DP-203 practice questions 281–290

1. Question 281 · 370 in bank

   HOTSPOT - You are designing an application that will use an Azure Data Lake Storage Gen 2 account to store petabytes of license plate photos from toll booths. The account will use zone-redundant storage (ZRS). You identify the following usage patterns: * The data will be accessed several times a day during the first 30 days after the data is created. The data must meet an availability SLA of 99.9%. * After 90 days, the data will be accessed infrequently but must be available within 30 seconds. * After 365 days, the data will be accessed infrequently but must be available within five minutes. You need to recommend a data retention solution. The solution must minimize costs. Which access tier should you recommend for each time frame? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Hot - The data will be accessed several times a day during the first 30 days after the data is created. The data must meet an availability SLA of 99.9%. Box 2: Cool - After 90 days, the data will be accessed infrequently but must be available within 30 seconds. Data in the Cool tier should be stored for a minimum of 30 days. When your data is stored in an online access tier (either Hot or Cool), users can access it immediately. The Hot tier is the best choice for data that is in active use, while the Cool tier is ideal for data that is accessed less frequently, but that still must be available for reading and writing. Box 3: Cool - After 365 days, the data will be accessed infrequently but must be available within five minutes. Incorrect: Not Archive: While a blob is in the Archive access tier, it's considered to be offline and can't be read or modified. In order to read or modify data in an archived blob, you must first rehydrate the blob to an online tier, either the Hot or Cool tier. Rehydration priority - When you rehydrate a blob, you can set the priority for the rehydration operation via the optional x-ms-rehydrate-priority header on a Set Blob Tier or Copy Blob operation. Rehydration priority options include: Standard priority: The rehydration request will be processed in the order it was received and may take up to 15 hours. High priority: The rehydration request will be prioritized over standard priority requests and may complete in less than one hour for objects under 10 GB in size. Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview https://docs.microsoft.com/en-us/azure/storage/blobs/archive-rehydrate-overview

   Source: Adapted from community discussion — hanzocuk

   References

   • Microsoft Learn

   

   Next question

2. Question 282 · 370 in bank

   DRAG DROP - You have an Azure Data Lake Storage Gen 2 account named storage1. You need to recommend a solution for accessing the content in storage1. The solution must meet the following requirements: • List and read permissions must be granted at the storage account level. • Additional permissions can be applied to individual objects in storage1. • Security principals from Microsoft Azure Active Directory (Azure AD), part of Microsoft Entra, must be used for authentication. What should you use? To answer, drag the appropriate components to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct. Azure Data Lake Storage Gen2 implements an access control model that supports both Azure role-based access control (Azure RBAC) and POSIX-like access control lists (ACLs). Azure RBAC scope are storage accounts and containers. ACL scope are directories and files. https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control

   Source: Adapted from community discussion — aemilka

   References

   • Microsoft Learn

   

   Next question

3. Question 283 · 370 in bank

   You have an Azure Synapse Analytics dedicated SQL pool named Pool1 that contains a table named Sales. Sales has row-level security (RLS) applied. RLS uses the following predicate filter.

   

   A user named SalesUser1 is assigned the db_datareader role for Pool1. Which rows in the Sales table are returned when SalesUser1 queries the table?

   • Aonly the rows for which the value in the User_Name column is SalesUser1
   • Ball the rows
   • Conly the rows for which the value in the SalesRep column is Manager
   • Donly the rows for which the value in the SalesRep column is SalesUser1

   Show answer

   Answer: D

   Explanation

   It's D. It clearly states that the user querying the table is SalesUser1. I feel they should have mentioned it being a manager if it's C.

   Source: Adapted from community discussion — zekescookies

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 284 · 370 in bank

   HOTSPOT - You have an Azure Data Lake Storage Gen2 account named account1 that contains the resources shown in the following table.

   

   You need to configure access control lists (ACLs) to allow a user named User1 to delete File1. User1 is NOT assigned any role-based access control (RBAC) roles for account1. The solution must use the principle of least privilege. Which type of ACL should you configure for each resource? To answer select the appropriate options in the answer area.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   you do not need any permissions on a file itself to delete it; you only need permissions on the folder where the file resides; https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control#common-scenarios-related-to-acl-permissions so answer -x / -wx / ---

   Source: Adapted from community discussion — mamahani

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 285 · 370 in bank

   You have an Azure subscription that is linked to a tenant in Microsoft Azure Active Directory (Azure AD), part of Microsoft Entra. The tenant that contains a security group named Group1. The subscription contains an Azure Data Lake Storage account named myaccount1. The myaccount1 account contains two containers named container1 and container2. You need to grant Group1 read access to container1. The solution must use the principle of least privilege. Which role should you assign to Group1?

