DP-203 Azure Data Engineer Associate Data Security and Compliance 5

Question 1

A DP-203 scenario requires encrypting data in an Azure Synapse dedicated SQL pool using a key stored in a customer-managed Azure Key Vault. Which TDE setting must be configured?

Accepted Answer

Set TDE Protector to the customer-managed key from Key Vault

Answer

Enable TDE with the service-managed key, then rotate to a customer key

Answer

Enable Always Encrypted with the Key Vault key as the column master key

Answer

Configure Bring Your Own Key (BYOK) in the Synapse workspace Advanced Settings

Question 2

In Azure Data Factory, a pipeline accesses multiple sensitive resources. The security team requires that secrets never leave Key Vault. Which ADF linked service configuration achieves this?

Accepted Answer

Use Key Vault references in the linked service so ADF fetches secrets at runtime

Answer

Store secrets in ADF's own encrypted credential store

Answer

Encode secrets as Base64 in the pipeline parameters

Answer

Use a self-hosted integration runtime with secrets stored locally on the IR machine

Question 3

A data engineering team needs to enforce that all new Azure resources in a subscription must use customer-managed keys for encryption. Which Azure tool should they use?

Accepted Answer

Azure Policy with a deny effect to block resources not using CMK

Answer

Azure Blueprints to deploy resources with pre-configured settings

Answer

Azure Security Center recommendation auto-remediation

Answer

Azure Cost Management to flag non-compliant resources

Question 4

When scanning an ADLS Gen2 source in Microsoft Purview, what credential type should be used to allow Purview to read file metadata and content for classification?

Accepted Answer

The Purview managed identity granted Storage Blob Data Reader on the ADLS account

Answer

A SAS token with list and read permissions, stored as a Purview credential

Answer

An ADLS access key stored in Purview's credential store

Answer

A service principal with Owner role on the storage account

Question 5

A data engineer is implementing row-level security in an Azure Synapse dedicated SQL pool so that sales reps see only their own region's data. What T-SQL objects are required?

Accepted Answer

A security predicate function and a security policy bound to the table

Answer

A view and a CHECK constraint on the table

Answer

A stored procedure that filters results before returning them

Answer

Column-level permissions using DENY SELECT on region column

Question 6

An ADLS Gen2 account contains highly sensitive financial data. The compliance team wants all access requests to the data to be logged with the caller's identity. Which diagnostic log category must be enabled?

Accepted Answer

StorageRead, StorageWrite, and StorageDelete log categories under Diagnostic Settings

Answer

Azure Monitor Activity Log at the subscription level

Answer

ADLS Gen2 metrics with dimensional breakdown by authentication type

Answer

Microsoft Defender for Storage alerts only

Question 7

A company needs to ensure that data exfiltration from Azure Synapse Analytics workspace is prevented, meaning managed resources cannot send data to arbitrary external endpoints. Which feature addresses this?

Accepted Answer

Synapse workspace data exfiltration protection, restricting outbound traffic to approved Azure AD tenants only

Answer

Azure Firewall with application rules on the Synapse subnet

Answer

Disabling all outbound internet access using NSG deny-all outbound rules

Answer

Enabling Microsoft Defender for Synapse with outbound anomaly detection