View Full Microsoft DP-420 Exam Dumps and Practice Test Dumps.

Q1. Your application builds Azure Cosmos DB for NoSQL queries from user-supplied values. You want to reduce the risk of query injection and improve query-plan reuse. What should you use?

1. String concatenation to create the SQL statement.
2. A stored procedure for every read.
3. Parameterized queries.
4. A separate container for each user.

Correct Answer: 3. Parameterized queries.

Explanation: Parameterized queries allow application code to define the query text separately from the values supplied at runtime. This reduces the risk associated with directly concatenating untrusted user input into SQL statements and produces cleaner, more maintainable application code. Parameters are especially useful for filters where values such as customer IDs, status values, or dates vary between requests. A stored procedure is unnecessary for ordinary reads, and creating separate containers per user would introduce significant operational complexity. Parameterized queries should be combined with proper authorization and validation because parameterization addresses query construction, not the complete application security model.

Q2. An Azure-hosted application needs to access Azure Cosmos DB without storing account keys in configuration files. Which authentication approach should you prefer?

1. Microsoft Entra ID authentication with a managed identity.
2. Embed the primary account key in source code.
3. Store the account key in every container document.
4. Allow anonymous database access.

Correct Answer: 1. Microsoft Entra ID authentication with a managed identity.

Explanation: Microsoft Entra ID authentication with a managed identity avoids the need to distribute long-lived Cosmos DB account keys with the application. Azure-hosted services that support managed identities can obtain tokens and authenticate without developers manually managing application secrets. Appropriate Cosmos DB data-plane roles can then be assigned according to least-privilege principles. Embedding primary keys in code creates a serious secret-management risk, while storing keys in data documents is inappropriate. Anonymous access is not suitable for protected application data. Managed identities also simplify secret rotation because there is no application credential that developers must regularly replace.

Q3. You need an application identity to read items from one Cosmos DB account but not create, replace, or delete items. What should you configure?

1. Give the identity the account’s primary key.
2. Assign Azure subscription Owner.
3. Disable authentication for reads.
4. Assign an appropriate Cosmos DB data-plane read role.

Correct Answer: 4. Assign an appropriate Cosmos DB data-plane read role.

Explanation: Azure Cosmos DB supports role-based authorization for data-plane operations. A read-only role can grant an identity the ability to retrieve and query data without providing write capabilities. This follows the principle of least privilege and is preferable to distributing an account key, which can provide much broader access. Azure subscription Owner is also excessively privileged because it grants management capabilities far beyond reading Cosmos DB items. Authentication should not be disabled. Role assignments should be scoped as narrowly as practical to the account, database, or container resources required by the application.

Q4. Your security team requires all application traffic to Cosmos DB to remain on private Azure networking rather than using the public endpoint. What should you configure?

1. TTL.
2. A private endpoint through Azure Private Link.
3. A composite index.
4. Session consistency.

Correct Answer: 2. A private endpoint through Azure Private Link.

Explanation: Azure Private Link allows a Cosmos DB account to be accessed through a private endpoint in a virtual network. Traffic can remain on private Azure networking, and public network access can be restricted according to the organization’s security requirements. TTL controls data expiration, composite indexes optimize particular query patterns, and session consistency defines read guarantees. Private endpoints are especially useful for workloads subject to network-isolation or compliance requirements. DNS configuration must also be planned correctly so applications resolve the Cosmos DB endpoint to the appropriate private IP address within the virtual network environment.

Q5. You must temporarily grant an external process access to Cosmos DB, but you do not want to distribute the primary account key. Which principle should guide the solution?

1. Use the most limited supported identity and permissions for the required operation.
2. Publish the primary key in an environment variable shared by all applications.
3. Give the process subscription-level Contributor access.
4. Disable authorization during the process.

Correct Answer: 1. Use the most limited supported identity and permissions for the required operation.

Explanation: Temporary integrations should follow least-privilege access principles. When supported, Microsoft Entra identities and narrowly scoped Cosmos DB data-plane roles are preferable to distributing account keys. The identity should receive only the operations and scope required by the process and access should be removed when it is no longer needed. A subscription-wide Contributor role would grant unrelated management permissions, while disabling authorization is insecure. Even placing an account key in an environment variable still exposes a broad shared secret. Strong identity governance minimizes the effect of accidental credential exposure or misuse.

