Microsoft Certified: Azure Databricks Data Engineer Associate (DP-750)

B and D are correct.

Explanation: A managed location defines where Unity Catalog stores the data files for managed tables and volumes in the catalog, so the data is stored in the dedicated container. Workspace bindings control which workspaces can access the catalog. Restricting a production catalog to production workspaces prevents development environments from querying or modifying production data.

A is incorrect: New catalogs are accessible from all workspaces attached to the metastore by default. Development workspaces would still be able to access production data.

C is incorrect: Catalogs are the primary unit of data isolation, and each catalog can have its own storage location and access policies. Schema names alone do not provide a dedicated storage location or workspace restriction.

B is correct.

Explanation: You can customize metadata at the space level without altering the underlying Unity Catalog objects. Updating the column description and adding synonyms lets Genie match the managers' language to the fcst_cat column.

A is incorrect: Renaming the source column changes the underlying Unity Catalog object. You can refine descriptions and synonyms within the Genie space instead.

C is incorrect: A space should use a small, focused set of tables for a focused set of business questions. Adding tables does not explain what the fcst_cat column means.

D is incorrect: The instructions limit is 100, and the guidance is to start with minimal instructions and expand based on actual user questions. Example queries do not replace column descriptions and synonyms for this mapping problem.

B and D are correct.

Explanation: To create compute dedicated to a group, you must enable Unity Catalog on the workspace and use Databricks Runtime 15.4 or above. The group also needs CAN MANAGE permission on a workspace folder, such as /Workspace/Groups/<groupName>, for notebooks, MLflow experiments, and other artifacts used on the group cluster.

A is incorrect: No isolation shared is a legacy access mode that exposes service account keys to users with CAN ATTACH TO permission. Group compute uses Dedicated access mode.

C is incorrect: The unrestricted cluster creation entitlement lets non-admin users create clusters without size restrictions. It is not a requirement for assigning compute to a group.

C is correct.

Explanation: Streaming tables use streaming semantics to process only new rows that arrive after the last refresh. They are intended for incremental ingestion, such as landing files and building bronze layers where data only arrives as new rows. They do not reprocess previously seen data during a normal refresh.

A is incorrect: A standard view does not store data. It runs the underlying query each time you access it, so it does not provide incremental ingestion.

B is incorrect: Materialized views use batch semantics to precompute results over bounded data. They are suited to aggregations over a complete dataset where periodic recomputation is acceptable, not append-only ingestion.

D is incorrect: An external table registers existing data in place and is useful when other systems manage the data. It does not process only the new rows on each refresh.

D is correct.

Explanation: A connection stores the details needed to reach the external database, including host, port, and credentials. A foreign catalog uses that connection and mirrors the named external database in Unity Catalog. Users then query the foreign tables with standard SQL under Unity Catalog permissions, and the queries appear in the audit logs. No data migration is required.

A is incorrect: The foreign catalog is created with the USING CONNECTION clause. The connection provides the authentication and network details, so a connection is required first.

B is incorrect: A materialized view needs a source that is already accessible in Unity Catalog. The connection and foreign catalog make the external tables accessible.

C is incorrect: An ETL copy would work against the requirement to avoid weeks of migration effort. A foreign catalog provides access without migrating the data.

B is correct.

Explanation: Standard performance mode is optimized for cost. It can reduce DBU consumption by up to 70% compared to performance-optimized mode. Jobs typically start within 4 to 6 minutes in this mode, which is acceptable for a scheduled batch job. Serverless compute also removes the need to manage clusters.

A is incorrect: Performance-optimized mode is the default and starts in seconds. It is intended for interactive or latency-sensitive workloads, so it does not give the DBU reduction that this scenario requires.

C is incorrect: A classic cluster requires you to manage configuration. An instance pool also means you pay for virtual machine costs while instances are idle.

D is incorrect: A pro SQL warehouse is optimized for SQL queries and is used when you need custom networking. It is not the compute option for a Python batch job.

D is correct.

Explanation: On clusters that use standard access mode, Maven coordinates and JAR file paths require allowlist approval before installation. A metastore admin adds the coordinates in the format groupId:artifactId:version to the allowlist. This gives admins review of the libraries that run on shared compute. You need CAN MANAGE permission on the cluster to install the library.

