How should I use these Design and implement data security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Design and implement data security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design and implement data security domain.

DP-203 · topic practice

Design and implement data security practice questions

Practise Microsoft Azure Data Engineer Associate DP-203 Design and implement data security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design and implement data security

Practice 10 questions Browse domain →

What the exam tests

What to know about Design and implement data security

Design and implement data security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Design and implement data security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Design and implement data security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Design and implement data security explanation →

A company uses Azure Synapse Analytics dedicated SQL pool. They need to ensure that only users with a specific Azure AD group can query a particular schema. Which approach should they use?

Trap 1: Configure a server-level firewall rule to block other users.

Firewall rules control network access, not database permissions.

Trap 2: Create a row-level security policy on all tables in the schema.

Row-level security restricts rows, not schema access.

Trap 3: Apply dynamic data masking to the schema.

Dynamic data masking hides data but does not prevent querying the schema.

Study all Design and implement data security common traps →

A
Configure a server-level firewall rule to block other users.
Why wrong: Firewall rules control network access, not database permissions.
B
Use the GRANT statement to grant SELECT on the schema to the Azure AD group.
GRANT schema permission controls access at schema level.
C
Create a row-level security policy on all tables in the schema.
Why wrong: Row-level security restricts rows, not schema access.
D
Apply dynamic data masking to the schema.
Why wrong: Dynamic data masking hides data but does not prevent querying the schema.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Design and implement data security explanation →

You are designing data security for Azure Data Lake Storage Gen2. The requirement is to prevent data from being accessed by anyone outside the corporate network. Which feature should you enable?

Trap 1: Assign RBAC roles to deny access to all except corporate users.

RBAC controls access based on identity, not network location.

Trap 2: Configure IP firewall rules to allow only corporate IP ranges.

IP firewall allows specific IPs but not network-level restriction via VNet.

Trap 3: Enable encryption at rest using customer-managed keys.

Encryption protects data if accessed but does not restrict access.

Study all Design and implement data security common traps →

A
Use Azure Private Endpoint or service endpoint with a VNet.
Private endpoint ensures data is accessed only from within the VNet.
B
Assign RBAC roles to deny access to all except corporate users.
Why wrong: RBAC controls access based on identity, not network location.
C
Configure IP firewall rules to allow only corporate IP ranges.
Why wrong: IP firewall allows specific IPs but not network-level restriction via VNet.
D
Enable encryption at rest using customer-managed keys.
Why wrong: Encryption protects data if accessed but does not restrict access.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full NAT/PAT explanation →

A company uses Azure Data Factory to copy sensitive data from on-premises SQL Server to Azure Blob Storage. They must ensure that data is encrypted in transit and at rest. Which combination of features should they use?

Trap 1: Use Always Encrypted in SQL Server and customer-managed keys in…

Always Encrypted encrypts columns but not the entire data flow.

Trap 2: Set up a VPN between on-premises and Azure, and use Azure Disk…

VPN encrypts the connection but not data at rest; Disk Encryption is for VMs.

Trap 3: Use HTTPS for the copy activity and enable Azure Storage Service…

HTTPS is not sufficient; TLS is required for in-transit encryption.

Study all Design and implement data security common traps →

A
Use Always Encrypted in SQL Server and customer-managed keys in Blob Storage.
Why wrong: Always Encrypted encrypts columns but not the entire data flow.
B
Set up a VPN between on-premises and Azure, and use Azure Disk Encryption.
Why wrong: VPN encrypts the connection but not data at rest; Disk Encryption is for VMs.
C
Configure the copy activity to use TLS and enable Azure Storage Service Encryption.
TLS encrypts data in transit; Storage Service Encryption encrypts at rest automatically.
D
Use HTTPS for the copy activity and enable Azure Storage Service Encryption.
Why wrong: HTTPS is not sufficient; TLS is required for in-transit encryption.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Design and implement data security explanation →

You need to audit all data access to an Azure Storage account. Which Azure service should you enable?

Trap 1: Azure Policy to audit storage account access

Azure Policy audits compliance, not data access.

Trap 2: Azure Monitor metrics

Metrics provide performance, not detailed access logs.

