Design and implement data storage →mediumMultiple Choice

DP-203 Design and implement data storage Practice Question

Exhibit

Refer to the exhibit.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Synapse/workspaces",
      "apiVersion": "2021-06-01",
      "name": "myworkspace",
      "location": "eastus",
      "properties": {
        "defaultDataLakeStorage": {
          "accountUrl": "https://mystorageaccount.dfs.core.windows.net",
          "filesystem": "synapse"
        },
        "sqlAdministratorLogin": "admin",
        "sqlAdministratorLoginPassword": "P@ssw0rd123!",
        "managedVirtualNetwork": "default"
      },
      "identity": {
        "type": "SystemAssigned"
      }
    }
  ]
}

Refer to the exhibit. An ARM template deploys an Azure Synapse Analytics workspace. What is the purpose of the 'managedVirtualNetwork' property set to 'default'?

⚠ Common exam trap

Candidates often confuse 'managedVirtualNetwork' with directly creating private endpoints or disabling public access, when in fact it is the prerequisite that enables the workspace to use a managed virtual network for network isolation, with private endpoints and public network access controls being separate configurations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It enables the workspace to use a managed virtual network for network isolation

Setting 'managedVirtualNetwork' to 'default' in an ARM template for Azure Synapse Analytics enables a managed virtual network that provides network isolation for the workspace. This allows the workspace to use private endpoints and managed private endpoints for secure data integration without exposing traffic to the public internet. It is a foundational setting for implementing a secure, network-isolated Synapse environment.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It configures the workspace to use a user-assigned managed identity
Why it's wrong here
managedVirtualNetwork governs the workspace's network isolation boundary, not identity. A user-assigned managed identity is configured through the workspace's identity property. That identity setting is the correct choice when the workspace must authenticate to resources such as storage accounts using a pre-created identity.
✗
It disables public network access to the workspace
Why it's wrong here
managedVirtualNetwork controls outbound traffic isolation from the workspace, not inbound public access. Disabling public network access is achieved through a separate workspace property. That setting is the correct choice when the workspace must be reachable only via private endpoints.
✗
It creates the workspace in a private endpoint configuration
Why it's wrong here
Setting managedVirtualNetwork to default provisions an Azure Synapse-managed virtual network with managed private endpoints inside it; it does not itself create a private endpoint configuration for the workspace. Private endpoints are the right choice when clients must reach the workspace over a private IP.
✓
It enables the workspace to use a managed virtual network for network isolation
Why this is correct
Setting 'managedVirtualNetwork' to 'default' provisions a managed virtual network for the workspace, isolating Synapse compute from other Azure services and the public internet. This satisfies the stem's network isolation requirement, ensuring integration runtimes and Spark pools communicate privately within Microsoft-managed infrastructure rather than traversing public endpoints.

Go deeper

DP-203 Design and implement data storage Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question