Courseiva
Describe an analytics workload on AzuremediumMultiple ChoiceObjective-mapped

DP-900 Describe an analytics workload on Azure Practice Question

A company receives real-time clickstream data from its website via Azure Event Hubs. They need to detect fraudulent clicks within seconds and also produce daily aggregate reports of visitor statistics for historical analysis. Which combination of Azure services should they use for the real-time detection and the daily aggregation, respectively?

⚠ Common exam trap

Many exam-takers confuse Azure Stream Analytics with Azure Databricks or Azure Functions for real-time processing, or think that Azure Blob Storage alone can perform aggregation, when in fact the question tests the specific pairing of a stream-processing service with a batch orchestration service.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Azure Stream Analytics for real-time detection; Azure Data Factory for daily aggregation

Azure Stream Analytics is purpose-built for real-time stream processing, making it ideal for detecting fraudulent clicks within seconds from Event Hubs. Azure Data Factory is a cloud-based ETL service that can orchestrate and execute daily aggregation jobs on historical data, such as producing visitor statistics reports from stored clickstream data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Azure Stream Analytics for real-time detection; Azure Data Factory for daily aggregation

    Why this is correct

    Azure Stream Analytics is a purpose-built stream processing engine that continuously executes SQL queries over data from Event Hubs or IoT Hub, producing results with sub-second latency—making it ideal for real-time fraud detection on clickstream data. Azure Data Factory is a cloud-based ETL orchestration service that can schedule a daily pipeline to move and transform the same data into an analytical store, invoking compute like Azure Databricks or SQL to perform aggregation. Together they satisfy both the real-time and batch halves of the requirement.

  • Azure Databricks for both real-time detection and daily aggregation

    Why it's wrong here

    Azure Databricks introduces latency from cluster startup and job scheduling that prevents sub-second fraud detection from streaming Event Hubs data, whereas a dedicated stream processor like Azure Stream Analytics provides continuous, low-latency query execution. It is tempting because Databricks excels at large-scale batch analytics and can handle streaming via Structured Streaming, making it a valid choice for the daily aggregation alone, but its architecture cannot guarantee the real-time responsiveness required for instantaneous fraud alerts.

    When this WOULD be correct

    A scenario where the company needs to perform complex, iterative analytics on historical clickstream data (e.g., building ML models for fraud patterns) and also run scheduled batch jobs for daily reports, all within a unified Apache Spark environment.

  • Azure Synapse Analytics for real-time detection; Azure Blob Storage for daily aggregation

    Why it's wrong here

    Azure Synapse Analytics is an enterprise data warehousing and analytics platform; its dedicated SQL pools and pipelines are designed for complex queries over large stored datasets, not for ingesting and responding to individual streaming events with low latency. Azure Blob Storage is a highly scalable object store that can persist raw clickstream logs, but it provides no compute or transformation capability to aggregate data—it can only hold the files that some other service reads. Relying on these two services would leave real-time detection impossible and would require a separate processing engine just to perform the daily aggregation, so this pairing is incorrect.

    When this WOULD be correct

    A question where the requirement is to store raw clickstream data for long-term retention and then use a separate service like Azure Data Factory or Synapse Pipelines to load and aggregate data into Azure Synapse Analytics for historical analysis, with real-time detection handled by a different service like Azure Stream Analytics.

  • Azure Functions for real-time detection; Azure SQL Database for daily aggregation

    Why it's wrong here

    Azure Functions can process events, but for high-throughput clickstream data, scaling can be complex and costly. SQL Database can store aggregated data, but it does not perform the aggregation itself; you would need additional logic.

    When this WOULD be correct

    A scenario where the company needs to process clickstream events with custom business logic (e.g., scoring each click with a complex algorithm) and store results in a relational database for immediate querying. For daily aggregation, if the data volume is low and the aggregation logic is simple, Azure SQL Database could serve as both storage and aggregation engine using T-SQL queries.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The DP-900 exam frequently reuses these exact scenarios with slightly different constraints.

Azure Stream Analytics for real-time detection; Azure Data Factory for daily aggregationCorrect answer

Why this is correct

Azure Stream Analytics is a purpose-built stream processing engine that continuously executes SQL queries over data from Event Hubs or IoT Hub, producing results with sub-second latency—making it ideal for real-time fraud detection on clickstream data. Azure Data Factory is a cloud-based ETL orchestration service that can schedule a daily pipeline to move and transform the same data into an analytical store, invoking compute like Azure Databricks or SQL to perform aggregation. Together they satisfy both the real-time and batch halves of the requirement.

Azure Databricks for both real-time detection and daily aggregationWrong answer — click to see why

Why this is wrong here

Azure Databricks is optimized for big data analytics and machine learning, not for sub-second real-time stream processing required for fraud detection. It also lacks native scheduling for daily aggregation, requiring additional orchestration.

★ When this WOULD be the correct answer

A scenario where the company needs to perform complex, iterative analytics on historical clickstream data (e.g., building ML models for fraud patterns) and also run scheduled batch jobs for daily reports, all within a unified Apache Spark environment.

Why candidates choose this

Candidates may assume Databricks can handle both real-time and batch workloads because it supports Spark Streaming, but they overlook its higher latency and complexity compared to purpose-built services like Stream Analytics for real-time detection.

Azure Synapse Analytics for real-time detection; Azure Blob Storage for daily aggregationWrong answer — click to see why

Why this is wrong here

Azure Synapse Analytics is not designed for real-time stream processing; it is a data warehousing and analytics service. Azure Blob Storage is a storage service, not a compute service for daily aggregation, lacking built-in transformation capabilities.

★ When this WOULD be the correct answer

A question where the requirement is to store raw clickstream data for long-term retention and then use a separate service like Azure Data Factory or Synapse Pipelines to load and aggregate data into Azure Synapse Analytics for historical analysis, with real-time detection handled by a different service like Azure Stream Analytics.

Why candidates choose this

Candidates may confuse Azure Synapse Analytics' ability to query data in Blob Storage via serverless SQL pool as real-time processing, and think Blob Storage can be used for aggregation via tools like Azure Data Lake Storage, overlooking the need for a compute service.

Azure Functions for real-time detection; Azure SQL Database for daily aggregationWrong answer — click to see why

Why this is wrong here

Azure Functions is not designed for real-time stream processing with low latency on high-throughput clickstream data; it is better suited for event-driven, short-lived tasks. Azure SQL Database lacks native capabilities for large-scale daily aggregation of streaming data, requiring additional orchestration and transformation logic.

★ When this WOULD be the correct answer

A scenario where the company needs to process clickstream events with custom business logic (e.g., scoring each click with a complex algorithm) and store results in a relational database for immediate querying. For daily aggregation, if the data volume is low and the aggregation logic is simple, Azure SQL Database could serve as both storage and aggregation engine using T-SQL queries.

Why candidates choose this

Candidates may think Azure Functions can handle real-time processing because it can be triggered by Event Hubs, and Azure SQL Database is a familiar storage option for reports, overlooking the need for scalable stream processing and efficient batch aggregation.

Analysis generated from the official DP-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question

About these practice questions

Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.