DP-203 Azure Data Engineer Associate Data Security and Compliance 5

Question 1

A DP-203 scenario requires encrypting data in an Azure Synapse dedicated SQL pool using a key stored in a customer-managed Azure Key Vault. Which TDE setting must be configured?

Accepted Answer

Set TDE Protector to the customer-managed key from Key Vault

Answer

Setting the TDE Protector to a customer-managed key stored in Azure Key Vault enables BYOK encryption for the dedicated SQL pool's data at rest.

Question 2

In Azure Data Factory, a pipeline accesses multiple sensitive resources. The security team requires that secrets never leave Key Vault. Which ADF linked service configuration achieves this?

Accepted Answer

Use Key Vault references in the linked service so ADF fetches secrets at runtime

Answer

Key Vault references in ADF linked services instruct ADF to retrieve secrets from Key Vault at pipeline execution time, keeping secrets out of ADF's own storage.

Question 3

A data engineering team needs to enforce that all new Azure resources in a subscription must use customer-managed keys for encryption. Which Azure tool should they use?

Accepted Answer

Azure Policy with a deny effect to block resources not using CMK

Answer

Azure Policy with a deny effect prevents deployment of resources that do not meet the CMK encryption requirement, enforcing compliance at provisioning time.

Question 4

When scanning an ADLS Gen2 source in Microsoft Purview, what credential type should be used to allow Purview to read file metadata and content for classification?

Accepted Answer

The Purview managed identity granted Storage Blob Data Reader on the ADLS account

Answer

Granting Purview's managed identity the Storage Blob Data Reader role on the ADLS account is the recommended least-privilege, passwordless approach for scanning.

Question 5

A data engineer is implementing row-level security in an Azure Synapse dedicated SQL pool so that sales reps see only their own region's data. What T-SQL objects are required?

Accepted Answer

A security predicate function and a security policy bound to the table

Answer

Row-level security in Synapse SQL requires an inline table-valued function as the predicate and a CREATE SECURITY POLICY statement to bind it to the target table.

DP-203 Azure Data Engineer Associate Practice Test

DP-203 Azure Data Engineer Associate Practice Test

DP-203 Azure Data Engineer Associate Data Security and Compliance 5