Option C is wrong because usingOPENROWSET with CSV is less efficient than Parquet.

Option D is wrong because materialized views are not supported in serverless SQL pool.

Options A and D are correct. TDE encrypts data at rest for dedicated SQL pool, and enabling double encryption provides additional protection. Option B is wrong because Always Encrypted is for client-side encryption, not at rest.

Option C is wrong because column-level encryption is for specific columns, not the whole pool. Option E is wrong because creating a customer-managed key is only part of TDE configuration, not a separate action.

Options A, B, and D are correct. A: Automated scanning classifies data. B: Labeling helps in applying sensitivity tags.

D: Microsoft Defender for Cloud Apps can monitor access and generate alerts. Option C is wrong because Azure Policy does not directly classify or monitor data access. Option E is wrong because Azure Sentinel is for security incident detection, not data classification.

Option C is correct because HTTPS ensures encryption in transit. Option A is wrong because encryption at rest does not cover transit. Option B is wrong because TLS is used for SQL connections, not for Data Lake.

Option D is wrong because Azure Firewall does not provide encryption.