A is incorrect: Ad-hoc commands such as pip3 bypass centralized management and security controls. A pip3 command also does not install a Java JAR library.

B is incorrect: For clusters that use standard access mode, library file paths in workspace files must also be added to the allowlist before installation.

C is incorrect: Init scripts are not recommended for library installation, because cluster-scoped libraries are the better approach. On standard access mode, the init script path also requires its own allowlist entry.

A is correct.

Explanation: Volume permissions apply to the entire volume. Unity Catalog volumes do not support folder-level or subdirectory-level ACLs. To apply different access controls to different sets of files, create a separate volume for each security boundary.

B is incorrect: Volumes do not support subdirectory-level ACLs, so this configuration cannot be applied.

C is incorrect: Managed and external volumes use the same permission model. The main difference is storage control and data lifecycle, so converting the volume type does not add folder-level permissions.

D is incorrect: A READ VOLUME grant at the catalog level cascades to all volumes in that catalog. This gives analysts access to the restricted files.

C is correct.

Explanation: Flexible node types fall back to compatible alternative instance types when the preferred type is unavailable. Compatible types share the same vCPU count, memory (within 100–110%), local disk configuration, CPU architecture, and OS image support. A workspace admin enables the feature by using the Enable auto flexible node types toggle in the workspace Compute admin settings. After that, all new classic compute resources use fallback instance types.

A is incorrect: Autoscaling adjusts the number of workers between a minimum and a maximum. It does not substitute a different instance type when the specified type is unavailable.

B is incorrect: Spot instances reduce cost, but Azure can reclaim them when it needs the capacity. They do not provide a fallback instance type for a stockout.

D is incorrect: Setting alternate_node_type_ids to an empty list disables flexible node types for an individual compute resource. Use it only for workloads with strict instance type requirements.

A is correct.

Explanation: Databricks Runtime ML includes pre-installed machine learning libraries, GPU drivers, and frameworks such as CUDA. GPU instances support deep learning training. Photon isn't supported on GPU-enabled clusters, so you must disable it.

B is incorrect: A standard runtime does not include the machine learning libraries and GPU drivers that Databricks Runtime ML provides. Photon must also be disabled on GPU instances.

C is incorrect: The runtime and instance choices are correct, but Photon isn't compatible with GPU instances. Leaving it enabled does not meet the requirement.

D is incorrect: E-series instances are memory-optimized and do not provide GPUs. A standard runtime also does not include the machine learning libraries and GPU drivers.

A is correct.

Explanation: Row and Column Security keeps one authoritative table. You associate a masking function with each sensitive column and a row filter function with the table. Queries then enforce the logic at the table level, and you manage fewer objects. Dynamic views are not needed because there is no multi-table composition or abstraction requirement.

B is incorrect: Duplicating tables creates synchronization problems, complicates governance, and can cause security drift.

C is incorrect: Dynamic views are valid when you need multi-table composition or strict abstraction. Creating one for each audience adds objects to grant, audit, and maintain.

D is incorrect: Complex transformations in masking functions blur responsibilities. These rules belong in upstream transformation pipelines, not in security enforcement.

D is correct.

Explanation: A user must have USE CATALOG on the catalog and USE SCHEMA on the schema to query a table. A SELECT grant on the schema is inherited by all current and future tables and views in that schema. Access stays limited to that schema.

A is incorrect: Explicit table grants limit access precisely, but they do not cover future tables and require ongoing effort when a schema contains many tables.

B is incorrect: Inheriting from the catalog opens access to every schema and object in the catalog. This exceeds the requirement.

C is incorrect: A SELECT grant on the schema is not enough by itself. If USE CATALOG or USE SCHEMA is missing, the users cannot query the table.

C is correct.

Explanation: For tables with deletion vectors enabled, you must run REORG TABLE ... APPLY (PURGE) after deleting records to permanently remove the underlying data. After the deletion operations, run VACUUM to remove the data files from storage. VACUUM permanently deletes files older than the retention threshold, so run it carefully.

