DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Which TWO configurations are recommended to secure data processing in Azure Synapse Pipelines?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store connection strings and secrets in Azure Key Vault and reference them via linked services.
Storing connection strings and secrets in Azure Key Vault and referencing them via linked services ensures secrets are stored securely and not exposed in pipeline definitions. Option D is correct: Enabling Managed Virtual Network (VNet) isolates data flows within a managed network boundary, preventing public network access. Option A is incorrect: Configuring a self-hosted integration runtime on a public cloud VM does not necessarily improve security; it may expose the runtime to the public internet. Option B is incorrect: Using the default Auto-resolve Integration Runtime is not recommended for secure data processing because it may use public endpoints and lacks network isolation. Option E is incorrect: Allowing all public IP addresses to access the Azure Synapse workspace exposes the workspace to potential security threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a self-hosted integration runtime on a public cloud VM.
Why it's wrong here
A self-hosted runtime on a public cloud VM leaves traffic traversing public addresses, so it cannot enforce private endpoint connectivity. It tempts because self-hosted runtimes are the right answer when reaching on-premises or non-Azure sources, yet that scenario differs from securing Synapse processing inside a managed virtual network.
- ✗
Use the default Auto-resolve Integration Runtime for all data flows.
Why it's wrong here
The default Auto-resolve runtime is Microsoft-managed and shared, so it cannot be placed inside a virtual network to reach private endpoints. It tempts because it works with zero setup and suits public-source pipelines, but securing processing demands a runtime you can bind to a managed virtual network with private connectivity.
- ✓
Store connection strings and secrets in Azure Key Vault and reference them via linked services.
Why this is correct
Azure Key Vault centralises secret storage, and linked services retrieve credentials at runtime instead of embedding them in pipeline definitions. This satisfies the stem's security requirement by removing plaintext connection strings from artefacts, notebooks and activity configurations.
- ✓
Enable Managed Virtual Network (VNet) to isolate data flows.
Why this is correct
Managed Virtual Network isolates pipeline activity within a Microsoft-managed network boundary, preventing data flows from traversing public endpoints. This satisfies the stem's security requirement by containing exfiltration risk and restricting outbound traffic during Synapse pipeline execution.
- ✗
Allow all public IP addresses to access the Azure Synapse workspace.
Why it's wrong here
Permitting all public IP addresses exposes the workspace to the internet, directly contradicting the isolation the scenario requires. It tempts because it removes connectivity troubleshooting instantly, and is acceptable only in disposable sandboxes or labs with no sensitive data — never where pipeline processing must be secured against external access.
Visual reference
Go deeper
Related to this question
About these practice questions
This DP-203 question is part of Courseiva's 509-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.