Q6. You are paginating a Cosmos DB query in a web API. A client requests the next page several minutes after receiving the first page. Which value should your API preserve and return to Cosmos DB?

1. The item’s ETag.
2. The account key.
3. The continuation token.
4. The TTL value.

Correct Answer: 3. The continuation token.

Explanation: Continuation tokens represent the query’s progress and allow subsequent requests to continue retrieving results from the appropriate point. An API can return the token to the caller or securely maintain it between requests, depending on the application design. ETags are used for optimistic concurrency on items and do not represent query position. Account credentials authenticate requests but do not provide pagination state. TTL controls item expiration. Continuation tokens are particularly valuable when results are too large to return at once and the client needs stateless or resumable paging across multiple requests.

Q7. Your application needs to efficiently retrieve 20 known items from the same container, and it already knows each item’s ID and partition key value. Which SDK pattern should you consider instead of issuing a SQL query?

1. Change feed processing.
2. A multi-item point-read capability such as ReadMany where supported.
3. A stored procedure that scans the container.
4. A cross-partition SELECT * query.

Correct Answer: 2. A multi-item point-read capability such as ReadMany where supported.

Explanation: When the IDs and partition-key values of required items are already known, using point-oriented APIs can be more efficient than constructing a general SQL query. SDK capabilities such as ReadMany can retrieve multiple known items while preserving efficient routing behavior. A cross-partition query may consume more request units because query processing and indexing are involved. Change feed processing is for reacting to changes, and a scanning stored procedure is inappropriate. Application data models should make IDs and partition-key values readily available for common lookups so efficient point operations can be used whenever possible.

Q8. You need to distribute change feed processing manually across custom worker processes and want each worker to read a specific feed range without using the change feed processor library. Which change feed model should you consider?

1. Integrated cache mode.
2. Stored procedure mode.
3. TTL mode.
4. Pull model.

Correct Answer: 4. Pull model.

Explanation: The change feed pull model gives an application explicit control over reading change feed pages and managing feed ranges. This can be useful for specialized processing frameworks that need custom scheduling, checkpointing, or partition distribution rather than the automatic lease management offered by the change feed processor. The processor library is usually simpler for standard scalable consumers because it handles load balancing and progress tracking. Integrated cache concerns reads, stored procedures run transactional server-side logic, and TTL manages expiration. The pull model should be chosen when its extra control justifies additional application complexity.

Q9. You need to move all existing data from one container to another while also capturing subsequent changes so the destination can become current. Which migration concern is most important?

1. Only changing the account consistency level.
2. Disabling the source partition key.
3. Combining an initial copy with ongoing change capture until cutover.
4. Setting TTL on every source item.

Correct Answer: 3. Combining an initial copy with ongoing change capture until cutover.

Explanation: Online migrations commonly require two phases: copying the existing data and then processing changes that occur while the copy is running. Without ongoing change capture, the destination can become stale before the application is switched over. The Cosmos DB change feed can support synchronization patterns after the initial data transfer. The migration design must also account for partition-key changes, idempotency, validation, throughput, and final cutover. Consistency level and TTL do not replace change synchronization, and a source partition key cannot simply be disabled to simplify migration.

Q10. You need to determine whether a Cosmos DB SQL query is expensive because it returns many documents or because its filtering is inefficient. Which information should you inspect?

1. Query metrics, request charge, and retrieved versus output document counts.
2. Only the Azure subscription name.
3. Only the database creation date.
4. The current backup retention period.

Correct Answer: 1. Query metrics, request charge, and retrieved versus output document counts.

Explanation: Query metrics can help determine how much work Cosmos DB performed relative to the results returned. If a query retrieves or examines many documents but outputs only a few, its predicates, partition routing, or indexing strategy may need optimization. Request charge shows the RU cost of execution and provides a practical basis for comparing alternative query designs. Subscription metadata and backup retention are unrelated to query efficiency. Effective optimization should also consider whether the partition key is included, whether suitable indexes exist, and whether a point operation could replace the query entirely.

