DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Exhibit
Refer to the exhibit. $storageAccount = Get-AzStorageAccount -ResourceGroupName 'rg-datalake' -Name 'stdatalake001' $ctx = $storageAccount.Context $fileSystem = 'data' $path = 'sales/2024/01/' $acl = Set-AzDataLakeGen2ItemAclObject -EntityId 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' -Permission 'rwx' -AccessControlType 'user' -DefaultScope Update-AzDataLakeGen2Item -FileSystem $fileSystem -Path $path -Acl $acl -Context $ctx
You are reviewing an Azure PowerShell script that sets permissions on a directory in Azure Data Lake Storage Gen2. The script sets a default ACL for a user on the path 'sales/2024/01/'. What is the effect of the -DefaultScope parameter?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is inherited by all new child items created under this directory.
The -DefaultScope parameter in Azure Data Lake Storage Gen2 sets a default ACL entry. Default ACLs do not set permissions on the current directory; instead, they define permissions that are inherited by new child items (files and subdirectories) created under that directory. Therefore, option B is correct. Option A is incorrect because default ACLs do not replace the access ACL; access ACLs are set separately without -DefaultScope. Option C is incorrect because default ACLs do not apply to existing items; they only affect future items. Option D is incorrect because default ACLs apply to both new files and new subdirectories.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL replaces the existing access ACL on the directory.
Why it's wrong here
-DefaultScope adds a default ACL entry; it does not overwrite the directory's existing access ACL, which governs permissions on the directory itself. It is tempting because both ACL types live on the same path, but they occupy separate lists and are modified independently.
- ✓
The ACL is inherited by all new child items created under this directory.
Why this is correct
-DefaultScope sets a default ACL on the directory rather than an access ACL, so the entry is automatically inherited by every new child item created beneath 'sales/2024/01/'. Existing items remain unaffected; only newly created files and subdirectories receive the inherited permission.
- ✗
The ACL is applied to all existing files and subdirectories recursively.
Why it's wrong here
-DefaultScope creates a default ACL that is inherited only by newly created child items; it does not retroactively alter existing files or subdirectories. It is tempting because recursive propagation is what administrators often want, but that requires a separate recursive Set-Acl operation against existing children.
- ✗
The ACL is applied only to files, not subdirectories.
Why it's wrong here
-DefaultScope applies to both files and subdirectories created beneath the directory, not files alone. It is tempting because default ACLs are often associated with file creation, yet the inheritance mechanism covers every new child item regardless of type, so the restriction described here is inaccurate.
Visual reference
Go deeper
Related to this question
About these practice questions
This DP-203 question is part of Courseiva's 509-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.