DP-203 practice questions 271–280

1. Question 271 · 370 in bank

   You have an Azure Synapse Analytics dedicated SQL pool that contains a table named Contacts. Contacts contains a column named Phone. You need to ensure that users in a specific role only see the last four digits of a phone number when querying the Phone column. What should you include in the solution?

   • Atable partitions
   • Ba default value
   • Crow-level security (RLS)
   • Dcolumn encryption
   • Edynamic data masking

   Show answer

   Answer: E

   Explanation

   I think the key is "when querying the Phone column". Column encryption encrypts individual columns of database on db level, instead Dynamic data masking does not store masked data, only display it.

   Source: Adapted from community discussion — vrodriguesp

   Next question

2. Question 272 · 370 in bank

   You are designing database for an Azure Synapse Analytics dedicated SQL pool to support workloads for detecting ecommerce transaction fraud. Data will be combined from multiple ecommerce sites and can include sensitive financial information such as credit card numbers. You need to recommend a solution that meets the following requirements: Users must be able to identify potentially fraudulent transactions.

   

   ✑ Users must be able to use credit cards as a potential feature in models. ✑ Users must NOT be able to access the actual credit card numbers. What should you include in the recommendation?

   • ATransparent Data Encryption (TDE)
   • Brow-level security (RLS)
   • Ccolumn-level encryption
   • DAzure Active Directory (Azure AD) pass-through authentication

   Show answer

   Answer: C

   Explanation

   By discard, is C, you can create a symetric key to encript a data, for example one column, and then use this data as feature of the model https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/encrypt-a-column-of-data?view=sql-server-ver15 The other options that not meet the requeriments: - TDE encript data, but decrypt when you query https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview?tabs=azure-portal - RLS is for row restriction, not meet the requeriment - Azure AD pass-through is for authentication

   Source: Adapted from community discussion — juanlu46

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation

   Next question

3. Question 273 · 370 in bank

   Select 2

   You have an Azure subscription linked to an Azure Active Directory (Azure AD) tenant that contains a service principal named ServicePrincipal1. The subscription contains an Azure Data Lake Storage account named adls1. Adls1 contains a folder named Folder2 that has a URI of https://adls1.dfs.core.windows.net/ container1/Folder1/Folder2/. ServicePrincipal1 has the access control list (ACL) permissions shown in the following table.

   

   You need to ensure that ServicePrincipal1 can perform the following actions: ✑ Traverse child items that are created in Folder2. ✑ Read files that are created in Folder2. The solution must use the principle of least privilege. Which two permissions should you grant to ServicePrincipal1 for Folder2? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAccess ג€" Read
   • BAccess ג€" Write
   • CAccess ג€" Execute
   • DDefault ג€" Read
   • EDefault ג€" Write
   • FDefault ג€" Execute

   Show answer

   Answer: CD

   Explanation

   Phrased different, the question for me says: if you create "Folder3" inside Folder2, you should be able to read files created in Folder3. This means that you for sure need Executive and Read premissions to Folder2 (Executive to traverse child folder, read to read the files). Now, starting from the least privilege, suppose you give "Access" permission both for read and execute. In this case, you can't read files created in Folder3. This is a requirement ("child items that are created in Folder2"), so you need Default Read access. You don't need Default Execute, otherwise you would have access to a Folder created in Folder3 (say Folder 4) and this is not required so for the least privilege you must give Access Execute and not Defualt Execute.

   Source: Adapted from community discussion — kl8585

   Next question

4. Question 274 · 370 in bank

   HOTSPOT - You have an Azure subscription that is linked to a hybrid Azure Active Directory (Azure AD) tenant. The subscription contains an Azure Synapse Analytics SQL pool named Pool1. You need to recommend an authentication solution for Pool1. The solution must support multi-factor authentication (MFA) and database-level authentication. Which authentication solution or solutions should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure AD authentication - Azure AD authentication has the option to include MFA. Box 2: Contained database users - Azure AD authentication uses contained database users to authenticate identities at the database level. Reference: https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-mfa-ssms-overview https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-overview

   Source: Adapted from community discussion — JG1984

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 275 · 370 in bank

   DRAG DROP - You have an Azure data factory. You need to ensure that pipeline-run data is retained for 120 days. The solution must ensure that you can query the data by using the Kusto query language. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Create an Azure Storage account that has a lifecycle policy To automate common data management tasks, Microsoft created a solution based on Azure Data Factory. The service, Data Lifecycle Management, makes frequently accessed data available and archives or purges other data according to retention policies. Teams across the company use the service to reduce storage costs, improve app performance, and comply with data retention policies. Step 2: Create a Log Analytics workspace that has Data Retention set to 120 days. Data Factory stores pipeline-run data for only 45 days. Use Azure Monitor if you want to keep that data for a longer time. With Monitor, you can route diagnostic logs for analysis to multiple different targets, such as a Storage Account: Save your diagnostic logs to a storage account for auditing or manual inspection. You can use the diagnostic settings to specify the retention time in days. Step 3: From Azure Portal, add a diagnostic setting. Step 4: Send the data to a log Analytics workspace, Event Hub: A pipeline that transfers events from services to Azure Data Explorer. Keeping Azure Data Factory metrics and pipeline-run data. Configure diagnostic settings and workspace. Create or add diagnostic settings for your data factory. 1. In the portal, go to Monitor. Select Settings > Diagnostic settings. 2. Select the data factory for which you want to set a diagnostic setting. 3. If no settings exist on the selected data factory, you're prompted to create a setting. Select Turn on diagnostics. 4. Give your setting a name, select Send to Log Analytics, and then select a workspace from Log Analytics Workspace. 5. Select Save. Reference: https://docs.microsoft.com/en-us/azure/data-factory/monitor-using-azure-monitor

   Source: Adapted from community discussion — Sunnyb

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 276 · 370 in bank

   You have an Azure Synapse Analytics dedicated SQL pool. You need to ensure that data in the pool is encrypted at rest. The solution must NOT require modifying applications that query the data. What should you do?