Q11. Your team changes an indexing policy on a large production container. What should you expect while the new indexing policy is applied?

1. All container data is permanently deleted.
2. The partition key automatically changes.
3. The account switches to serverless mode.
4. Azure Cosmos DB performs an index transformation in the background.

Correct Answer: 4. Azure Cosmos DB performs an index transformation in the background.

Explanation: When indexing policy changes require existing data to be reindexed, Cosmos DB performs an index transformation to bring the container’s index into the new configuration. Applications should monitor the transformation and verify query behavior before relying on the new index design. The data is not deleted and the partition key is not changed by an indexing policy update. Throughput mode also remains a separate configuration. Because unnecessary indexing increases write cost while insufficient indexing can harm query performance, production indexing changes should be validated using representative workloads and query metrics.

Q12. A frequently executed query uses equality filters on tenantId and type and a range filter on createdAt. Which optimization should you evaluate?

1. Disable all indexing.
2. An appropriate composite index matching the query pattern.
3. Replace the partition key with createdAt automatically.
4. Enable TTL on the results.

Correct Answer: 2. An appropriate composite index matching the query pattern.

Explanation: Composite indexes can improve certain query patterns that combine equality predicates with range conditions or multi-property ordering. The exact index path order and sort directions should match the important query pattern. Disabling indexing would make supported indexed querying less efficient or impossible for some scenarios. Changing a partition key requires data-model redesign and migration rather than an automatic index optimization. TTL affects item expiration, not query cost. Before adding an index, developers should examine query metrics and confirm that the query is important enough to justify additional index-maintenance overhead on writes.

Q13. Your application needs to prevent public network access to a Cosmos DB account while allowing connections only through selected virtual networks and private endpoints. What should you configure?

1. Network access controls on the Cosmos DB account.
2. A user-defined SQL function.
3. A continuation token.
4. A TTL policy.

Correct Answer: 1. Network access controls on the Cosmos DB account.

Explanation: Cosmos DB networking settings can restrict public access and permit connectivity only through approved network paths such as private endpoints or configured network rules. This helps reduce the attack surface and meet enterprise network-security requirements. SQL functions execute query logic, continuation tokens support paging, and TTL controls document lifecycle. Network controls should be combined with strong authentication and authorization because private networking alone does not define which identities are allowed to perform data operations. DNS and application routing should also be tested carefully when private endpoints are introduced.

Q14. You need to rotate Cosmos DB account keys with minimal application interruption. Which design makes this easier?

1. Hard-code one key permanently in the application binary.
2. Use both primary and secondary keys strategically during rotation, or preferably move to Microsoft Entra authentication.
3. Disable authentication before key rotation.
4. Store the primary key in every item.

Correct Answer: 2. Use both primary and secondary keys strategically during rotation, or preferably move to Microsoft Entra authentication.

Explanation: Cosmos DB provides primary and secondary keys so applications using key-based authentication can transition from one key to another while the unused key is regenerated. A well-planned rotation updates applications to one valid key, regenerates the other, then repeats as needed. Microsoft Entra ID authentication can further reduce reliance on long-lived account secrets. Hard-coding keys makes rotation difficult, while disabling authentication is insecure. Storing credentials in database items is also inappropriate. Regular credential rotation and centralized secret management reduce risk if a key is accidentally exposed.

Q15. An application should allow a support team to query data but should prevent them from modifying database account configuration. What access model should you implement?

1. Give support staff subscription Owner.
2. Share the Cosmos DB primary key with the entire team.
3. Separate data-plane permissions from management-plane permissions and grant only required access.
4. Disable all authorization.

Correct Answer: 3. Separate data-plane permissions from management-plane permissions and grant only required access.

Explanation: Cosmos DB administration and data access represent different permission scopes. A support user may need data-plane query rights without requiring the ability to change account networking, regions, throughput, or other management settings. Separating these responsibilities and assigning only the necessary roles follows least-privilege principles. Subscription Owner grants far more authority than required, while sharing account keys creates broad data-plane access that can be difficult to govern. Proper RBAC design helps organizations limit accidental changes and provides clearer auditing of management and data operations.

