DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
You are using Azure Data Factory to copy data from an on-premises Oracle database to Azure Data Lake Storage Gen2. You need to ensure the copy activity can connect to the Oracle database without storing credentials in the pipeline JSON. What should you configure?
⚠ Common exam trap
The trap here is assuming that a self-hosted integration runtime or a private endpoint also handles credential secrecy, when those components only solve connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A linked service that references an Azure Key Vault secret for the Oracle credentials.
Azure Data Factory integrates with Azure Key Vault so linked services can reference secrets instead of embedding credentials. Storing the Oracle password as a Key Vault secret and referencing it from the linked service keeps sensitive values out of pipeline and dataset JSON. Network components such as integration runtimes and private endpoints address connectivity, not credential protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A parameterized dataset that prompts for credentials at runtime.
Why it's wrong here
Parameters in datasets are used to pass values such as file paths or table names, not credentials. There is no mechanism for a dataset parameter to securely prompt for and supply a password at runtime. The credentials would still need to be provided through a linked service, so this does not meet the requirement.
- ✗
A self-hosted integration runtime with a service account that has Oracle access.
Why it's wrong here
A self-hosted integration runtime is required for connectivity to on-premises sources, but it does not by itself remove credentials from the pipeline. You would still need to supply a username and password or another authentication method in the linked service. Using a service account can help with Windows authentication scenarios, but Oracle typically requires explicit credentials.
- ✗
A managed private endpoint from the data factory to the Oracle server.
Why it's wrong here
Managed private endpoints provide private network connectivity from the data factory to supported Azure services or private endpoints, not to arbitrary on-premises Oracle databases. They address network isolation, not credential storage. The scenario's requirement is about keeping credentials out of the pipeline JSON, which a private endpoint does not accomplish.
- ✓
A linked service that references an Azure Key Vault secret for the Oracle credentials.
Why this is correct
Azure Data Factory linked services can retrieve credentials from Azure Key Vault at runtime rather than embedding them in the pipeline or dataset JSON. By storing the Oracle password as a secret and referencing it from the linked service, you keep credentials out of the pipeline definition while still allowing the copy activity to authenticate. This is the supported pattern for secret management.
Go deeper
Related to this question
About these practice questions
This DP-203 question is part of Courseiva's 509-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.