Maintain an Azure Cosmos DB solution — DP-420 Practice Quiz

Question 1

A healthcare application stores patient records in Azure Cosmos DB for NoSQL. Compliance requires that the 'nationalId' property be encrypted client-side so that plaintext is never visible to the database engine. Developers must still be able to run queries that filter documents using an exact-match equality predicate on 'nationalId'. When configuring Always Encrypted for this property, which encryption type must you select?

Accepted Answer

Deterministic encryption

Answer

Randomized encryption

Answer

Service-managed key encryption at rest

Answer

Transparent Data Encryption (TDE) with a customer-managed key

Question 2

You operate a production Azure Cosmos DB for NoSQL account with a single container using autoscale throughput. Users intermittently report HTTP 429 errors during peak hours. You want to be proactively notified the moment the underlying cause—a physical partition consistently approaching its throughput ceiling—begins to occur, before users experience widespread throttling. Which Azure Monitor metric should you build the alert rule on to detect this specific condition?

Accepted Answer

Normalized RU Consumption, alerting when it approaches 100%

Answer

Total Request Units, alerting when the sum exceeds the provisioned maximum

Answer

Server Side Latency, alerting when average latency exceeds 10 ms

Answer

Total Requests, alerting when the count of 200 status codes drops

Question 3

A security team wants operations engineers to be able to create and modify Azure Cosmos DB accounts, adjust throughput settings, and manage failover priorities through the Azure portal and ARM, but they must be prevented from reading or writing any document data inside containers. Which approach satisfies these requirements with the least privilege?

Accepted Answer

Assign the engineers a control-plane Azure RBAC role such as Cosmos DB Operator, and do not grant any Cosmos DB data-plane role assignments.

Answer

Assign the engineers the Cosmos DB Built-in Data Contributor data-plane role scoped to the account.

Answer

Distribute the account's primary read-write key to the engineers so they can manage the account.

Answer

Assign the engineers the Owner role on the resource group containing the Cosmos DB account.

Question 4

Your company uses customer-managed keys (CMK) stored in Azure Key Vault to encrypt an Azure Cosmos DB account. During a security incident review, an administrator accidentally revokes the key permissions granted to the Cosmos DB account's managed identity in the Key Vault access policy. What is the immediate impact on the Cosmos DB account, and what is the correct remediation?

Accepted Answer

The account becomes unavailable for data operations, and you must restore access by re-granting the Get, Unwrap Key, and Wrap Key permissions to the account's managed identity in Key Vault.

Answer

The account continues to function normally because Cosmos DB caches the encryption key indefinitely; no action is required.

Answer

The account is permanently corrupted and must be deleted and recreated from a periodic backup.

Answer

Only write operations fail while reads continue, and you must rotate to a new customer-managed key to restore write access.

Question 5

Your company's compliance team requires that all encryption keys for an Azure Cosmos DB account be managed and rotated by your organization rather than by Microsoft. You plan to configure the account to use customer-managed keys (CMK) stored in Azure Key Vault. Which combination of settings is REQUIRED on the Key Vault so that Cosmos DB can use the key and so that accidental deletion does not permanently lock you out of your data?

Accepted Answer

Enable soft delete and purge protection on the Key Vault, and grant the Cosmos DB identity Get, Unwrap Key, and Wrap Key permissions.

Answer

Enable only soft delete on the Key Vault, and grant the Cosmos DB identity full administrator access to all keys, secrets, and certificates.

Answer

Disable soft delete but enable purge protection, and grant the Cosmos DB identity Sign and Verify permissions on the key.

Answer

Enable purge protection only, and grant the Cosmos DB identity Decrypt and Encrypt permissions at the secret scope.

Question 6

A financial services company requires that all access to a Cosmos DB for NoSQL account be auditable and that primary/secondary account keys never be used by applications reading and writing documents. Developers must authenticate using Microsoft Entra ID identities, and each application's ability to read or write items must be governed by role assignments. Which approach satisfies these requirements for data-plane operations?

Accepted Answer

Assign the built-in 'Cosmos DB Built-in Data Contributor' role to the application's Entra ID identity using the Cosmos DB native RBAC data-plane role definitions.

