DP-201 Exam QuestionsBrowse all questions from this exam
Go to Exam

DP-201 Exam - Question 21

You need to recommend a storage solution to store flat files and columnar optimized files. The solution must meet the following requirements:

✑ Store standardized data that data scientists will explore in a curated folder.

✑ Ensure that applications cannot access the curated folder.

✑ Store staged data for import to applications in a raw folder.

✑ Provide data scientists with access to specific folders in the raw folder and all the content the curated folder.

Which storage solution should you recommend?

Show Answer
Correct Answer: C

Azure Data Lake Storage Gen2 is the appropriate solution because it supports a hierarchical namespace, which allows for folders and subfolders. This is crucial for organizing your raw and curated data as required. It also supports ACLs (Access Control Lists), which enable fine-grained access control at the folder and file level. This ensures that you can provide data scientists with access to specific folders while restricting application access to the curated folder, meeting all the specified requirements comprehensively.

Discussion

19 comments
Sign in to comment
Sam9999
Mar 22, 2020

Shouldn't answer be C, there is no concept of folders and folder permissions in Azure storage.

kempstonjoystick
Apr 1, 2020

I agree, Azure Data Lake Stroage includes ACLs which can be applied to folder structures, which Blob Storage does not. Therefore the security requirements mean the answer should be ADLS

MLCL
Apr 14, 2020

There is the notion of public anonymous access in blob storage as well as shared access signatures, and of course RBAC can be implemented through Azure AD for Blobs and Queues, so the security requirements can be met. Check this doc : https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-portal

Yuri1101
Apr 22, 2020

Agree, especially it is only required to handle standardized data. There is no need to use ADLS.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

lingjun
Nov 12, 2020

When an Azure role is assigned to an Azure AD security principal, Azure grants access to those resources for that security principal. Access can be scoped to the level of the subscription, the resource group, the storage account, or an individual container or queue. An Azure AD security principal may be a user, a group, an application service principal, or a managed identity for Azure resources. https://docs.microsoft.com/de-de/azure/storage/common/storage-auth-aad

Yuri1101
Apr 22, 2020

Agree, especially it is only required to handle standardized data. There is no need to use ADLS.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

lingjun
Nov 12, 2020

When an Azure role is assigned to an Azure AD security principal, Azure grants access to those resources for that security principal. Access can be scoped to the level of the subscription, the resource group, the storage account, or an individual container or queue. An Azure AD security principal may be a user, a group, an application service principal, or a managed identity for Azure resources. https://docs.microsoft.com/de-de/azure/storage/common/storage-auth-aad

MLCL
Apr 14, 2020

There is the notion of public anonymous access in blob storage as well as shared access signatures, and of course RBAC can be implemented through Azure AD for Blobs and Queues, so the security requirements can be met. Check this doc : https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-portal

Yuri1101
Apr 22, 2020

Agree, especially it is only required to handle standardized data. There is no need to use ADLS.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

lingjun
Nov 12, 2020

When an Azure role is assigned to an Azure AD security principal, Azure grants access to those resources for that security principal. Access can be scoped to the level of the subscription, the resource group, the storage account, or an individual container or queue. An Azure AD security principal may be a user, a group, an application service principal, or a managed identity for Azure resources. https://docs.microsoft.com/de-de/azure/storage/common/storage-auth-aad

Yuri1101
Apr 22, 2020

Agree, especially it is only required to handle standardized data. There is no need to use ADLS.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

However, strictly speaking, in BLOB storage, data not stored in folders, just the name of the blob will include the folder name. So if the requirement is to store in folder, it have to be ADLS

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

Leonido
Apr 23, 2020

Also, in blob, without RBAC you can only grant permission to the level of container.

lingjun
Nov 12, 2020

When an Azure role is assigned to an Azure AD security principal, Azure grants access to those resources for that security principal. Access can be scoped to the level of the subscription, the resource group, the storage account, or an individual container or queue. An Azure AD security principal may be a user, a group, an application service principal, or a managed identity for Azure resources. https://docs.microsoft.com/de-de/azure/storage/common/storage-auth-aad

Anonymous
Jun 19, 2021

there is, it is called container.

