DP-203 Design and implement data storage Practice Question
You are a data engineer for a financial services company. The company uses Azure Data Lake Storage Gen2 as its data lake. You have a directory structure where each customer has a folder containing transaction files in CSV format. The security team requires that each customer's data be accessible only to that customer's users. You need to implement fine-grained access control using Azure Data Lake Storage Gen2's POSIX-like ACLs. However, you have thousands of customers, and managing ACLs individually is not feasible. What should you do?
⚠ Common exam trap
Many candidates confuse row-level security (a SQL-based feature) with file-system access control in Azure Data Lake Storage Gen2, or they mistakenly believe that SAS tokens can provide granular directory-level isolation, when in fact SAS tokens operate at the container or storage account level and cannot enforce per-folder ACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Azure AD group for each customer, add users to the group, and assign ACLs to the group on the customer folder
Azure Data Lake Storage Gen2 supports POSIX-like ACLs that can be assigned to Azure AD security groups. By creating one Azure AD group per customer, adding the customer's users to that group, and then assigning the group the appropriate read/execute ACLs on the customer's folder, you achieve scalable, fine-grained access control without managing thousands of individual user ACLs. This approach aligns with the principle of least privilege and simplifies administration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a shared access signature (SAS) token for each customer and distribute it securely
Why it's wrong here
SAS tokens are not suitable for fine-grained RBAC and are hard to manage at scale.
- ✗
Use POSIX ACLs on each customer folder, assigning permissions to individual user identities
Why it's wrong here
This approach does not scale to thousands of customers.
- ✗
Use row-level security in Azure Data Lake Storage Gen2
Why it's wrong here
Row-level security is not a feature of ADLS Gen2; it uses ACLs and RBAC at the file/folder level.
- ✓
Create an Azure AD group for each customer, add users to the group, and assign ACLs to the group on the customer folder
Why this is correct
Group-based ACL assignment is scalable and manageable.
Go deeper
Related to this question
About these practice questions
One of 760 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.