DP-203 Azure Data Engineer Associate Data Security and Compliance 3

Question 1

A DP-203 candidate is reviewing Azure Synapse dedicated SQL pool security. Which role grants a user the ability to query data without any administrative privileges?

Accepted Answer

db_datareader

Answer

The db_datareader fixed database role grants SELECT permissions on all user tables, enabling read-only query access without admin rights.

Question 2

An organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. A service principal needs read access to only one folder. What is the most granular way to grant access?

Accepted Answer

Set a POSIX-style ACL on the specific folder for the service principal

Answer

ADLS Gen2 with HNS supports POSIX ACLs that can be applied at the folder level, providing more granular access than RBAC roles scoped to the account.

Question 3

When configuring Azure Event Hubs to receive streaming data for a data engineering pipeline, which authentication method provides the most secure, password-less access from an Azure Data Factory pipeline?

Accepted Answer

Managed Identity assigned to the ADF instance

Answer

Managed Identity eliminates the need for stored credentials by allowing ADF to authenticate to Event Hubs using its Azure AD identity.

Question 4

A data engineer discovers that a Synapse Analytics workspace has public network access enabled. The compliance team requires all traffic to traverse private endpoints only. Which setting must be changed?

Accepted Answer

Set 'Allow Azure services and resources to access this workspace' to Off and disable public network access

Answer

Disabling public network access on the Synapse workspace and removing Azure service exceptions forces all traffic through configured private endpoints.

Question 5

What does Transparent Data Encryption (TDE) in Azure Synapse dedicated SQL pools protect against?

Accepted Answer

Theft of physical storage media or backup files

Answer

TDE encrypts data at rest, protecting database files and backups from being read if physical media or backup storage is compromised.

DP-203 Azure Data Engineer Associate Practice Test

DP-203 Azure Data Engineer Associate Practice Test

DP-203 Azure Data Engineer Associate Data Security and Compliance 3