DP-203 Design and implement data storage Practice Question
You are implementing a data lake using Azure Data Lake Storage Gen2. Which THREE actions should you take to secure the data at rest and in transit?
⚠ Common exam trap
Many exam-takers confuse network security controls (firewalls) or legacy protocol compatibility (TLS 1.0) with actual data encryption mechanisms, leading them to select options that address access or connectivity rather than encryption of data at rest and in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Storage Service Encryption (SSE) for data at rest
Option B is correct because Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Data Lake Storage Gen2 using 256-bit AES encryption, protecting stored files and blobs even if the underlying media is compromised. Option D is correct because Data Lake Storage Gen2 supports a hierarchical namespace where Azure RBAC controls management-plane and broad data access while POSIX-style ACLs provide fine-grained file and directory permissions, ensuring only authorized identities can read or modify data. Option E is correct because requiring secure transfer (HTTPS) enforces TLS encryption of data in transit between clients and the storage account, preventing eavesdropping or tampering on the network. Option A is not correct because TLS 1.0 is deprecated and insecure; enabling it weakens transport security rather than strengthening it, and Azure recommends TLS 1.2 or higher. Option C is not correct because firewall IP restrictions are a network-perimeter control, not a mechanism for securing data at rest or in transit, and they do not encrypt or authorize data access by themselves.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable TLS 1.0 for compatibility with legacy clients
Why it's wrong here
TLS 1.0 is deprecated and vulnerable to BEAST and POODLE, so enabling it weakens transit encryption rather than securing it. It is tempting when legacy clients cannot negotiate TLS 1.2, but the correct approach is upgrading those clients, not downgrading the storage account's minimum TLS version.
- ✓
Enable Azure Storage Service Encryption (SSE) for data at rest
Why this is correct
Azure Storage Service Encryption automatically encrypts data at rest using 256-bit AES, covering the stem's at-rest security requirement for Azure Data Lake Storage Gen2. It applies transparently to blobs and files with Microsoft-managed or customer-managed keys, requiring no application changes.
- ✗
Configure firewall rules to allow only trusted IPs
Why it's wrong here
IP firewall rules restrict network origin but do not encrypt data at rest or in transit, so they fail the encryption requirement. They are tempting because network perimeter control is a familiar hardening step, and they would be correct for limiting access to known corporate ranges alongside private endpoints.
- ✓
Use Azure RBAC and ACLs to control access to data
Why this is correct
Combining Azure RBAC for management-plane and directory-level scope with ACLs for file and folder granularity enforces least-privilege access, satisfying the stem's authorisation requirement. This layered model prevents broad role assignments from exposing sensitive data lake paths to unauthorised principals.
- ✓
Require HTTPS for all data transfers
Why this is correct
Requiring HTTPS enforces TLS encryption for all data in transit, satisfying the stem's in-transit security requirement. Azure Data Lake Storage Gen2 rejects unencrypted HTTP requests when secure transfer is enabled, protecting credentials and payloads from interception on the network.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Secure Data at Rest and in Transit
Key term
Azure Data Lake Gen2
Azure Data Lake Gen2 is a cloud-based data storage service that combines the scalability and performance of a data lake with the hierarchical file system and security of a data warehouse, designed for big data analytics.
Key term
Azure RBAC for Data
Azure RBAC for Data is a security system that controls who can read, write, or manage data in Azure storage services using role-based permissions.
About these practice questions
Courseiva writes every DP-203 question from scratch — 509 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.