   • AStorage Table Data Reader for myaccount1
   • BStorage Blob Data Reader for container1
   • CStorage Blob Data Reader for myaccount1
   • DStorage Table Data Reader for container1

   Show answer

   Answer: B

   Explanation

   The appropriate role to assign to Group1 to grant read access to container1 with the principle of least privilege is option B, Storage Blob Data Reader for container1. Option A, Storage Table Data Reader for myaccount1, is incorrect because it grants read access to all tables in the storage account, not just container1. Option C, Storage Blob Data Reader for myaccount1, is incorrect because it grants read access to all containers in the storage account, not just container1. Option D, Storage Table Data Reader for container1, is incorrect because it grants read access to tables in the specified container only, not blobs in container1. Therefore, option B, Storage Blob Data Reader for container1, is the most appropriate role to assign Group1 to grant read access to container1 with the principle of least privilege.

   Source: Adapted from community discussion — Iamthealpha

   Next question

6. Question 286 · 370 in bank

   You have an Azure Synapse Analytics dedicated SQL pool that contains a table named dbo.Users. You need to prevent a group of users from reading user email addresses from dbo.Users. What should you use?

   • Acolumn-level security
   • Brow-level security (RLS)
   • CTransparent Data Encryption (TOE)
   • Ddynamic data masking

   Show answer

   Answer: A

   Explanation

   The appropriate feature to use to prevent a group of users from reading user email addresses from dbo.Users in an Azure Synapse Analytics dedicated SQL pool is option A, column-level security. Option B, row-level security (RLS), is used to filter rows in a table based on the user executing a query, but it cannot prevent certain columns from being read by a group of users. Option C, Transparent Data Encryption (TDE), encrypts data at rest and does not prevent a group of users from reading specific columns in a table. Option D, dynamic data masking, is used to mask sensitive data in query results, but it does not prevent a group of users from reading the actual values in a column. Therefore, option A, column-level security, is the most appropriate feature to use to prevent a group of users from reading user email addresses from dbo.Users in an Azure Synapse Analytics dedicated SQL pool. Column-level security can be used to deny read access to specific columns in a table based on a user or group's permissions.

   Source: Adapted from community discussion — Iamthealpha

   Next question

7. Question 287 · 370 in bank

   HOTSPOT - You have an Azure Synapse Analytics dedicated SQL pool that hosts a database named DB1. You need to ensure that DB1 meets the following security requirements: • When credit card numbers show in applications, only the last four digits must be visible. • Tax numbers must be visible only to specific users. What should you use for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think the answer is correct. Imagine a team where all have access to the table, but just one person needs access to the tax numbers, you can use column-level to disable access for all the other people except the one that needs it

   Source: Adapted from community discussion — francocalvo

   

   Next question

8. Question 288 · 370 in bank

   You have an Azure subscription that contains a storage account named storage1 and an Azure Synapse Analytics dedicated SQL pool. The storage1 account contains a CSV file that requires an account key for access. You plan to read the contents of the CSV file by using an external table. You need to create an external data source for the external table. What should you create first?

   • Aa database role
   • Ba database scoped credential
   • Ca database view
   • Dan external file format

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

9. Question 289 · 370 in bank

   You are designing an enterprise data warehouse in Azure Synapse Analytics that will contain a table named Customers. Customers will contain credit card information. You need to recommend a solution to provide salespeople with the ability to view all the entries in Customers. The solution must prevent all the salespeople from viewing or inferring the credit card information. What should you include in the recommendation?

   • Adata masking
   • BAlways Encrypted
   • Ccolumn-level security
   • Drow-level security

   Show answer

   Answer: C

   Explanation

   the key word is 'infer'. as listed in the below documentation, data masking is not used to protect against malicious intent to infer the underlying data. I would therefore choose C

   Source: Adapted from community discussion — mikerss

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 290 · 370 in bank

    HOTSPOT - You have an Azure subscription that contains an Azure Data Lake Storage account. The storage account contains a data lake named DataLake1. You plan to use an Azure data factory to ingest data from a folder in DataLake1, transform the data, and land the data in another folder. You need to ensure that the data factory can read and write data from any folder in the DataLake1 container. The solution must meet the following requirements: • Minimize the risk of unauthorized user access. • Use the principle of least privilege. • Minimize maintenance effort. How should you configure access to the storage account for the data factory? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DP-203 practice, question 281. 370 questions available.