DP-203 Develop data processing Practice Question
You are developing a data processing solution in Azure Synapse Analytics. The solution must use a serverless SQL pool to query Parquet files stored in Azure Data Lake Storage Gen2. Which authentication method should you use to ensure that the queries use the identity of the caller and adhere to Azure role-based access control (RBAC) permissions?
⚠ Common exam trap
A common mix-up: candidates confuse 'service principal' (a fixed identity) with 'user identity' and select option D, not realizing that pass-through authentication is the only method that preserves the caller's individual RBAC permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID pass-through authentication.
Microsoft Entra ID pass-through authentication (option A) is correct because it allows the serverless SQL pool to use the caller's identity when accessing Azure Data Lake Storage Gen2. This ensures that Azure RBAC permissions (e.g., Storage Blob Data Reader) assigned to the user are evaluated for each query, providing fine-grained access control without exposing storage account keys or tokens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID pass-through authentication.
Why this is correct
Microsoft Entra ID pass-through authentication lets the serverless SQL pool forward the caller's token to ADLS Gen2, so access is evaluated against that user's Azure RBAC assignments. This satisfies the requirement that queries use the caller's identity rather than a shared credential.
- ✗
Storage account key.
Why it's wrong here
A storage account key grants full administrative access to the entire account and bypasses Azure RBAC entirely, so caller identity is never evaluated. It is tempting for quick setup, and would be correct only for trusted administrative tooling where broad account-level access is genuinely intended.
- ✗
Shared access signature (SAS) token.
Why it's wrong here
A SAS token carries its own delegated permissions, so the serverless SQL pool reads storage as the token, not the caller, bypassing Azure RBAC evaluation. It is tempting for scoped, time-limited access, and would be correct for granting an external partner temporary read access to specific files.
- ✗
Service principal with a secret.
Why it's wrong here
A service principal authenticates as the application itself, so queries run under that identity rather than the caller's, and Azure RBAC evaluates the principal's assignments. It is tempting for unattended pipelines, and would be correct for scheduled jobs needing consistent access without interactive users.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Implement Azure Stream Analytics
Key term
Azure RBAC for Data
Azure RBAC for Data is a security system that controls who can read, write, or manage data in Azure storage services using role-based permissions.
Key term
Azure Synapse Analytics
Azure Synapse Analytics is a cloud-based data integration, warehousing, and analytics service that brings together big data and data warehouse capabilities under one platform.
About these practice questions
This DP-203 question is part of Courseiva's 509-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.