Trap 3: Azure Security Center

Security Center provides security posture, not detailed audit logs.

Study all Design and implement data security common traps →

A
Azure Storage analytics logs and send to Log Analytics workspace
Storage logs capture access details; Log Analytics enables querying.
B
Azure Policy to audit storage account access
Why wrong: Azure Policy audits compliance, not data access.
C
Azure Monitor metrics
Why wrong: Metrics provide performance, not detailed access logs.
D
Azure Security Center
Why wrong: Security Center provides security posture, not detailed audit logs.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Design and implement data security explanation →

A company uses Azure Key Vault to store secrets for data pipelines. They need to rotate the secrets automatically every 90 days. What should they implement?

Trap 1: Use Azure Policy to enforce secret expiration.

Azure Policy enforces compliance but does not rotate.

Trap 2: Assign RBAC roles to a service principal to update the secret.

RBAC controls who can update, not automatic rotation.

Trap 3: Create a manual process to update the secret in Key Vault.

Manual process is not automatic.

Study all Design and implement data security common traps →

A
Use Azure Policy to enforce secret expiration.
Why wrong: Azure Policy enforces compliance but does not rotate.
B
Assign RBAC roles to a service principal to update the secret.
Why wrong: RBAC controls who can update, not automatic rotation.
C
Create a manual process to update the secret in Key Vault.
Why wrong: Manual process is not automatic.
D
Configure Key Vault secret rotation with an expiration date of 90 days.
Key Vault can automatically rotate secrets based on expiration.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Design and implement data security explanation →

Which TWO of the following are valid methods to secure data at rest in Azure Data Lake Storage Gen2?

Trap 1: Assign RBAC roles for data access

RBAC controls authorization, not encryption.

Trap 2: Configure storage firewall rules

Firewall restricts access, but does not encrypt data at rest.

Trap 3: Enable TLS 1.2 for all connections

TLS secures data in transit, not at rest.

Study all Design and implement data security common traps →

A
Assign RBAC roles for data access
Why wrong: RBAC controls authorization, not encryption.
B
Configure storage firewall rules
Why wrong: Firewall restricts access, but does not encrypt data at rest.
C
Use customer-managed keys in Azure Key Vault
Customer-managed keys provide additional control over encryption.
D
Use Azure Storage Service Encryption (SSE)
SSE encrypts data at rest automatically.
E
Enable TLS 1.2 for all connections
Why wrong: TLS secures data in transit, not at rest.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Design and implement data security explanation →

Which THREE of the following are required to implement column-level security in Azure Synapse Analytics dedicated SQL pool?

Trap 1: A VIEW that selects only the allowed columns

A VIEW is an alternative method but not required for column-level security.

Trap 2: A DENY statement on specific columns to users or roles

DENY is not required; absence of GRANT is enough to block access.

Trap 3: A row-level security policy must be in place

RLS is for rows, not columns.

Study all Design and implement data security common traps →

A
A GRANT statement on specific columns to users or roles
GRANT allows access to specified columns.
B
A VIEW that selects only the allowed columns
Why wrong: A VIEW is an alternative method but not required for column-level security.
C
A DENY statement on specific columns to users or roles
Why wrong: DENY is not required; absence of GRANT is enough to block access.
D
A row-level security policy must be in place
Why wrong: RLS is for rows, not columns.
E
The database user must have a default schema
A default schema is required for the user to access objects.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Design and implement data security explanation →

A company uses Azure Synapse Analytics with dedicated SQL pools. They need to allow a data scientist to read all tables in the 'sales' schema but prevent access to columns containing personally identifiable information (PII). Which feature should be used?

Trap 1: Dynamic data masking

Dynamic data masking obfuscates data but does not prevent access to the underlying data.

Trap 2: Row-level security

Row-level security filters rows based on user context, not columns.

Trap 3: Azure Active Directory authentication

Azure AD authentication controls identity, not column-level access.

