DP-900 Describe an analytics workload on Azure Practice Question
A company uses Azure Data Lake Storage Gen2 as a data lake. They need to enforce row-level security for sensitive data so that sales representatives can only see rows for their assigned region. Which approach should they use?
⚠ Common exam trap
A common mix-up: candidates confuse storage-level access controls (ACLs, RBAC) with data-level security (RLS), assuming that folder-per-region ACLs can achieve row-level filtering, but ACLs cannot filter rows within a file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Load data into Azure Synapse Analytics dedicated SQL pool and implement row-level security (RLS)
Row-level security (RLS) in Azure Synapse Analytics dedicated SQL pool allows you to restrict data access at the row level based on a user's identity or group membership. By loading the data into a dedicated SQL pool and defining a security policy with a predicate function that filters rows by region, you can ensure sales representatives only see rows for their assigned region. This is the correct approach because RLS is designed specifically for this purpose and integrates with Azure Active Directory for user authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply sensitivity labels in Microsoft Purview
Why it's wrong here
Sensitivity labels in Microsoft Purview classify data by applying metadata, encryption, and visual markers at the document or file level, but they do not evaluate or filter individual rows within a file. A label can mark an entire Customer.parquet file as 'Confidential,' yet it cannot hide rows belonging to one region while exposing rows from another. Because the requirement is row-level access control inside a file, Purview labels fail to provide the granular enforcement needed.
- ✓
Load data into Azure Synapse Analytics dedicated SQL pool and implement row-level security (RLS)
Why this is correct
Loading the data into a dedicated SQL pool in Azure Synapse Analytics enables row-level security (RLS), which uses a security predicate defined by an inline table-valued function to filter rows at query time. The predicate can reference attributes such as the caller's USER_NAME() or session context, so each user sees only the regions they are authorized to access. This is the only option listed that can enforce row-level restrictions on the actual data, meeting the stated requirement directly.
- ✗
Use Azure RBAC roles on the storage account
Why it's wrong here
Azure RBAC roles on the storage account assign permissions for management operations and data-plane access to blobs, but the permission evaluation happens at the storage account, container, or blob scope. Granting a role like Storage Blob Data Reader to a user gives that user read access to an entire blob or directory, with no ability to filter rows based on the file's content. Since the data lake contains a single file with regional records, RBAC cannot restrict visibility to a subset of rows.
- ✗
Use Azure Data Lake Storage Gen2 access control lists (ACLs) on folders per region
Why it's wrong here
ADLS Gen2 ACLs control access at the directory and file level by granting read, write, and execute permissions to specific security principals. If you place each region in a separate folder, ACLs can block access to an entire folder, but they cannot inspect values inside a file. Because the scenario involves data in one file (or multiple files) where row-level filtering is required, folder-level ACLs are too coarse-grained and cannot enforce 'only see your region' rules.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Row
A row is a horizontal record in a database table that contains all the information about a single entity, like one customer or one product.
About these practice questions
Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.