Answer

Assign the Azure control-plane role 'DocumentDB Account Contributor' to the application identity so it can read and write items.

Answer

Store the primary key in Azure Key Vault and grant the application a Key Vault access policy so it can retrieve the key at runtime.

Answer

Enable customer-managed keys (CMK) with Key Vault so all item reads and writes are authorized through Entra ID.

Question 7

A developer reports that an application writing to an Azure Cosmos DB for NoSQL container intermittently fails. Inspecting the SDK diagnostics, you notice the failed requests return HTTP status code 503 (Service Unavailable), not 429. The container uses autoscale throughput and the Normalized RU Consumption metric peaks at only 62%. What is the MOST likely cause of these failures, and the appropriate action?

Accepted Answer

Transient connectivity or service-side unavailability is occurring; ensure the SDK's built-in retry policy is enabled and implement retry logic for 503 responses.

Answer

The account is exceeding provisioned RU/s; increase the maximum autoscale throughput to eliminate the errors.

Answer

The partition key is causing a hot partition; redesign the partition key to distribute writes more evenly.

Answer

The requests violate the consistency level; lower the consistency from Strong to Session to allow the writes to succeed.

Question 8

Your team needs to investigate individual data-plane requests against an Azure Cosmos DB for NoSQL account — including the RU charge, status code, partition key range, and request duration for each operation over the past week. Metrics in Azure Monitor only show aggregated values and are insufficient for this per-request analysis. What must you configure to enable this level of investigation?

Accepted Answer

Create diagnostic settings on the Cosmos DB account to send the DataPlaneRequests log category to a Log Analytics workspace, then query it with KQL.

Answer

Enable the Azure Cosmos DB integrated cache on a dedicated gateway to capture per-request telemetry.

Answer

Increase the metrics retention period in Azure Monitor Metrics to 30 days and filter by the RequestCharge dimension.

Answer

Turn on continuous backup mode so that point-in-time request history is retained for auditing.

Question 9

Your operations team must retain Azure Cosmos DB data-plane request logs for seven years to satisfy a compliance audit, while also sending a 90-day copy to a Log Analytics workspace for interactive KQL queries. Costs must be minimized for the long-term retention copy, which is queried only rarely. Which configuration should you implement?

Accepted Answer

Create one diagnostic setting that sends DataPlaneRequests to a Log Analytics workspace and, in the same setting, also archives the logs to an Azure Storage account for long-term retention.

Answer

Create a single diagnostic setting that streams DataPlaneRequests to Log Analytics only, then rely on the workspace's data retention policy set to 2555 days.

Answer

Enable continuous backup on the account and use point-in-time restore to recover the request logs when the auditor requests them.

Answer

Query the Normalized RU Consumption metric in Azure Monitor Metrics and export the chart to CSV every 90 days for archival.

Question 10

A development team runs an ASP.NET Core web app on Azure App Service that connects to Azure Cosmos DB. Security auditors flag that the account's primary key is stored in an App Service application setting. The team must remove all shared keys from configuration and authenticate using Microsoft Entra ID, while granting the app only the ability to read and write items in a single container (no control-plane management rights). What should the team implement?

Accepted Answer

Assign a system-assigned managed identity to the App Service, then use the Cosmos DB data plane RBAC to assign a built-in or custom role scoped to the container, and connect the SDK with TokenCredential.

Answer

Assign the built-in Azure RBAC 'Cosmos DB Account Reader' control-plane role to the App Service managed identity and connect using DefaultAzureCredential.

Answer

Rotate to the secondary key and store it in Azure Key Vault, referencing it from App Service configuration with a Key Vault reference.

Answer

Enable Always Encrypted with a customer-managed key so the SDK no longer needs the account key to read data.

Question 11

Your company runs an on-premises order processing system that publishes messages to Apache Kafka. You need to continuously ingest these Kafka messages into an Azure Cosmos DB for NoSQL container, and separately stream all document changes from a different Cosmos DB container back out to a downstream Kafka topic for analytics. You want to use the official Cosmos DB Kafka connectors with minimal custom code. Which configuration should you deploy?

Accepted Answer

Use the Cosmos DB sink connector to ingest Kafka messages into the container, and the Cosmos DB source connector (which reads the change feed) to publish document changes to the downstream Kafka topic.