Study all Design and implement data security common traps →

A
Dynamic data masking
Why wrong: Dynamic data masking obfuscates data but does not prevent access to the underlying data.
B
Row-level security
Why wrong: Row-level security filters rows based on user context, not columns.
C
Column-level security
Column-level security restricts access to specific columns based on user or role.
D
Azure Active Directory authentication
Why wrong: Azure AD authentication controls identity, not column-level access.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Design and implement data security explanation →

A company has an Azure Data Lake Storage Gen2 account. They want to ensure that only users with the 'Data Reader' role can access files in a specific container, while other users cannot list or read files. The storage account has hierarchical namespace enabled. What is the most secure and manageable approach?

Trap 1: Assign the Storage Blob Data Reader role at the storage account…

RBAC at account level applies to all containers; row-level security is not for storage.

Trap 2: Generate a shared access signature (SAS) token for each user

SAS tokens are less manageable and require token distribution.

Trap 3: Configure a storage firewall to allow only the Data Reader role's…

Firewall controls network access, not user-level permissions.

Study all Design and implement data security common traps →

A
Assign the Storage Blob Data Reader role at the storage account level and use row-level security
Why wrong: RBAC at account level applies to all containers; row-level security is not for storage.
B
Generate a shared access signature (SAS) token for each user
Why wrong: SAS tokens are less manageable and require token distribution.
C
Configure a storage firewall to allow only the Data Reader role's IP addresses
Why wrong: Firewall controls network access, not user-level permissions.
D
Set POSIX-like access control lists (ACLs) on the container folder for the Data Reader role
ACLs provide fine-grained permissions at the file/directory level for specific users/groups.

Full breakdown with real-world context →

Question 10easymultiple choice

Read the full Design and implement data security explanation →

You need to configure encryption for an Azure SQL Database to protect data at rest. Which Azure service or feature should you enable?

Trap 1: Dynamic Data Masking

Dynamic Data Masking hides data from non-privileged users but does not encrypt.

Trap 2: Always Encrypted

Always Encrypted encrypts sensitive data at the column level, not the entire database.

Trap 3: Azure Information Protection

Azure Information Protection is for classifying and protecting documents and emails.

Study all Design and implement data security common traps →

A
Dynamic Data Masking
Why wrong: Dynamic Data Masking hides data from non-privileged users but does not encrypt.
B
Always Encrypted
Why wrong: Always Encrypted encrypts sensitive data at the column level, not the entire database.
C
Azure Information Protection
Why wrong: Azure Information Protection is for classifying and protecting documents and emails.
D
Transparent Data Encryption (TDE)
TDE encrypts the database at rest automatically.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Design and implement data security explanation →

A company is using Azure Data Factory to copy data from an on-premises SQL Server to Azure Blob Storage. The data must be encrypted in transit using TLS 1.2. The on-premises SQL Server is configured to support TLS 1.2. Which Data Factory property should be configured?

Trap 1: The encryptedCredential property in the linked service

encryptedCredential stores encrypted credentials, not TLS settings.

Trap 2: The connectVia property in the linked service

connectVia specifies the integration runtime, not encryption.

Trap 3: The integrationRuntime property in the dataset

IntegrationRuntime specifies the runtime, not encryption settings.

Study all Design and implement data security common traps →

A
The encryptedCredential property in the linked service
Why wrong: encryptedCredential stores encrypted credentials, not TLS settings.
B
The typeProperties property in the linked service to include 'Encrypt=True' in the connection string
The connection string in typeProperties can include 'Encrypt=True' to enforce TLS encryption.
C
The connectVia property in the linked service
Why wrong: connectVia specifies the integration runtime, not encryption.
D
The integrationRuntime property in the dataset
Why wrong: IntegrationRuntime specifies the runtime, not encryption settings.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Design and implement data security explanation →

You are designing a data solution in Azure that requires all data in transit between Azure Databricks and Azure Storage to be encrypted using a customer-managed key. Which configuration meets this requirement?

Trap 1: Configure a service endpoint and a firewall rule to restrict access…

Service endpoints do not provide encryption; they provide network access control.

Trap 2: Create a customer-managed key in Azure Key Vault and assign it to…

Customer-managed keys are for encryption at rest, not in transit.

Trap 3: Set the minimum TLS version to 1.2 on the storage account

This enforces a TLS version but still uses Microsoft-managed keys, not customer-managed.

