DP-203 Azure Data Engineer Associate Data Security and Compliance 3

Question 1

A DP-203 candidate is reviewing Azure Synapse dedicated SQL pool security. Which role grants a user the ability to query data without any administrative privileges?

Accepted Answer

db_datareader

Answer

db_owner

Answer

sysadmin

Answer

db_datawriter

Question 2

An organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. A service principal needs read access to only one folder. What is the most granular way to grant access?

Accepted Answer

Set a POSIX-style ACL on the specific folder for the service principal

Answer

Assign the Storage Blob Data Reader RBAC role at the storage account level

Answer

Create a SAS token with container-level read permission

Answer

Enable anonymous blob access on the container

Question 3

When configuring Azure Event Hubs to receive streaming data for a data engineering pipeline, which authentication method provides the most secure, password-less access from an Azure Data Factory pipeline?

Accepted Answer

Managed Identity assigned to the ADF instance

Answer

Shared Access Signature (SAS) stored in Key Vault

Answer

Connection string embedded in the linked service

Answer

Event Hubs namespace primary key

Question 4

A data engineer discovers that a Synapse Analytics workspace has public network access enabled. The compliance team requires all traffic to traverse private endpoints only. Which setting must be changed?

Accepted Answer

Set 'Allow Azure services and resources to access this workspace' to Off and disable public network access

Answer

Delete all firewall rules in the workspace

Answer

Change the workspace SKU to a private tier

Answer

Enable Azure DDoS Protection Standard on the workspace VNet

Question 5

What does Transparent Data Encryption (TDE) in Azure Synapse dedicated SQL pools protect against?

Accepted Answer

Theft of physical storage media or backup files

Answer

Unauthorized queries by internal users

Answer

SQL injection attacks on query endpoints

Answer

Cross-tenant data leakage via shared compute

Question 6

A data engineer needs to audit all login attempts to an Azure Synapse dedicated SQL pool. Which feature should be enabled?

Accepted Answer

Synapse SQL Auditing configured to write to a storage account or Log Analytics

Answer

Azure Monitor Diagnostic Logs for the Synapse workspace

Answer

Microsoft Defender for SQL with Advanced Threat Protection only

Answer

Azure Sentinel with a custom KQL rule

Question 7

In Azure Data Lake Storage Gen2, what is the difference between the 'Execute' ACL permission on a folder and the 'Read' permission?

Accepted Answer

Execute allows traversal into the folder to access children; Read allows listing the folder's contents

Answer

Execute allows listing folder contents; Read allows reading file data within the folder

Answer

Execute grants write access to create files; Read grants download access

Answer

Execute and Read are identical permissions in ADLS Gen2 ACLs