Stream Analytics Tumbling Window Aggregation and Alerting — Real-Time Processing
You are developing a real-time data processing solution for a financial services company. The system ingests stock trade data from Azure Event Hubs at 50,000 events per second. Each event is a JSON object with fields: TradeID, Symbol, Price, Quantity, Timestamp. You need to calculate a 5-minute rolling average of the trade price per symbol and store the result in Azure Cosmos DB for low-latency queries. Additionally, you need to detect anomalies where the price deviates more than 10% from the rolling average within the same window, and send alerts to Azure Event Grid. You must minimize latency and ensure that the processing is stateful across multiple partitions. What should you do?
Quick Answer
The answer is to create an Azure Stream Analytics job with a Tumbling window of 5 minutes to compute the average price per symbol, then add conditional logic to detect price deviations exceeding 10% and output results to both Cosmos DB and Event Grid. This solution is correct because Azure Stream Analytics natively supports stateful, high-throughput stream processing with windowed aggregations like Tumbling windows, which partition data by Symbol and maintain state across multiple Event Hubs partitions without manual management. On the DP-203 exam, this scenario tests your understanding of real-time processing patterns versus batch-oriented tools; a common trap is choosing Azure Functions for high-velocity streams, but Functions lack built-in windowing and state management for 50,000 events per second. Remember the memory tip: "Tumble, compare, dual output" — Tumbling window for aggregation, compare for anomaly detection, and dual output to Cosmos DB and Event Grid for low-latency queries and alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Azure Stream Analytics job. Define input from Event Hubs. Use a Tumbling window of 5 minutes to compute average price per symbol. Add a custom function to compare each event's price to the average and output anomalies. Write to Cosmos DB via the Azure Cosmos DB output adapter and to Event Grid via the Event Grid output adapter.
Azure Stream Analytics (Option D) is the most appropriate service for this scenario. It can ingest from Event Hubs, perform windowed aggregations (e.g., Tumbling window for rolling average), detect anomalies using conditional logic, and output to both Cosmos DB and Event Grid. It handles partitioning automatically and provides stateful processing with low latency. Option A uses Azure Functions, which are not designed for high-throughput stateful stream processing across partitions; each function invocation is stateless and would require an external cache (Redis) adding latency and complexity. Option B incorrectly describes Azure Synapse Pipelines with Data Flow, which is a batch-oriented ETL tool and not suitable for real-time streaming. Option C uses Azure Databricks Structured Streaming, which is more complex to manage and requires additional configuration for state management and output to multiple sinks, resulting in higher operational overhead compared to Stream Analytics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Functions with Event Hubs trigger. In each function invocation, compute the rolling average using a distributed cache (Redis) and detect anomalies. Write to Cosmos DB and Event Grid via output bindings.
Why it's wrong here
Azure Functions may struggle with high throughput and state management across partitions.
- ✗
Use Azure Synapse Pipelines with a Data Flow. Set up a streaming Data Flow from Event Hubs, compute rolling average using window functions, and sink to Cosmos DB and Event Grid.
Why it's wrong here
Synapse Pipelines are batch-oriented; streaming Data Flows are in preview and less mature.
- ✗
Use Azure Databricks with Structured Streaming. Read from Event Hubs using Kafka API. Perform windowed aggregations and anomaly detection using Spark SQL. Write to Cosmos DB via the Azure Cosmos DB Spark connector and to Event Grid via HTTP sink.
Why it's wrong here
Azure Databricks with Structured Streaming introduces micro-batching latency, preventing the *minimised latency* required for this real-time financial scenario. While it handles stateful processing and complex windowed aggregations effectively, its design is not for true event-at-a-time processing. This option is tempting as Databricks excels at large-scale, high-throughput stream processing, offering robust analytical capabilities and state management across partitions, making it ideal when throughput and rich analytics are prioritised over absolute lowest event processing latency.
- ✓
Create an Azure Stream Analytics job. Define input from Event Hubs. Use a Tumbling window of 5 minutes to compute average price per symbol. Add a custom function to compare each event's price to the average and output anomalies. Write to Cosmos DB via the Azure Cosmos DB output adapter and to Event Grid via the Event Grid output adapter.
Why this is correct
Stream Analytics provides native support for windowing, stateful processing, and multiple outputs.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Introduction to Azure Data Engineering
Key term
Azure Databricks
Azure Databricks is a fast, easy, and collaborative Apache Spark-based analytics platform optimized for Azure that lets data teams prepare data, run machine learning models, and build data pipelines using a single workspace.
Key term
Azure Stream Analytics
Azure Stream Analytics is a fully managed, real-time data processing service that analyzes and transforms high volumes of streaming data from various sources to deliver low-latency insights and trigger actions.
About these practice questions
One of 760 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-203
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing a near-real-time data processing solution that ingests millions of events per second from IoT devices. The data must be aggregated on a per-minute basis and stored in Azure Data Lake Storage Gen2 for long-term analytics. The solution must also support alerting when certain thresholds are exceeded. Which combination of Azure services should you use?
hard- A.Azure Event Hubs, Azure Data Factory, and Azure SQL Database.
- ✓ B.Azure IoT Hub, Azure Stream Analytics, and Azure Functions.
- C.Azure IoT Hub, Azure Databricks with Structured Streaming, and Azure Data Lake Storage Gen2.
- D.Azure Event Hubs, Azure Data Explorer, and Power BI.
Why B: Azure IoT Hub is designed for secure, bidirectional communication with IoT devices and can ingest millions of events per second. Azure Stream Analytics provides low-latency, SQL-based stream processing to aggregate data on a per-minute basis and can output to Azure Data Lake Storage Gen2 for long-term analytics. Additionally, Stream Analytics can trigger Azure Functions for alerting when thresholds are exceeded, enabling near-real-time responses.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.