Develop data processing →hardMultiple ChoiceObjective-mapped

DP-203 Develop data processing Practice Question

Exhibit

Refer to the exhibit. The following is an Azure CLI output after running a command on a Synapse Analytics workspace:

{
  "name": "myworkspace",
  "type": "Microsoft.Synapse/workspaces",
  "location": "eastus",
  "properties": {
    "defaultDataLakeStorage": {
      "accountUrl": "https://mydatalake.dfs.core.windows.net",
      "filesystem": "myfilesystem"
    },
    "sqlAdministratorLogin": "adminuser",
    "managedResourceGroupName": "managedRG",
    "provisioningState": "Succeeded",
    "privateEndpointConnections": []
  }
}

Refer to the exhibit. You have an Azure Synapse Analytics workspace. You need to ensure that data processing jobs can access the Data Lake Storage Gen2 account using a managed identity. What should you do?

⚠ Common exam trap

A common mix-up: candidates confuse network-level access controls (firewall rules or private endpoints) with identity-based authorization (RBAC), mistakenly thinking that allowing network traffic alone is sufficient for data access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable the system-assigned managed identity on the Synapse workspace and assign it the 'Storage Blob Data Contributor' role on the storage account

Azure Synapse Analytics supports system-assigned managed identities, which provide a secure, passwordless authentication method for accessing Azure Data Lake Storage Gen2. By enabling the managed identity on the Synapse workspace and assigning it the 'Storage Blob Data Contributor' role, you grant the workspace's data processing jobs the necessary permissions to read, write, and delete data in the storage account without managing credentials.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use the SQL admin login credentials to access the storage account
Why it's wrong here
SQL admin login is for SQL pool access, not storage.
✓
Enable the system-assigned managed identity on the Synapse workspace and assign it the 'Storage Blob Data Contributor' role on the storage account
Why this is correct
The managed identity needs RBAC permissions on the storage account.
✗
Create a private endpoint connection between the workspace and the storage account
Why it's wrong here
Private endpoint secures network traffic but does not grant data plane permissions.
✗
Configure the storage account firewall to allow access from the Synapse workspace
Why it's wrong here
Firewall settings allow network access but do not grant data permissions.

Go deeper

DP-203 Develop data processing Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question