DP-203 Azure Data Engineer Associate Data Security and Compliance 2 — Questions and Answers
Question 1: A data engineer needs to prevent a specific Azure Data Factory pipeline from accessing a storage account over the public internet. What should they configure?
- Managed Private Endpoint in the ADF managed virtual network (Correct answer)
- A service endpoint on the storage account subnet
- A VPN Gateway between ADF and the storage account
- Azure Front Door with WAF policies
Correct answer: Managed Private Endpoint in the ADF managed virtual network
Managed Private Endpoints in ADF's managed virtual network route traffic privately through Azure backbone, eliminating public internet exposure.
Question 2: When using Azure Synapse Analytics, which feature allows you to restrict which IP addresses can connect to a dedicated SQL pool?
- Synapse workspace firewall rules (Correct answer)
- Network Security Groups on the subnet
- Azure Policy deny assignments
- Private DNS zones
Correct answer: Synapse workspace firewall rules
Synapse workspace-level firewall rules control IP-based access to dedicated SQL pools and other Synapse endpoints.
Question 3: A company stores sensitive PII in Azure Data Lake Storage Gen2. They want column-level masking when analysts query data via Azure Synapse serverless SQL. What is the correct approach?
- Apply Dynamic Data Masking on the external table columns in the serverless SQL database (Correct answer)
- Encrypt individual columns using Always Encrypted in Synapse
- Use row-level security policies in ADLS Gen2 ACLs
- Enable Transparent Data Encryption with customer-managed keys
Correct answer: Apply Dynamic Data Masking on the external table columns in the serverless SQL database
Dynamic Data Masking can be applied to columns in external tables in Synapse serverless SQL to obfuscate sensitive data for non-privileged users.
Question 4: Which Azure Databricks feature provides fine-grained access control on tables, columns, and rows stored in the Hive metastore?
- Table Access Control (Table ACLs)
- Unity Catalog data governance (Correct answer)
- Cluster-level IAM passthrough
- Databricks Secret Scopes
Correct answer: Unity Catalog data governance
Unity Catalog is the recommended unified governance solution for Azure Databricks that provides fine-grained table, column, and row-level security.
Question 5: An Azure Data Factory linked service is configured to connect to an on-premises SQL Server. Where should the connection credentials be stored to follow security best practices?
- Hardcoded in the linked service JSON definition
- In Azure Key Vault, referenced by the linked service (Correct answer)
- In an ADF pipeline parameter
- In a Git repository alongside the pipeline code
Correct answer: In Azure Key Vault, referenced by the linked service
Storing credentials in Azure Key Vault and referencing them from the ADF linked service keeps secrets out of pipeline definitions and rotation-friendly.
Question 6: A data engineer must ensure that all data written to Azure Data Lake Storage Gen2 is encrypted with a customer-managed key (CMK) that can be rotated without data re-encryption. Which service holds the CMK?
- Azure Key Vault (Correct answer)
- Azure Active Directory
- Azure Information Protection
- Azure Dedicated HSM directly on the storage account
Correct answer: Azure Key Vault
ADLS Gen2 supports CMK encryption via Azure Key Vault, where key rotation is handled without re-encrypting the underlying data.
Question 7: In Microsoft Purview, what is the purpose of a 'sensitivity label' applied to an Azure Synapse Analytics asset?
- It enforces network isolation on the Synapse workspace
- It classifies the asset to indicate the sensitivity of the data it contains (Correct answer)
- It automatically masks data returned by SQL queries
- It restricts who can create new Synapse pipelines
Correct answer: It classifies the asset to indicate the sensitivity of the data it contains
Sensitivity labels in Microsoft Purview classify data assets to communicate the data's sensitivity level to consumers and compliance stakeholders.
DP-203 Azure Data Engineer Associate Data Security and Compliance 2
A data engineer needs to prevent a specific Azure Data Factory pipeline from accessing a storage account over the public internet.
What should they configure?