Q16. You operate Cosmos DB accounts across several subscriptions and need a centralized view of resource usage and health. Which approach should you use?

1. Manually open each document in Data Explorer every day.
2. Use Azure Monitor capabilities to aggregate and analyze metrics across resources.
3. Disable diagnostic logging.
4. Store monitoring values in the partition key.

Correct Answer: 2. Use Azure Monitor capabilities to aggregate and analyze metrics across resources.

Explanation: Azure Monitor provides centralized metrics, logs, workbooks, and alerting that can help operations teams monitor multiple Cosmos DB resources. Centralized visibility is preferable to manually opening each account because it enables consistent tracking of request rates, throttling, latency, availability, and other health signals. Diagnostic settings can route logs to destinations such as Log Analytics for cross-resource analysis. Disabling logs makes troubleshooting harder, and partition keys are part of data distribution rather than monitoring architecture. Operational dashboards should focus on service objectives and actionable indicators.

Q17. An Azure Cosmos DB application requires resilience if one read region becomes unavailable. The SDK has several preferred regions configured. What behavior should you expect?

1. The SDK can route reads to another available preferred region.
2. All data is immediately deleted.
3. The account automatically changes its partition key.
4. TTL is disabled.

Correct Answer: 1. The SDK can route reads to another available preferred region.

Explanation: In a globally distributed account with multiple readable regions, the SDK can use its configured preferred-region list and fail over to another available region when necessary. This supports application availability and can also reduce latency by prioritizing nearby regions. Regional resilience depends on the Cosmos DB account configuration, consistency level, application deployment, and SDK settings. An unavailable region does not change partition keys, TTL settings, or delete data. Region failover behavior should be tested so application teams understand what happens during planned and unplanned outages.

Q18. A multi-region application requires a guarantee that reads lag writes by no more than a specified number of versions or time interval. Which consistency level is designed for this requirement?

1. Eventual.
2. Bounded staleness.
3. Consistent prefix.
4. Session.

Correct Answer: 2. Bounded staleness.

Explanation: Bounded staleness guarantees that reads can lag behind writes only within a configured bound expressed in versions or time. It provides stronger guarantees than eventual or consistent-prefix consistency while allowing more flexibility than strong consistency. Session consistency focuses on read-your-writes and ordering within a session rather than a global bounded lag. Bounded staleness is appropriate when an application can tolerate limited staleness but must ensure replicas never fall behind beyond a defined threshold. As with all consistency choices, latency, availability, and throughput tradeoffs should be evaluated.

Q19. You need a query to search for documents where a string contains a particular substring. Which Cosmos DB SQL feature should you use?

1. A string function such as CONTAINS.
2. A manual failover.
3. Transactional Batch.
4. Periodic backup.

Correct Answer: 1. A string function such as CONTAINS.

Explanation: Cosmos DB for NoSQL SQL provides built-in string functions that can evaluate text properties. CONTAINS can determine whether a string includes a specified substring and can be used in query predicates or projections where appropriate. Manual failover changes regional roles, Transactional Batch groups atomic operations, and backup configuration is unrelated to text matching. Query cost should still be measured because string searches across large datasets can be expensive depending on selectivity, indexing, and partition routing. Specialized full-text search requirements may justify a dedicated search capability.

Q20. You need to inspect detailed Cosmos DB request logs alongside application logs using Kusto queries. What should you configure?

1. TTL and unique keys.
2. Integrated cache only.
3. Azure Monitor diagnostic settings that send resource logs to Log Analytics.
4. A stored procedure.

Correct Answer: 3. Azure Monitor diagnostic settings that send resource logs to Log Analytics.

Explanation: Azure Monitor diagnostic settings can route Cosmos DB resource logs to a Log Analytics workspace. There, Kusto Query Language can be used to investigate request behavior and correlate database activity with logs from applications or other Azure services. This supports troubleshooting, auditing, security investigations, and operational analysis. TTL, integrated cache, and stored procedures serve unrelated purposes. Centralized logs are most valuable when they are retained according to organizational needs and combined with useful application context such as correlation IDs, timestamps, status codes, and affected resources.