Study all Design and implement data security common traps →

A
Enable 'Secure transfer required' on the storage account
This ensures data is encrypted in transit with Microsoft-managed keys, not customer-managed. Customer-managed keys for transit are not supported; client-side encryption would be needed.
B
Configure a service endpoint and a firewall rule to restrict access to Azure Databricks
Why wrong: Service endpoints do not provide encryption; they provide network access control.
C
Create a customer-managed key in Azure Key Vault and assign it to the storage account for encryption
Why wrong: Customer-managed keys are for encryption at rest, not in transit.
D
Set the minimum TLS version to 1.2 on the storage account
Why wrong: This enforces a TLS version but still uses Microsoft-managed keys, not customer-managed.

Full breakdown with real-world context →

Question 13mediummulti select

Read the full Design and implement data security explanation →

Which TWO actions should you take to ensure that only authorized users can access sensitive data in an Azure Synapse Analytics dedicated SQL pool?

Trap 1: Configure Azure Active Directory authentication

Azure AD authentication controls who can connect, not what they can access.

Trap 2: Enable dynamic data masking on all columns

Dynamic data masking does not prevent access; it only masks data for non-privileged users.

Trap 3: Enable transparent data encryption

TDE encrypts data at rest but does not control user access.

Study all Design and implement data security common traps →

A
Configure Azure Active Directory authentication
Why wrong: Azure AD authentication controls who can connect, not what they can access.
B
Enable dynamic data masking on all columns
Why wrong: Dynamic data masking does not prevent access; it only masks data for non-privileged users.
C
Implement row-level security
Row-level security filters rows based on user identity to prevent unauthorized access.
D
Implement column-level security
Column-level security restricts access to specific columns containing sensitive data.
E
Enable transparent data encryption
Why wrong: TDE encrypts data at rest but does not control user access.

Full breakdown with real-world context →

Question 14hardmulti select

Read the full Design and implement data security explanation →

Which THREE components are part of a defense-in-depth strategy for data security in Azure?

Trap 1: Azure Policy to enforce tagging

Azure Policy is for governance and compliance, not a security layer.

Trap 2: Dynamic data masking for all databases

Dynamic data masking is a feature, not a defense-in-depth layer; it's part of access control.

Study all Design and implement data security common traps →

A
Azure Policy to enforce tagging
Why wrong: Azure Policy is for governance and compliance, not a security layer.
B
Network security groups (NSGs) on subnets
NSGs provide network-level security by filtering traffic.
C
Data classification and labeling
Data classification helps identify sensitive data and apply appropriate controls.
D
Encryption at rest for storage accounts
Encryption at rest protects data if physical media is compromised.
E
Dynamic data masking for all databases
Why wrong: Dynamic data masking is a feature, not a defense-in-depth layer; it's part of access control.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Design and implement data security explanation →

Refer to the exhibit. A custom RBAC role is defined as shown. A user is assigned this role at the resource group scope. Which operation can the user perform?

Exhibit

Refer to the exhibit.

{
  "RoleName": "CustomStorageReader",
  "Actions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/read"
  ],
  "NotActions": [],
  "AssignableScopes": [
    "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/DataRG"
  ]
}

Trap 1: Delete containers

Deleting containers requires 'Microsoft.Storage/storageAccounts/blobServices/containers/delete'.

Trap 2: Write blob data to containers

Writing requires 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'.

Trap 3: Read blob data from containers

Reading blob data requires 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'.

Study all Design and implement data security common traps →

A
Delete containers
Why wrong: Deleting containers requires 'Microsoft.Storage/storageAccounts/blobServices/containers/delete'.
B
Write blob data to containers
Why wrong: Writing requires 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'.
C
List containers in a storage account within DataRG
The action permits reading container properties and listing containers.
D
Read blob data from containers
Why wrong: Reading blob data requires 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'.

Full breakdown with real-world context →

Question 16hardmulti select

Read the full Design and implement data security explanation →

A company uses Azure Synapse Analytics with a dedicated SQL pool. Data engineers need to implement column-level security so that only users with the 'Manager' role can see salary columns. Which TWO actions should they take?

Trap 1: Create a stored procedure that checks the user's role and returns…

Stored procedures cannot be used as predicate functions; they must be inline table-valued functions.

