Develop data processing →hardMultiple Choice

DP-203 Develop data processing Practice Question

Exhibit

Refer to the exhibit. The following is an Azure CLI output after running a command on a Synapse Analytics workspace:

{
  "name": "myworkspace",
  "type": "Microsoft.Synapse/workspaces",
  "location": "eastus",
  "properties": {
    "defaultDataLakeStorage": {
      "accountUrl": "https://mydatalake.dfs.core.windows.net",
      "filesystem": "myfilesystem"
    },
    "sqlAdministratorLogin": "adminuser",
    "managedResourceGroupName": "managedRG",
    "provisioningState": "Succeeded",
    "privateEndpointConnections": []
  }
}

Refer to the exhibit. You have an Azure Synapse Analytics workspace. You need to ensure that data processing jobs can access the Data Lake Storage Gen2 account using a managed identity. What should you do?

⚠ Common exam trap

A common mix-up: candidates confuse network-level access controls (firewall rules or private endpoints) with identity-based authorization (RBAC), mistakenly thinking that allowing network traffic alone is sufficient for data access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable the system-assigned managed identity on the Synapse workspace and assign it the 'Storage Blob Data Contributor' role on the storage account

Azure Synapse Analytics supports system-assigned managed identities, which provide a secure, passwordless authentication method for accessing Azure Data Lake Storage Gen2. By enabling the managed identity on the Synapse workspace and assigning it the 'Storage Blob Data Contributor' role, you grant the workspace's data processing jobs the necessary permissions to read, write, and delete data in the storage account without managing credentials.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use the SQL admin login credentials to access the storage account
Why it's wrong here
SQL admin credentials authenticate the SQL pool, not the workspace's managed identity, and Synapse cannot use them to obtain an Entra token for storage. It tempts because admins already hold these credentials, but the requirement is credential-free access via the workspace's managed identity.
✓
Enable the system-assigned managed identity on the Synapse workspace and assign it the 'Storage Blob Data Contributor' role on the storage account
Why this is correct
A system-assigned managed identity gives the Synapse workspace a Microsoft Entra ID service principal, and granting it Storage Blob Data Contributor on the account authorises read and write access to blob data without storing secrets.
✗
Create a private endpoint connection between the workspace and the storage account
Why it's wrong here
A private endpoint gives network-level private connectivity, not identity-based authorisation; the managed identity still needs a role assignment on the storage account. It tempts because private endpoints are the standard fix for public network exposure, but the requirement here is credential-free authentication, not network isolation.
✗
Configure the storage account firewall to allow access from the Synapse workspace
Why it's wrong here
Firewall rules govern network reachability only; they grant no identity or permission, so the managed identity still lacks a role assignment on the storage account. It tempts because firewall configuration is the usual fix for blocked storage access, but authorisation, not connectivity, is the missing piece.

Go deeper

DP-203 Develop data processing Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question