Marcus1612
Sep 23, 2021

RBAC Security on Azure Blob can be scoped at the container level or above. With two containers (one for raw data and one for curated data) without folders, it would be possible to manage the security. BUT the current use case states that: " datascientists need access to specifics folders in the "raw" folder. You cannot manage security at this level with Azure Blob. You have to use Azure Data Lake with RBAC/ACLs. The right answer is C

HeB
Apr 26, 2020

Answer should definitely be C, Azure Data Lake Storage Gen2.

Abhitm
May 28, 2020

It is ADLS

yilpiz
Aug 29, 2020

raw, curated folder, folder level access all characteristics of ADLS

Yaswant
Aug 8, 2020

Here we are talking about storage solutions and granting permissions to the solution. Data lake is mostly suited for analytical workloads and in blobs we have a concept of virtual folders and we can create access policies in storage explorer for blobs. So C is correct (Just an intution).

Yaswant
Aug 10, 2020

*B* is correct

monumentalcrankiness
Oct 11, 2020

The answer also mentions that the files are supposed to be explored by Data Scientists in curated folder. ADLS Gen 2 hooked up with Databricks or Azure Synapse Analytics is a ready-made solution for this kind of exploration.

M0e
Oct 23, 2020

The given answer is clearly incorrect. All the points that are mentioned in the questions are hints to use ADLS Gen 2.

Anonymous
Jun 19, 2021

The given answer is wrong and it should be C. The answer given states container is same as folder but it is not. A folder can have sub folders and access can be given only to sub folder. Where as in containers there are no sub containers hence the answer is wrong. Folder however can be given access in ADLS Gen2 using ACL so when we have a straight forward answer, why go with assumtion that 'container is same as folder'

monumentalcrankiness
Oct 11, 2020

I think correct answer should be ADLS Gen 2.

mohowzeh
Dec 28, 2020

A folder can be created in a blob (e.g. via button "Create folder" in the portal) but such a folder is virtual. Using Azure Storage Explorer (presently v1.17.0), one can verify that an SAS can be created on a blob container, but not on a folder within a blob. Still, multiple containers could be created where each container maps to one group of users in the security requirements. This is not forbidden in the question. If each container has one or more folders, all requirements would still be met, making answer B a "minimum viable answer". However, I agree that answer C is the best and most flexible. Using Azure Storage Explorer, one can easily verify that the option "Manage Access Control Lists" is available on an individual folder.

AyeshJr
Feb 6, 2021

I will choose Azure Datalake on the only fact that the question did ask for columnar optimized files and this is available in Datalake and not Azure storage account

rmk4ever
Apr 13, 2021

Columnar optimized file for Raw, enriched and curated structure with Folder level access Ans is ADLS ref: https://www.dremio.com/data-lake/adls/ https://medium.com/microsoftazure/building-your-data-lake-on-adls-gen2-3f196fc6b430

davita8
Apr 28, 2021

C. Azure Data Lake Storage Gen2

Bob123456
Aug 13, 2020

I believe there is actually only a single layer of containers. You can virtually create a "file-system" like layered storage, but in reality everything will be in 1 layer, the container in which it is. So Answer should be DATA LAKE

Deepu1987
Feb 19, 2021

The given answer is correct as when you check the below link https://docs.microsoft.com/en-us/azure/architecture/data-guide/technology-choices/data-storage it's clearly mentioned that ADLS can be used with certain restrictions it can be accessed via az synapse using poly base feature. There are certain performance tuning guidelines but in qn it's asked it need to be easily accessed by data scientistists as per the conditions we can go with blob storage

cadio30
May 21, 2021

The requirements leads to using ADLS gen 2 as it can manage the folder level using ACL

Arjun16
May 27, 2021

In Question they mentioned about flat files and columnar optimized files(Binary Files) and Containers are similar to folders, so Azure storage is Correct

cadio30
Jun 2, 2021

ADLS is the appropriate solution here as it has ACL function.

azurenav
Jun 5, 2021

Azure Data Lake Store Gen2 is a superset of Azure Blob storage capabilities. In the list below, some of the key differences between ADLS Gen2 and Blob storage are summarized. ADLS Gen2 supports ACL and POSIX permissions allowing for more granular access control compared to Blob storage. ADLS Gen2 introduces a hierarchical namespace. This is a true file system, unlike Blob Storage which has a flat namespace. This capability has a significant impact on performance, especially in big data analytics scenarios. ADLS Gen2 is an HDFS-compatible store. This means that Apache Hadoop services can use data stored in ADLS Gen2. Azure Blob storage is not Hadoop-compatible.