DP-203 Azure Data Engineer Associate Data Security and Compliance 4

Question 1

A company must comply with GDPR and needs to identify all columns containing personal data across Azure Synapse and ADLS Gen2 assets. Which Azure service automates this discovery?

Accepted Answer

Microsoft Purview with automated scanning and classification

Answer

Azure Security Center

Answer

Azure Policy with built-in compliance initiatives

Answer

Azure Monitor with custom metric alerts

Question 2

An Azure Databricks cluster is configured with credential passthrough. What does this mean for data access?

Accepted Answer

The cluster passes the end user's Azure AD credentials to ADLS Gen2, enforcing per-user access control

Answer

The cluster uses a service principal for all ADLS access regardless of the logged-in user

Answer

All users on the cluster share the same storage access key

Answer

Credential passthrough disables Unity Catalog and falls back to Hive metastore

Question 3

Which Azure Key Vault object type should a data engineer use to store an Azure Storage account access key?

Accepted Answer

Secret

Answer

Certificate

Answer

Key

Answer

Managed Identity

Question 4

A data pipeline writes raw data to an ADLS Gen2 container and then processes it into a curated zone. The processed data must not be deletable by anyone except a designated compliance officer for 7 years. Which feature enforces this?

Accepted Answer

Azure Blob Storage immutability policy (WORM) with a time-based retention policy

Answer

ADLS Gen2 soft delete with a 7-year retention window

Answer

Azure Backup with a 7-year vault retention policy

Answer

Azure Policy denying delete operations on the storage account

Question 5

A Synapse Analytics pipeline uses a linked service to connect to Azure SQL Database. The pipeline fails with an error that the Managed Identity does not have permission. What is the correct fix?

Accepted Answer

Grant the Synapse workspace Managed Identity the appropriate database role in Azure SQL Database

Answer

Switch to SQL authentication with a hardcoded password

Answer

Add the Synapse IP to the Azure SQL firewall rules

Answer

Enable Advanced Threat Protection on the Azure SQL Database

Question 6

What is the primary purpose of enabling Microsoft Defender for SQL on an Azure Synapse dedicated SQL pool?

Accepted Answer

To detect anomalous database activities and potential threats such as SQL injection

Answer

To encrypt data at rest automatically

Answer

To block all public internet connections to the SQL pool

Answer

To enable row-level security on all tables

Question 7

A data engineer wants to ensure that only resources within a specific Azure Virtual Network can write to an ADLS Gen2 account. What should be configured?

Accepted Answer

Storage account network rules to allow only the specific VNet subnet via service endpoints

Answer

A Shared Access Signature scoped to the VNet

Answer

A DNS zone override for the storage account FQDN

Answer

Azure Firewall with DNAT rules for the storage account