Secure, monitor, and optimize data storage and data processing →mediumMultiple ChoiceObjective-mapped

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

Refer to the exhibit.

{
  "properties": {
    "rules": [
      {
        "name": "AuditPolicy",
        "description": "Audit all events",
        "ruleState": "Enabled",
        "source": {
          "include": ["*"],
          "exclude": []
        },
        "target": {
          "include": ["*"],
          "exclude": []
        },
        "filter": {
          "predicate": "true"
        },
        "actions": [
          {
            "actionGroup": "ALL_ACTIONS"
          }
        ]
      }
    ]
  }
}

Refer to the exhibit. You are configuring an Azure Purview data policy for Azure Storage. The policy above is intended to audit all access events. However, the security team complains that not all read events are being audited. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The storage account is not enabled for Purview policy enforcement.

The security team reports that not all read events are being audited. The policy uses 'ALL_ACTIONS' which should include read events, so the issue is not with the action group or predicate. The most likely reason is that the storage account has not been enabled for Purview policy enforcement. Azure Purview requires the 'AllowPurviewPolicyEnforcement' property to be enabled on the storage account for policies to take effect. Without this, no auditing events are captured, even if the policy is correctly defined.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The filter predicate is set to 'true', which only captures a subset of events.
Why it's wrong here
The predicate 'true' includes all events, not a subset.
✓
The storage account is not enabled for Purview policy enforcement.
Why this is correct
Without enabling 'AllowPurviewPolicyEnforcement' on the storage account, Purview policies are not applied.
✗
The action group 'ALL_ACTIONS' does not include read events.
Why it's wrong here
'ALL_ACTIONS' includes all actions including read.
✗
The policy excludes the 'Read' action by default.
Why it's wrong here
The policy includes all actions.

Go deeper

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question