DP-203 Azure Data Engineer Associate Data Security and Compliance 2

Question 1

A data engineer needs to prevent a specific Azure Data Factory pipeline from accessing a storage account over the public internet. What should they configure?

Accepted Answer

Managed Private Endpoint in the ADF managed virtual network

Answer

A service endpoint on the storage account subnet

Answer

A VPN Gateway between ADF and the storage account

Answer

Azure Front Door with WAF policies

Question 2

When using Azure Synapse Analytics, which feature allows you to restrict which IP addresses can connect to a dedicated SQL pool?

Accepted Answer

Synapse workspace firewall rules

Answer

Network Security Groups on the subnet

Answer

Azure Policy deny assignments

Answer

Private DNS zones

Question 3

A company stores sensitive PII in Azure Data Lake Storage Gen2. They want column-level masking when analysts query data via Azure Synapse serverless SQL. What is the correct approach?

Accepted Answer

Apply Dynamic Data Masking on the external table columns in the serverless SQL database

Answer

Encrypt individual columns using Always Encrypted in Synapse

Answer

Use row-level security policies in ADLS Gen2 ACLs

Answer

Enable Transparent Data Encryption with customer-managed keys

Question 4

Which Azure Databricks feature provides fine-grained access control on tables, columns, and rows stored in the Hive metastore?

Accepted Answer

Unity Catalog data governance

Answer

Table Access Control (Table ACLs)

Answer

Cluster-level IAM passthrough

Answer

Databricks Secret Scopes

Question 5

An Azure Data Factory linked service is configured to connect to an on-premises SQL Server. Where should the connection credentials be stored to follow security best practices?

Accepted Answer

In Azure Key Vault, referenced by the linked service

Answer

Hardcoded in the linked service JSON definition

Answer

In an ADF pipeline parameter

Answer

In a Git repository alongside the pipeline code

Question 6

A data engineer must ensure that all data written to Azure Data Lake Storage Gen2 is encrypted with a customer-managed key (CMK) that can be rotated without data re-encryption. Which service holds the CMK?

Accepted Answer

Azure Key Vault

Answer

Azure Active Directory

Answer

Azure Information Protection

Answer

Azure Dedicated HSM directly on the storage account

Question 7

In Microsoft Purview, what is the purpose of a 'sensitivity label' applied to an Azure Synapse Analytics asset?

Accepted Answer

It classifies the asset to indicate the sensitivity of the data it contains

Answer

It enforces network isolation on the Synapse workspace

Answer

It automatically masks data returned by SQL queries

Answer

It restricts who can create new Synapse pipelines