DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Which TWO actions should you take to secure access to Azure Data Lake Storage Gen2 when using Azure Synapse Analytics serverless SQL pools? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable firewall rules and virtual network service endpoints for the storage account.
To secure access to Azure Data Lake Storage Gen2 from Azure Synapse Analytics serverless SQL pools, two effective actions are: (A) Enable firewall rules and virtual network service endpoints to restrict network access to the storage account, and (B) Use managed identity authentication from the serverless SQL pool to the storage account, which eliminates the need to store credentials and provides secure, Azure AD-based authentication. Option C (service principal with client secret) is less secure than managed identity because it requires managing secrets. Option D (shared access signature token) is not recommended for long-term access as tokens can be leaked and need to be rotated. Option E (Azure AD passthrough authentication) is not supported for serverless SQL pools; it is only available for dedicated SQL pools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable firewall rules and virtual network service endpoints for the storage account.
Why this is correct
Network restrictions reduce the attack surface.
- ✓
Use managed identity authentication from the serverless SQL pool to the storage account.
Why this is correct
Managed identity provides secure, credential-free access.
- ✗
Use a service principal with a client secret to access the storage account.
Why it's wrong here
Service principal requires secret management; managed identity is preferred.
- ✗
Generate a shared access signature (SAS) token for the storage account and store it securely.
Why it's wrong here
SAS tokens can be compromised and should be avoided where possible.
- ✗
Use Azure Active Directory (Azure AD) passthrough authentication for the serverless pool.
Why it's wrong here
Passthrough is not available for serverless SQL pools.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DP-203 question from scratch — 760 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.