Secure, monitor, and optimize data storage and data processing →hardMultiple ChoiceObjective-mapped

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-01-01",
      "name": "storagedatalakeprod",
      "kind": "StorageV2",
      "properties": {
        "isHnsEnabled": true,
        "encryption": {
          "keySource": "Microsoft.Keyvault",
          "keyvaultproperties": {
            "keyuri": "https://kv-prod.vault.azure.net/keys/datalake-key/abc123"
          }
        },
        "networkAcls": {
          "defaultAction": "Deny",
          "virtualNetworkRules": [
            {
              "id": "/subscriptions/.../virtualNetworks/vnet-prod/subnets/subnet-databricks"
            }
          ],
          "ipRules": []
        }
      }
    }
  ]
}

Refer to the exhibit. You deploy the ARM template to create a storage account. After deployment, a developer reports that they cannot access the storage account from an Azure Databricks notebook running in the same virtual network as specified in the subnet rule. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Databricks cluster is not using a managed virtual network with a service endpoint to the storage account.

The storage account firewall is configured with a default deny and a subnet rule allowing traffic from a specific virtual network subnet. For an Azure Databricks notebook to access the storage account, the Databricks workspace must be deployed with a managed virtual network and the cluster must use that same subnet with a service endpoint to the storage account. If the Databricks cluster is not using a managed virtual network or the subnet is not correctly configured, the traffic will be blocked. Option A is incorrect because customer-managed keys from Key Vault do not block access; they are for encryption. Option B is incorrect because the firewall's default deny is expected, but the subnet rule should allow traffic from the Databricks VNet, not the cluster's public IP (Databricks clusters in a managed VNet use private IPs). Option D is incorrect because hierarchical namespace (ADLS Gen2) does not block access; it enables it.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The storage account uses customer-managed keys from Key Vault, which requires additional permissions.
Why it's wrong here
Incorrect. Customer-managed keys from Key Vault do not block access; they are used for encryption at rest and require additional permissions but are not the likely reason for the access issue.
✗
The firewall default action is Deny, and there are no IP rules allowing the Databricks cluster's public IP.
Why it's wrong here
Incorrect. The firewall default action is Deny, but the subnet rule should allow traffic from the Databricks managed VNet. The Databricks cluster's public IP is not relevant if it is using a managed VNet with private IPs.
✓
The Databricks cluster is not using a managed virtual network with a service endpoint to the storage account.
Why this is correct
Correct. The most likely reason is that the Databricks cluster is not using a managed virtual network with a service endpoint to the storage account, so traffic from the cluster is not recognized as coming from the allowed subnet.
✗
The storage account has hierarchical namespace enabled, which blocks non-ADLS Gen2 tools.
Why it's wrong here
Incorrect. Hierarchical namespace (ADLS Gen2) does not block access; it enables data lake storage features and is compatible with Databricks.

Visual reference

Go deeper

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question