Answer

Use the Cosmos DB source connector to ingest Kafka messages into the container, and the Cosmos DB sink connector to publish document changes to the downstream Kafka topic.

Answer

Use the Cosmos DB sink connector for both directions, configuring one instance to read and one to write.

Answer

Use Azure Data Factory copy activities in both directions since the Kafka connectors only support one-way movement from Cosmos DB to Kafka.

Question 12

A retail company runs a production Azure Cosmos DB for NoSQL account currently configured with periodic backup mode. After a recent incident where an operator accidentally deleted several containers, the compliance team requires the ability to perform self-service point-in-time restore to any second within the last 7 days. The database team wants to enable this capability on the existing account with minimal disruption and no data migration. What should they do?

Accepted Answer

Switch the existing account's backup policy from periodic to continuous (7-day tier) mode, which is a supported one-way migration performed in place.

Answer

Open a support ticket to request an additional periodic backup copy, since periodic backups already allow point-in-time restore to any second.

Answer

Create a new account with continuous backup mode and use Azure Data Factory to copy all data, because backup mode cannot be changed after account creation.

Answer

Increase the periodic backup interval frequency to every second so any point in time within 7 days can be restored.

Question 13

A financial services company runs an Azure Cosmos DB for NoSQL account that must only be reachable from resources inside a specific Azure virtual network. Corporate security policy requires that no traffic ever traverses the public internet, and the account must not be resolvable or reachable via its public endpoint at all. Application servers reside in a subnet within that virtual network. Which configuration meets these requirements?

Accepted Answer

Create a Private Endpoint for the account in the virtual network and set public network access to Disabled.

Answer

Add the virtual network subnet to the account's IP firewall allow-list and leave public network access enabled.

Answer

Enable a service endpoint for Microsoft.AzureCosmosDB on the subnet and keep the default public network access setting.

Answer

Configure customer-managed keys in Azure Key Vault and restrict Key Vault access to the virtual network.

Question 14

Your team runs a production Azure Cosmos DB for NoSQL container provisioned with autoscale at a maximum of 10,000 RU/s. Users report intermittent HTTP 429 responses during peak hours, yet the total RU/s consumed across the account stays well below the 10,000 RU/s ceiling in Azure Monitor. Which metric should you examine first to confirm the most likely root cause of the throttling?

Accepted Answer

Normalized RU Consumption, to detect whether a single physical partition is hitting its per-partition throughput limit

Answer

Server-Side Latency, to determine whether slow query execution is causing the 429 responses

Answer

Data Usage, to confirm whether the container has exceeded its storage quota

Answer

Total Request Units, averaged over the full account, to verify overall provisioning is adequate

Question 15

A retail company reports that point-read latency for their Azure Cosmos DB for NoSQL container has increased. The application team confirms Normalized RU Consumption is consistently below 40% and there is no throttling (429s). You open Azure Monitor Metrics to isolate whether the delay originates inside Cosmos DB itself versus the network or client. Which metric should you examine to determine the latency contributed by the Cosmos DB service processing the request?

Accepted Answer

Server Side Latency

Answer

Normalized RU Consumption

Answer

Total Request Units

Answer

Data Usage

Question 16

A data engineering team uses Azure Databricks with the Azure Cosmos DB Spark 3 connector to load a large historical dataset into a provisioned throughput container that is also serving a production read workload. During the initial bulk write job, the operations team observes that production queries experience elevated latency and 429 (rate limited) responses. The team wants the Spark job to consume only a bounded fraction of the container's provisioned RU/s while still completing, without permanently increasing the container's throughput. Which configuration should they apply to the Spark write?

Accepted Answer

Set spark.cosmos.throughputControl.enabled to true with a targetThroughputThreshold value (e.g., 0.3) and a shared throughput control container

Answer

Set spark.cosmos.write.strategy to ItemOverwrite so writes are idempotent and retried less frequently

Answer

Increase spark.cosmos.write.bulk.enabled to true to batch operations and reduce total RU consumption

Answer

Reduce the number of Spark executor cores so fewer parallel requests are issued to Cosmos DB

More DP-420 practice