DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Exhibit
{
"type": "Microsoft.Authorization/policyDefinitions",
"properties": {
"displayName": "Audit diagnostic setting for Azure Data Lake Storage Gen2",
"policyType": "Custom",
"description": "Audit if diagnostic setting is not configured for Data Lake Storage Gen2",
"parameters": {
"effect": {
"type": "String",
"allowedValues": ["AuditIfNotExists", "Deny", "Disabled"],
"defaultValue": "AuditIfNotExists"
}
},
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Insights/diagnosticSettings",
"existenceCondition": {
"field": "Microsoft.Insights/diagnosticSettings/logs[*].category",
"equals": "StorageRead"
}
}
}
}
}
}Refer to the exhibit. You are reviewing an Azure Policy definition that was created to audit diagnostic settings for Azure Data Lake Storage Gen2. The policy is assigned to a management group containing several storage accounts. You notice that the policy is not flagging storage accounts that lack diagnostic settings. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The existence condition incorrectly checks for a specific log category 'StorageRead' instead of any diagnostic setting.
The existence condition checks for a specific log category 'StorageRead' rather than checking for any diagnostic setting. Azure Policy for auditing diagnostic settings should verify that at least one diagnostic setting exists, not that a particular category is configured. This causes storage accounts with diagnostic settings that do not include 'StorageRead' (or with no settings at all) to not be flagged. Option B is incorrect because the 'field' property 'type' with value 'Microsoft.Storage/storageAccounts' is appropriate for auditing diagnostic settings on the storage account level, not blobServices. Option C is incorrect because the effect parameter defaults to 'AuditIfNotExists' even without explicit assignment, so that is not the issue. Option D is incorrect because custom policy type does not require special permissions beyond those needed to assign policies; evaluation occurs normally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The existence condition incorrectly checks for a specific log category 'StorageRead' instead of any diagnostic setting.
Why this is correct
The policy should audit if no diagnostic setting exists, not check for a specific category.
- ✗
The 'field' property in the 'if' condition should be 'type' equals 'Microsoft.Storage/storageAccounts/blobServices' for Data Lake.
Why it's wrong here
Data Lake Gen2 uses storage accounts.
- ✗
The effect parameter is not assigned a value; the default 'AuditIfNotExists' is not applied.
Why it's wrong here
Default value is used when not specified.
- ✗
The policy type is 'Custom', which requires special permissions to evaluate.
Why it's wrong here
Custom policies work like built-in ones.
Go deeper
Related to this question
About these practice questions
This DP-203 question is part of Courseiva's 760-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.