Trap 2: Grant the 'Manager' role SELECT permission on the security policy.

Permissions on the security policy are not needed; the policy automatically applies based on the predicate function.

Trap 3: Use GRANT SELECT ON OBJECT::[dbo].[Employee](Salary) TO [Manager]…

Column-level permissions are not supported in dedicated SQL pools; use column-level security via a security policy.

Study all Design and implement data security common traps →

A
Create a stored procedure that checks the user's role and returns the appropriate columns.
Why wrong: Stored procedures cannot be used as predicate functions; they must be inline table-valued functions.
B
Grant the 'Manager' role SELECT permission on the security policy.
Why wrong: Permissions on the security policy are not needed; the policy automatically applies based on the predicate function.
C
Create a security policy with a filter predicate on the salary column using the function, and set the state to ON with BLOCK predicate.
The security policy with BLOCK prevents updates/inserts that would expose the column.
D
Create an inline table-valued function that returns 1 if the user is a member of the 'Manager' role, else 0.
The function is used as a filter predicate in the security policy.
E
Use GRANT SELECT ON OBJECT::[dbo].[Employee](Salary) TO [Manager] to grant access to the salary column.
Why wrong: Column-level permissions are not supported in dedicated SQL pools; use column-level security via a security policy.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Design and implement data security explanation →

A manufacturing company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled and Azure Databricks for analytics. The security team requires that all data stored in the 'raw' container be encrypted at rest using customer-managed keys. The data is ingested via Azure Data Factory. What should the data engineer configure to meet the requirement?

Trap 1: Assign an Azure Policy that requires encryption at rest.

Policy can enforce the setting but does not configure the key.

Trap 2: Enable Azure Information Protection on the storage account.

Azure Information Protection is for data classification, not encryption at rest.

Trap 3: Enable the 'require secure transfer' setting on the storage account.

This enforces HTTPS, not encryption at rest.

Study all Design and implement data security common traps →

A
Assign an Azure Policy that requires encryption at rest.
Why wrong: Policy can enforce the setting but does not configure the key.
B
Enable Azure Information Protection on the storage account.
Why wrong: Azure Information Protection is for data classification, not encryption at rest.
C
Configure the storage account to use Azure Key Vault for customer-managed key encryption.
This enables encryption at rest with a customer-managed key.
D
Enable the 'require secure transfer' setting on the storage account.
Why wrong: This enforces HTTPS, not encryption at rest.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Design and implement data security explanation →

A company uses Azure Synapse Analytics with a dedicated SQL pool. They need to ensure that a team of data scientists can query all tables in the 'sales' schema but cannot modify any data or schema objects. Which role should the team be assigned?

Trap 1: db_owner

db_owner has full control over the database.

Trap 2: db_ddladmin

db_ddladmin allows schema modifications.

Trap 3: db_datawriter

db_datawriter allows insert, update, delete operations.

Study all Design and implement data security common traps →

A
db_owner
Why wrong: db_owner has full control over the database.
B
db_datareader
db_datareader grants read access to all tables.
C
db_ddladmin
Why wrong: db_ddladmin allows schema modifications.
D
db_datawriter
Why wrong: db_datawriter allows insert, update, delete operations.

Full breakdown with real-world context →

Question 19hardmulti select

Read the full Design and implement data security explanation →

You are designing data security for an Azure Data Lake Storage Gen2 account that stores sensitive customer data. You need to ensure that only authorized users can access the data and that access can be audited. Which TWO actions should you implement?

Trap 1: Use storage account access keys (Shared Key) for authentication.

Shared Key does not provide per-user auditing and is less secure.

Trap 2: Generate shared access signatures (SAS) with a long expiry time.

Long-lived SAS tokens increase security risk.

Trap 3: Configure a firewall to allow access from all Azure services.

Allowing all Azure services may grant unintended access.