A is incorrect: VACUUM by itself does not remove data that deletion vectors have marked for deletion.

B is incorrect: OPTIMIZE improves file layout and query performance. The evidence does not show that it permanently removes deleted records.

D is incorrect: The delta.logRetentionDuration property controls how long transaction log history is kept. Increasing it preserves history longer and does not purge deleted data.

C is correct.

Explanation: Azure Databricks does not support the Azure RBAC permission model for Key Vault-backed secret scopes. A Key Vault created without an explicit permission model can default to Azure RBAC, which causes a 403 error during scope creation. In the Azure portal, go to Settings, then Access configuration, and verify that Permission model is set to Vault access policy.

A is incorrect: Scope ACLs control who can read secrets from an existing scope. They cannot fix a failure that occurs while you create the scope.

B is incorrect: You must allow trusted Microsoft services to bypass the firewall, even if you restrict access to specific virtual networks. Disabling it does not address the permission model.

D is incorrect: WRITE is not applicable to Key Vault-backed scopes. You manage secrets directly in Azure Key Vault.

D is correct.

Explanation: Azure Storage accounts offer low-cost, long-term archival and batch analysis. They suit compliance scenarios where logs are accessed infrequently but must be retained for extended periods. Platform administrators configure log delivery at the account level through the Azure portal.

A is incorrect: Azure Log Analytics suits fast analysis, interactive investigations, and dashboards. It is not the destination described for low-cost, long-term archival.

B is incorrect: Azure Event Hubs suits real-time streaming to downstream consumers and SIEM platforms. It is not an archival destination.

C is incorrect: Azure Databricks retains audit logs for up to one year. You need a separate retention strategy for logs beyond that period.

B and D are correct.

Explanation: The managed identity needs a role on the storage account. Storage Blob Data Contributor provides read and write access to blob data, and you can assign it at the account level or the container level. You then create a storage credential in Unity Catalog with the Azure Managed Identity type and the access connector resource ID. This requires the CREATE STORAGE CREDENTIAL privilege on the metastore.

A is incorrect: Managed identities remove the need to create, store, and rotate secrets. Client secrets are part of the service principal approach.

C is incorrect: Reader is not the role identified for read and write access to blob data. Storage Blob Data Contributor is the role identified for that access.

A and D are correct.

Explanation: Unity Catalog captures lineage automatically only for queries that run on Unity Catalog-enabled compute. Queries that access tables by direct file path do not generate lineage data, and path-based access shows only the path in lineage. Use Unity Catalog-enabled compute and reference tables by using the three-level namespace catalog.schema.table.

B is incorrect: Lineage is not preserved for renamed objects, so renaming a table loses the connection to its previous name. It does not fix path-based access or non-Unity Catalog compute.

C is incorrect: Global temporary views are not captured in lineage, so this change does not improve lineage coverage.

B is correct.

Explanation: When a user queries a view that accesses an ABAC-protected table, Azure Databricks evaluates row filters and column masks by using the session user's identity. The analyst is not in the compliance_team, so the mask applies. Users still do not need direct privileges on the underlying table, but you must design the policy for the caller's identity.

A is incorrect: The view owner's identity is not used. Designing the policy on the assumption that the owner's exception applies would expose SSN data in your plan but not in practice.

C is incorrect: The schema owner's identity is not used to evaluate the policy. The identity of the person running the query is used.

D is incorrect: Not needing direct privileges on the underlying table does not bypass the policy. The row filter or column mask still applies to the session user.

B is correct.

Explanation: When a storage account has firewall or virtual network restrictions, you must explicitly allow the access connector and managed identity to reach the storage, in addition to allowing the compute nodes. If the identity is not allowed through the firewall rules, storage can reject a valid token.

A is incorrect: Unity Catalog permission checks already succeeded. More SELECT grants do not change the storage firewall behavior.

C is incorrect: A service principal cannot be used to access storage accounts that are protected by network rules. A managed identity with an access connector can.

D is incorrect: Row filters are enforced on the compute resource after data is returned from storage. They do not affect whether storage accepts the token.

A is correct.

