DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Exhibit
Refer to the exhibit.
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'MyStr0ngP@ssw0rd!';
CREATE DATABASE SCOPED CREDENTIAL SasCredential
WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
SECRET = '?sv=2020-08-04&ss=b&srt=sco&sp=rl&se=2025-12-31T23:59:59Z&st=2025-01-01T00:00:00Z&spr=https&sig=...';
CREATE EXTERNAL DATA SOURCE MyDataSource WITH (
LOCATION = 'wasbs://mycontainer@mystorageaccount.blob.core.windows.net',
CREDENTIAL = SasCredential
);You are reviewing a script to create an external data source in Azure Synapse Analytics serverless SQL pool. Based on the exhibit, what is the purpose of the SAS token?
⚠ Common exam trap
DP-203 often tests the purpose of SAS tokens in external data sources; candidates might confuse SAS tokens with account keys or think they provide write access, but they are primarily for delegated read access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide read access to the container for querying data.
In Azure Synapse Analytics serverless SQL pool, an external data source pointing to Azure Storage requires a SAS token to provide read access to the container so that queries can read the data. The SAS token grants limited access rights without exposing the account key, and it is used in the CREATE EXTERNAL DATA SOURCE statement to authenticate and authorize access to the storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To provide read access to the container for querying data.
Why this is correct
The SAS token supplies delegated, time-limited credentials appended to the external data source location, letting the serverless SQL pool authenticate to the storage container. Without it, queries against the external data source would fail authorisation, so it grants the read access needed for querying.
- ✗
To provide write access to the container for storing query results.
Why it's wrong here
The SAS token supplies read credentials so the serverless pool can access the external data source; write access for query results is granted through the storage account's own permissions or a separate credential. It is tempting because SAS tokens can carry write permissions, but the exhibit's token is scoped to reading the referenced container.
- ✗
To encrypt the connection between the serverless pool and storage.
Why it's wrong here
A SAS token authorises access to storage resources; transport encryption is handled by HTTPS/TLS on the endpoint, not by the token itself. It is tempting because SAS strings look like security credentials, so they appear to secure the channel; a SAS token would be correct for granting time-limited delegated access to a blob or container.
- ✗
To authenticate the user to the serverless SQL pool.
Why it's wrong here
The SAS token authenticates the serverless SQL pool to the external storage account, not the user to the pool; user authentication to Synapse is handled by Microsoft Entra ID. It is tempting because tokens are credentials, but this one is presented to Azure Storage, not to the SQL endpoint.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 509 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.