DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Your Azure Data Lake Storage Gen2 account stores sensitive customer data. You need to ensure that data is encrypted at rest using customer-managed keys (CMK) and that access to the encryption key is logged. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure customer-managed keys in Azure Key Vault and enable Key Vault diagnostics logging.
Customer-managed keys (CMK) stored in Azure Key Vault allow you to control and audit key usage, and enabling Key Vault diagnostics logging captures access events. Option A is incorrect because infrastructure encryption uses platform-managed keys. Option B is incorrect because double encryption adds a second layer but does not directly provide logging of key access. Option D is incorrect because SSE with platform-managed keys does not give customer control or logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable infrastructure encryption on the storage account.
Why it's wrong here
Infrastructure encryption uses platform-managed keys, not customer-managed keys.
- ✗
Enable double encryption using both platform-managed and customer-managed keys.
Why it's wrong here
Double encryption provides additional protection but does not specifically address logging key access.
- ✓
Configure customer-managed keys in Azure Key Vault and enable Key Vault diagnostics logging.
Why this is correct
CMK in Key Vault allows customer control, and diagnostics logs capture key access events.
- ✗
Use Azure Storage Service Encryption (SSE) with platform-managed keys.
Why it's wrong here
SSE with platform-managed keys does not allow customer control.
Go deeper
Related to this question
About these practice questions
One of 760 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-203
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions should you take to secure sensitive data in Azure Data Lake Storage Gen2? (Choose two.)
medium- A.Enable public network access from all networks for ease of use
- ✓ B.Use access control lists (ACLs) to restrict access to specific directories
- C.Allow anonymous access to enable sharing
- D.Disable soft delete to prevent accidental retention of deleted data
- ✓ E.Enable encryption at rest using customer-managed keys in Azure Key Vault
Why B: The correct answers are B and E. Option B: Using access control lists (ACLs) in Azure Data Lake Storage Gen2 allows granular permissions at the directory and file level, enabling you to restrict access to sensitive data. Option E: Enabling encryption at rest with customer-managed keys in Azure Key Vault provides an additional layer of security by allowing you to manage your own encryption keys. Option A is incorrect because public network access from all networks exposes data to potential threats; it should be restricted. Option C is incorrect as anonymous access should always be disabled for sensitive data. Option D is incorrect because soft delete should be enabled to protect against accidental data deletion or corruption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.