Explanation: Open sharing is for recipients who use platforms other than Azure Databricks or lack Unity Catalog access. OIDC federation grants short-lived Databricks OAuth tokens in exchange for JWT tokens from the recipient's identity provider. This removes long-lived credentials entirely.

B is incorrect: Databricks-to-Databricks sharing requires the recipient to have a Unity Catalog-enabled Azure Databricks workspace. This partner does not.

C is incorrect: You should set an expiration period instead of allowing tokens to live indefinitely. Tokens without expiration are long-lived credentials.

D is incorrect: An IP access list restricts which addresses can connect, with up to 100 IP or CIDR values for each recipient. It does not change the bearer token into a short-lived credential.

D is correct.

Explanation: ROW_NUMBER() with QUALIFY lets you control which duplicate to keep. Partitioning by customer_id and ordering by updated_at in descending order keeps only the most recently updated record for each customer.

A is incorrect: dropDuplicates keeps only the first occurrence. It does not let you choose the row with the latest updated_at.

B is incorrect: distinct() removes duplicates across all columns. Rows that differ in name or updated_at are not identical, so they remain.

C is incorrect: GROUP BY with HAVING identifies values that appear more than once. It does not remove duplicate rows.

D is correct.

Explanation: Flow names identify streaming checkpoints. If you rename a flow, the checkpoint does not carry over, and the renamed flow starts processing from the beginning as a new flow. Plan for this behavior before you rename a flow that has been running.

A is incorrect: Flow names are used to identify checkpoints, so a rename does affect checkpoint continuity.

B is incorrect: The documented effect of a rename is on the checkpoint of the renamed flow. It does not describe a table drop or a rebuild from both sources.

C is incorrect: Each flow is identified by its own name, and orders_east_flow keeps its name. The documented effect applies to the renamed flow.

A is correct.

Explanation: The native Event Hubs connector returns a different schema than the Kafka-compatible interface. The event payload is in the body column instead of value. Use CAST(body AS STRING) before parsing the JSON content.

B is incorrect: The startingOffsets option controls where a new Kafka query begins reading. It does not change the columns that the source returns.

C is incorrect: SASL settings configure authentication for the Kafka-compatible interface. They do not rename columns, and the native connector uses its own connection string option.

D is incorrect: A trigger controls when the stream processes data. It does not change the source schema, so the value column is still missing.

A and C are correct.

Explanation: MERGE INTO matches source rows to target rows. It updates existing records and inserts new ones in a single statement. MERGE requires a unique match between source and target rows. If multiple source rows match the same target row, the operation fails, so you deduplicate the source first.

B is incorrect: INSERT INTO appends rows and does not update existing records. It also does not check for duplicates, so changed customers would be added as additional rows.

D is incorrect: INSERT OVERWRITE truncates the target table or partition before it inserts rows. It replaces existing data instead of synchronizing changes.

B is correct.

Explanation: An anti join returns left table rows that have no match in the right table. It does not include columns from the right table. This meets the requirement for customers with no orders and customer-only columns.

A is incorrect: A left join returns all left table rows, including customers that have orders. It adds NULLs for the right table only when no match exists.

C is incorrect: A semi join returns left table rows that have matches in the right table. This returns customers who placed orders, which is the opposite of the requirement.

D is incorrect: An inner join returns only matching rows from both tables. It excludes customers without orders.

C is correct.

Explanation: CREATE OR REPLACE TABLE fully replaces the table contents. It preserves table history, granted privileges, and any row filters or column masks. Downstream users continue to access the table without reconfiguration.

A is incorrect: The IF NOT EXISTS clause skips execution entirely when the table already exists. The table is not refreshed after the first run.

B is incorrect: COPY INTO appends files to an existing table and skips files that were already loaded. It does not replace the table contents, and its source is files rather than a query.

D is incorrect: Dropping and recreating the table is not the documented way to keep metadata and permissions. CREATE OR REPLACE is documented to preserve them.

B is correct.

Explanation: Query-based connectors query the source database directly on a schedule and do not require CDC configuration. They use a cursor column, which is a monotonically increasing timestamp or integer column, to find new or updated rows since the last run. No gateway or staging storage is required, so updated_at meets the stated constraints.

