DEA-C02 Data Movement Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure an Azure Service Bus to relay the data to Snowflake.

  Why it's wrong here

  Azure Service Bus is a messaging service for decoupled applications and is not designed for bulk data ingestion into Snowflake. Using it for data movement would be architecturally incorrect, introduce significant latency, and fail to leverage Snowflake's native, optimized storage integration features for secure cloud data transfer.

• ✓

  Create a storage integration using an Microsoft Entra ID service principal and Private Link.

  Why this is correct

  Storage integrations are the secure way to access cloud storage without hardcoding credentials. When combined with Azure Private Link, they establish a dedicated, private connection that ensures data movement stays within the cloud provider's backbone, satisfying security requirements by removing reliance on public internet traffic for data transfers.

• ✗

  Use a public URL for the stage but enable IP whitelisting.

  Why it's wrong here

  IP whitelisting only controls who can access the database; it does not secure the transit path of the data itself. Using public URLs exposes data to the public internet, which violates the requirement for private connectivity regardless of whether specific IP addresses are permitted to access the final destination.

• ✗

  Use an external stage with a SAS token that has a long expiration time.

  Why it's wrong here

  SAS tokens are a less secure method of access compared to storage integrations. They are difficult to rotate and do not address the network security requirement. Relying on long-lived tokens increases the risk of unauthorized access if the token is compromised, violating the principle of least privilege security.