   • AEnable encryption at rest for the Azure Data Lake Storage Gen2 account.
   • BEnable Transparent Data Encryption (TDE) for the pool.
   • CUse a customer-managed key to enable double encryption for the Azure Synapse workspace.
   • DCreate an Azure key vault in the Azure subscription grant access to the pool.

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

7. Question 277 · 370 in bank

   DRAG DROP - You have an Azure subscription that contains an Azure Data Lake Storage Gen2 account named storage1. Storage1 contains a container named container1. Container1 contains a directory named directory1. Directory1 contains a file named file1. You have an Azure Active Directory (Azure AD) user named User1 that is assigned the Storage Blob Data Reader role for storage1. You need to ensure that User1 can append data to file1. The solution must use the principle of least privilege. Which permissions should you grant? To answer, drag the appropriate permissions to the correct resources. Each permission may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Execute - If you are granting permissions by using only ACLs (no Azure RBAC), then to grant a security principal read or write access to a file, you'll need to give the security principal Execute permissions to the root folder of the container, and to each folder in the hierarchy of folders that lead to the file. Box 2: Execute - On Directory: Execute (X): Required to traverse the child items of a directory Box 3: Write - On file: Write (W): Can write or append to a file. Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control

   Source: Adapted from community discussion — OldSchool

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 278 · 370 in bank

   Select 2

   You plan to create an Azure Synapse Analytics dedicated SQL pool. You need to minimize the time it takes to identify queries that return confidential information as defined by the company's data privacy regulations and the users who executed the queues. Which two components should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Asensitivity-classification labels applied to columns that contain confidential information
   • Bresource tags for databases that contain confidential information
   • Caudit logs sent to a Log Analytics workspace
   • Ddynamic data masking for columns that contain confidential information

   Show answer

   Answer: AC

   Explanation

   Correct: "The solution needs to identify the users who executed queries, not to hide confidental information." thanks @DirectX from this discussion: https://www.examtopics.com/discussions/microsoft/view/51257-exam-dp-201-topic-3-question-32-discussion/

   Source: Adapted from community discussion — rashjan

   Next question

9. Question 279 · 370 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure Databricks workspace named databricks1 and an Azure Synapse Analytics workspace named synapse1. The synapse1 workspace contains an Apache Spark pool named pool1. You need to share an Apache Hive catalog of pool1 with databricks1. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure SQL Database - Use external Hive Metastore for Synapse Spark Pool Azure Synapse Analytics allows Apache Spark pools in the same workspace to share a managed HMS (Hive Metastore) compatible metastore as their catalog. Set up linked service to Hive Metastore Follow below steps to set up a linked service to the external Hive Metastore in Synapse workspace. 1. Open Synapse Studio, go to Manage > Linked services at left, click New to create a new linked service. 2. Set up Hive Metastore linked service 3. Choose Azure SQL Database or Azure Database for MySQL based on your database type, click Continue. 4. Provide Name of the linked service. Record the name of the linked service, this info will be used to configure Spark shortly. 5. You can either select Azure SQL Database/Azure Database for MySQL for the external Hive Metastore from Azure subscription list, or enter the info manually. 6. Provide User name and Password to set up the connection. 7. Test connection to verify the username and password. 8. Click Create to create the linked service. Box 2: A Hive Metastore - Reference: https://docs.microsoft.com/en-us/azure/synapse-analytics/spark/apache-spark-external-metastore

   Source: Adapted from community discussion — andjurovicela

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 280 · 370 in bank

    HOTSPOT - You have an Azure subscription. You need to deploy an Azure Data Lake Storage Gen2 Premium account. The solution must meet the following requirements: * Blobs that are older than 365 days must be deleted. * Administrative effort must be minimized. * Costs must be minimized. What should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: The Archive access tier - Archive tier - An offline tier optimized for storing data that is rarely accessed, and that has flexible latency requirements, on the order of hours. Data in the Archive tier should be stored for a minimum of 180 days. Box 2: Azure Storage lifecycle management With the lifecycle management policy, you can: * Delete current versions of a blob, previous versions of a blob, or blob snapshots at the end of their lifecycles. Transition blobs from cool to hot immediately when they're accessed, to optimize for performance. Transition current versions of a blob, previous versions of a blob, or blob snapshots to a cooler storage tier if these objects haven't been accessed or modified for a period of time, to optimize for cost. In this scenario, the lifecycle management policy can move objects from hot to cool, from hot to archive, or from cool to archive. Etc. Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview

    Source: Adapted from community discussion — goxxx

    References

    • azure.microsoft.com documentation
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DP-203 practice, question 271. 370 questions available.