A is incorrect: Database connectors that use CDC create an ingestion gateway that extracts changes from the source binlog. CDC and binlog access are not available in this scenario.

C is incorrect: SaaS connectors are for enterprise SaaS applications such as Salesforce and Workday. They extract data through the source API and do not apply to a MySQL table.

D is incorrect: COPY INTO loads files from a storage location into an existing Delta table. It does not read rows from a source database.

C is correct.

Explanation: Anomaly detection is enabled once at the schema level. It evaluates freshness and completeness for all tables in the schema without per-table configuration. Data profiling is configured per table. It tracks distributions, null percentages, and drift metrics, so you use it for the critical table.

A is incorrect: Data profiling is configured individually for each table, so this approach requires per-table configuration for every table in the schema.

B is incorrect: Anomaly detection evaluates freshness and completeness. It does not provide the per-table distribution, null percentage, and drift metrics that data profiling provides.

D is incorrect: ANALYZE TABLE collects statistics such as row counts, null counts, and distinct counts. It does not create the drift metrics table that data profiling creates.

B and D are correct.

Explanation: With partial update records, ignoring null updates leaves existing column values intact instead of overwriting them with nulls. SCD Type 2 preserves historical versions, and TRACK HISTORY ON * EXCEPT (last_login) updates the existing record in place for last_login changes. Changes to other columns, such as name or department, create new historical versions.

A is incorrect: SCD Type 1 keeps only the current version of each record, so it does not preserve history for name and department.

C is incorrect: The COLUMNS * EXCEPT clause excludes columns from the destination table, such as the operation and sequence columns. Excluding last_login would remove it from the table instead of limiting history tracking.

A is correct.

Explanation: DECIMAL(p,s) provides exact precision for financial data. TIMESTAMP converts values to UTC for storage and applies the session timezone when values are read. This behavior gives consistent ordering across time zones.

B is incorrect: DOUBLE uses binary representation and can introduce rounding errors with base-10 values such as currency.

C is incorrect: TIMESTAMP_NTZ does not apply timezone conversion. Use it when a time must remain as entered, not when you track events across time zones.

D is incorrect: DOUBLE can introduce rounding errors with currency, and TIMESTAMP_NTZ does not apply timezone conversion.

B and D are correct.

Explanation: A Max duration more than 50% above the 75th percentile indicates data skew, and the repeated customer ID is a common cause. AQE dynamically handles skewed joins, and salting distributes the skewed key across partitions. Spill often accompanies skew, so addressing skew can also resolve the spill.

A is incorrect: Each call to repartition() triggers a full shuffle. Unnecessary repartitioning increases data movement.

C is incorrect: Spark cache requires explicit management. Cached data that you do not unpersist consumes memory that Spark needs for processing, which can worsen memory pressure.

C is correct.

Explanation: A streaming table is a Delta table for append-only processing and handles each input record once, so it fits ingestion of new files from cloud storage. A materialized view handles aggregations and complex joins and stays synchronized when upstream data changes, so it fits the join and regional sums.

A is incorrect: Materialized views are intended for transformations such as aggregations and joins, not for append-only ingestion that processes each record once.

B is incorrect: Streaming tables are for append-only data. They are not the right choice for aggregations and joins on dimensions that can change.

D is incorrect: This reverses the roles. The append-only ingestion fits a streaming table, and the aggregation with a join on changing data fits a materialized view.

B is correct.

Explanation: Tags propagate from clusters and workspaces to billing records. You can query system.billing.usage and filter or group by custom_tags to see DBU usage for a project. Apply the tags consistently from the start.

A is incorrect: The Metrics tab shows hardware, Spark, and GPU metrics. It does not provide billing data that you can attribute to a project.

C is incorrect: Budgets track spending and send email notifications. Creating and managing budgets requires account admin permissions, and workspace admins typically cannot create them.

D is incorrect: You cannot add tags retroactively to historical usage. Usage that occurs before you apply the tags cannot be attributed by tag.

A is correct.

Explanation: A red driver node with blue (idle) workers indicates that the driver is overloaded. A larger driver instance type addresses that constraint.

B is incorrect: The workers are idle, so more workers add capacity where it is not needed. The bottleneck is the driver.

