DP-203 Azure Data Engineer Associate Data Security and Compliance 3 — Questions and Answers
Question 1: A DP-203 candidate is reviewing Azure Synapse dedicated SQL pool security. Which role grants a user the ability to query data without any administrative privileges?
- db_datareader (Correct answer)
- db_owner
- sysadmin
- db_datawriter
Correct answer: db_datareader
The db_datareader fixed database role grants SELECT permissions on all user tables, enabling read-only query access without admin rights.
Question 2: An organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. A service principal needs read access to only one folder. What is the most granular way to grant access?
- Assign the Storage Blob Data Reader RBAC role at the storage account level
- Set a POSIX-style ACL on the specific folder for the service principal (Correct answer)
- Create a SAS token with container-level read permission
- Enable anonymous blob access on the container
Correct answer: Set a POSIX-style ACL on the specific folder for the service principal
ADLS Gen2 with HNS supports POSIX ACLs that can be applied at the folder level, providing more granular access than RBAC roles scoped to the account.
Question 3: When configuring Azure Event Hubs to receive streaming data for a data engineering pipeline, which authentication method provides the most secure, password-less access from an Azure Data Factory pipeline?
- Shared Access Signature (SAS) stored in Key Vault
- Connection string embedded in the linked service
- Managed Identity assigned to the ADF instance (Correct answer)
- Event Hubs namespace primary key
Correct answer: Managed Identity assigned to the ADF instance
Managed Identity eliminates the need for stored credentials by allowing ADF to authenticate to Event Hubs using its Azure AD identity.
Question 4: A data engineer discovers that a Synapse Analytics workspace has public network access enabled. The compliance team requires all traffic to traverse private endpoints only. Which setting must be changed?
- Set 'Allow Azure services and resources to access this workspace' to Off and disable public network access (Correct answer)
- Delete all firewall rules in the workspace
- Change the workspace SKU to a private tier
- Enable Azure DDoS Protection Standard on the workspace VNet
Correct answer: Set 'Allow Azure services and resources to access this workspace' to Off and disable public network access
Disabling public network access on the Synapse workspace and removing Azure service exceptions forces all traffic through configured private endpoints.
Question 5: What does Transparent Data Encryption (TDE) in Azure Synapse dedicated SQL pools protect against?
- Unauthorized queries by internal users
- Theft of physical storage media or backup files (Correct answer)
- SQL injection attacks on query endpoints
- Cross-tenant data leakage via shared compute
Correct answer: Theft of physical storage media or backup files
TDE encrypts data at rest, protecting database files and backups from being read if physical media or backup storage is compromised.
Question 6: A data engineer needs to audit all login attempts to an Azure Synapse dedicated SQL pool. Which feature should be enabled?
- Azure Monitor Diagnostic Logs for the Synapse workspace
- Synapse SQL Auditing configured to write to a storage account or Log Analytics (Correct answer)
- Microsoft Defender for SQL with Advanced Threat Protection only
- Azure Sentinel with a custom KQL rule
Correct answer: Synapse SQL Auditing configured to write to a storage account or Log Analytics
Synapse SQL Auditing tracks database events including logins and writes audit logs to Azure Storage, Log Analytics, or Event Hubs for analysis.
Question 7: In Azure Data Lake Storage Gen2, what is the difference between the 'Execute' ACL permission on a folder and the 'Read' permission?
- Execute allows listing folder contents; Read allows reading file data within the folder
- Execute allows traversal into the folder to access children; Read allows listing the folder's contents (Correct answer)
- Execute grants write access to create files; Read grants download access
- Execute and Read are identical permissions in ADLS Gen2 ACLs
Correct answer: Execute allows traversal into the folder to access children; Read allows listing the folder's contents
In ADLS Gen2 POSIX ACLs, Execute (X) on a folder allows traversing into it to reach child items, while Read (R) allows listing the folder's directory contents.
DP-203 Azure Data Engineer Associate Data Security and Compliance 3
A DP-203 candidate is reviewing Azure Synapse dedicated SQL pool security.
Which role grants a user the ability to query data without any administrative privileges?