Study all Design and implement data security common traps →

A
Configure diagnostic settings to send logs to a Log Analytics workspace.
Diagnostic settings enable auditing of access.
B
Use storage account access keys (Shared Key) for authentication.
Why wrong: Shared Key does not provide per-user auditing and is less secure.
C
Generate shared access signatures (SAS) with a long expiry time.
Why wrong: Long-lived SAS tokens increase security risk.
D
Configure a firewall to allow access from all Azure services.
Why wrong: Allowing all Azure services may grant unintended access.
E
Enable Azure Active Directory (Azure AD) authentication for the storage account.
Azure AD provides identity-based access control.

Full breakdown with real-world context →

Question 20mediumdrag order

Read the full Design and implement data security explanation →

Drag and drop the steps to configure Azure Stream Analytics job with event input and Power BI output into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Design and implement data security sessions

Start a Design and implement data security only practice session

Every question in these sessions is drawn from the Design and implement data security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Design and implement data security questions →Mixed DP-203 session

Frequently asked questions

What does the DP-203 exam test about Design and implement data security?: Design and implement data security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Design and implement data security questions in a focused session?: Yes — the session launcher on this page draws every question from the Design and implement data security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other DP-203 topics?: Use the topic links above to move to related areas, or go back to the DP-203 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the DP-203 exam covers. They are not copied from any real exam or dump site.

Design and implement data security only

10 questions 20 questions 30 questions 50 questions

Mixed DP-203 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All DP-203 questions Design and implement data security domain overview DP-203 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Design and implement data security practice questions

What to know about Design and implement data security

Common Design and implement data security exam traps

Design and implement data security questions

A company uses Azure Synapse Analytics dedicated SQL pool. They need to ensure that only users with a specific Azure AD group can query a particular schema. Which approach should they use?

You are designing data security for Azure Data Lake Storage Gen2. The requirement is to prevent data from being accessed by anyone outside the corporate network. Which feature should you enable?

A company uses Azure Data Factory to copy sensitive data from on-premises SQL Server to Azure Blob Storage. They must ensure that data is encrypted in transit and at rest. Which combination of features should they use?

You need to audit all data access to an Azure Storage account. Which Azure service should you enable?

A company uses Azure Key Vault to store secrets for data pipelines. They need to rotate the secrets automatically every 90 days. What should they implement?

Which TWO of the following are valid methods to secure data at rest in Azure Data Lake Storage Gen2?

Which THREE of the following are required to implement column-level security in Azure Synapse Analytics dedicated SQL pool?

A company uses Azure Synapse Analytics with dedicated SQL pools. They need to allow a data scientist to read all tables in the 'sales' schema but prevent access to columns containing personally identifiable information (PII). Which feature should be used?

You need to configure encryption for an Azure SQL Database to protect data at rest. Which Azure service or feature should you enable?

A company is using Azure Data Factory to copy data from an on-premises SQL Server to Azure Blob Storage. The data must be encrypted in transit using TLS 1.2. The on-premises SQL Server is configured to support TLS 1.2. Which Data Factory property should be configured?

You are designing a data solution in Azure that requires all data in transit between Azure Databricks and Azure Storage to be encrypted using a customer-managed key. Which configuration meets this requirement?

Which TWO actions should you take to ensure that only authorized users can access sensitive data in an Azure Synapse Analytics dedicated SQL pool?

Which THREE components are part of a defense-in-depth strategy for data security in Azure?

Refer to the exhibit. A custom RBAC role is defined as shown. A user is assigned this role at the resource group scope. Which operation can the user perform?

Exhibit

A company uses Azure Synapse Analytics with a dedicated SQL pool. Data engineers need to implement column-level security so that only users with the 'Manager' role can see salary columns. Which TWO actions should they take?

A company uses Azure Synapse Analytics with a dedicated SQL pool. They need to ensure that a team of data scientists can query all tables in the 'sales' schema but cannot modify any data or schema objects. Which role should the team be assigned?

You are designing data security for an Azure Data Lake Storage Gen2 account that stores sensitive customer data. You need to ensure that only authorized users can access the data and that access can be audited. Which TWO actions should you implement?

Drag and drop the steps to configure Azure Stream Analytics job with event input and Power BI output into the correct order.

Track your progress over time

Start a Design and implement data security only practice session

Related DP-203 topic practice pages

Secure, monitor, and optimize data storage and data processing practice questions

Design and develop data processing practice questions