C is incorrect: Restarting a cluster terminates running jobs and resets the Spark UI history. It removes diagnostic information and does not address the overloaded driver.

D is incorrect: Auto-termination shuts down idle clusters to control cost. It does not change driver capacity or fix slow execution.

D is correct.

Explanation: Repair run re-runs only the unsuccessful tasks and their dependents. This saves time and compute compared with restarting the whole job. Repair is available for jobs with two or more tasks, and this job has five.

A is incorrect: Maximum concurrent runs addresses runs that queue or are skipped behind other runs. It does not resolve a task failure, and starting from the first task re-runs successful tasks.

B is incorrect: Restart run applies to continuous jobs that are in an exponential backoff state. It cancels the active run and starts a new run.

C is incorrect: A full run repeats tasks that already succeeded. This uses more time and compute than a repair run.

C is correct.

Explanation: Log streaming sends diagnostic data to Azure Log Analytics, where events from multiple workspaces can be queried in one place. The DatabricksJobs table holds job runs and failures. You can create an alert rule from a KQL query and use an action group to define who is notified. Diagnostic logs require the Azure Databricks Premium plan.

A is incorrect: The system.access.audit table is recommended for querying audit logs within Azure Databricks. Log streaming is the preferred approach for cross-service centralized monitoring and KQL-based alerting. Separate queries per workspace also do not give one place for the data.

B is incorrect: DatabricksClusters records cluster events such as creation, termination, and resizing. It does not record job failures.

D is incorrect: The Spark UI shows execution details for a single cluster. It does not centralize events across workspaces and does not send notifications.

B and C are correct.

Explanation: Transient failures such as network timeouts often resolve themselves, so a retry policy with a retry count and a retry interval lets the task run again after the system recovers. Task-level notifications fire on each retry attempt, so selecting Mute notifications until the last retry reduces alerts and still notifies the team if the final attempt fails.

A is incorrect: The All done dependency condition controls when a task runs relative to upstream tasks. It does not retry a failed task or reduce notifications.

D is incorrect: ON VIOLATION FAIL UPDATE applies to data quality expectations in Lakeflow pipelines and stops a flow when a record violates a constraint. It does not handle transient network timeouts or notification volume.

D is correct.

Explanation: Lakeflow pipelines fit standardized ETL patterns such as reading from cloud storage, schema evolution, and slowly changing dimensions. They provide expectations that track violations and can halt processing, and they provide lineage tracking and monitoring without additional configuration. They are also SQL-friendly, which lowers the barrier for the team.

A is incorrect: Notebooks require custom implementation for error handling and manual validation code. This adds code to write and maintain and does not give built-in expectations.

B is incorrect: Notebooks require external tooling for lineage tracking. Lineage tracking is automatic in Lakeflow pipelines.

C is incorrect: Cell-by-cell iteration is useful for prototyping and exploration. It is not a reason to choose notebooks for a repeatable production workload with standard patterns.

B is correct.

Explanation: Ingestion should preserve data with minimal transformation, which corresponds to the bronze layer. Cleaning operations such as schema enforcement and deduplication belong in a separate stage that corresponds to the silver layer. This separation keeps the raw data available for auditing and reprocessing, and it gives later transformations validated data to build on.

A is incorrect: Cleaning during ingestion and discarding the original records removes the raw state, so you cannot reprocess data or audit it later.

C is incorrect: Cleaning in the load stage lets quality issues propagate through ingestion and transformation first. Data quality issues should be caught early.

D is incorrect: The serving layer provides access patterns, performance, and access control for consumers. Using it to fix data quality problems leaves the underlying tables unvalidated.

A is correct.

Explanation: All done runs the task after all upstream tasks finish, regardless of outcome. This fits a cleanup task that must release temporary resources in every case.

B is incorrect: All succeeded runs the task only when every upstream task completes successfully. Cleanup would not run after a failure.

C is incorrect: At least one failed runs the task only when an upstream task fails. Cleanup would not run when all ingestion tasks succeed.

D is incorrect: None failed runs the task when no upstream task failed, even if some were skipped. Cleanup would not run after a failure.