View Full Microsoft DP-420 Exam Dumps and Practice Test Dumps.

Q1. Your organization requires Azure Cosmos DB data to be encrypted with a key that the security team controls and manages in Azure Key Vault. Which feature should you configure?

1. Session consistency
2. Integrated cache
3. Customer-managed keys
4. TTL

Correct Answer: 3. Customer-managed keys

Explanation: Customer-managed keys allow an organization to control the encryption key used to protect Azure Cosmos DB data at rest. The key is typically stored and managed in Azure Key Vault, allowing security teams to control key lifecycle, permissions, and rotation policies. Azure Cosmos DB already encrypts data at rest using platform-managed keys by default, but customer-managed keys provide additional control for organizations with specific compliance requirements. Session consistency affects read behavior, integrated cache improves eligible read performance, and TTL controls document expiration. Encryption-key strategy should be planned together with identity, Key Vault permissions, and operational recovery procedures.

Q2. You want sensitive properties inside JSON documents to remain encrypted even from database administrators who can access the Cosmos DB account. Which capability should you consider?

1. Always Encrypted
2. Composite indexing
3. Change feed
4. Multi-region writes

Correct Answer: 1. Always Encrypted

Explanation: Always Encrypted is designed to protect sensitive application data by encrypting selected properties on the client side before they are transmitted to Azure Cosmos DB. The database stores encrypted values and does not receive the plaintext encryption keys. This can help protect particularly sensitive fields even from users with broad database access. The application must manage encryption metadata and keys correctly, and query capabilities can be affected depending on the encryption configuration. Composite indexes optimize queries, change feed exposes data changes, and multi-region writes improve global write availability. Always Encrypted addresses field-level data confidentiality.

Q3. Your web application hosted on a different domain must call Azure Cosmos DB directly from browser-based code. What account setting should you evaluate?

1. Continuous backup
2. Analytical store
3. Automatic failover
4. Cross-origin resource sharing settings

Correct Answer: 4. Cross-origin resource sharing settings

Explanation: Cross-origin resource sharing, or CORS, controls whether browser-based applications from specified origins can access a resource from another domain. If a browser application must communicate directly with Azure Cosmos DB, the relevant CORS configuration must allow the approved origin. CORS is not a substitute for authentication or authorization, so secure credential and identity design is still required. Continuous backup supports recovery, analytical store supports analytics, and automatic failover manages regional resilience. Direct browser access to databases should also be carefully evaluated because exposing powerful credentials in client-side code can create serious security risks.

Q4. You need to allow an administrator to change Cosmos DB account throughput and networking settings but not read application documents. Which access model should you use?

1. Data-plane read permissions
2. Azure role-based access control for control-plane management
3. Session tokens
4. A unique key policy

Correct Answer: 2. Azure role-based access control for control-plane management

Explanation: Control-plane RBAC governs management operations on the Azure Cosmos DB resource, such as modifying throughput, networking, regions, or account configuration. These permissions are separate from data-plane permissions that allow applications or users to read and modify documents. Separating management and data access supports least privilege and reduces unnecessary exposure. Session tokens relate to consistency, while unique keys enforce data constraints. Administrators who need to manage the account should receive only the Azure management roles necessary for those tasks rather than broad data-plane credentials such as account keys.

Q5. You must move several terabytes of Cosmos DB data to another data platform using an orchestrated Azure pipeline with scheduled execution and transformations. Which service should you consider?

1. Azure Monitor
2. Azure Bastion
3. Integrated cache
4. Azure Data Factory or Azure Synapse pipelines

Correct Answer: 4. Azure Data Factory or Azure Synapse pipelines

Explanation: Azure Data Factory and Azure Synapse pipelines provide managed data-integration and orchestration capabilities suitable for scheduled data movement, transformation, and workflow coordination. They can be used to move data between Azure Cosmos DB and many other supported systems. This is often preferable to writing a custom migration application when the workload benefits from managed connectors, scheduling, monitoring, and pipeline control. Azure Monitor provides observability, Bastion provides secure virtual-machine access, and integrated cache improves reads. The correct movement strategy should consider data size, transformation needs, downtime tolerance, throughput, and destination capabilities.

Q6. You need to migrate a large amount of data between two Cosmos DB containers using application code. Each record can be moved independently. Which SDK capability is most appropriate?

1. Bulk operations
2. Strong consistency
3. Integrated cache
4. Stored procedure execution for every record

Correct Answer: 1. Bulk operations

Explanation: SDK bulk support is appropriate when an application must perform large numbers of independent create, replace, or delete operations efficiently. The SDK can schedule operations concurrently across partition keys and improve overall throughput during migrations or large ingestion jobs. Bulk execution does not provide atomicity across all operations, so it should be used when each item can succeed independently. Strong consistency affects read semantics, integrated cache optimizes reads, and a stored procedure is restricted to one logical partition and would add unnecessary complexity. Migration jobs should still monitor 429 responses and respect available RU capacity.

Q7. You need to stream events from Apache Kafka into Azure Cosmos DB continuously. Which integration should you consider?

1. Azure Monitor workbook
2. TTL
3. Azure Cosmos DB Kafka connector
4. Manual regional failover

Correct Answer: 3. Azure Cosmos DB Kafka connector

Explanation: The Azure Cosmos DB Kafka connector enables integration between Kafka-based event streams and Cosmos DB. It can be used in streaming architectures where Kafka producers and consumers need Cosmos DB as a source or destination. This avoids the need to build all ingestion logic manually and can fit naturally into existing Kafka ecosystems. Azure Monitor is used for observability, TTL controls item expiration, and failover changes regional roles. Streaming integrations should be designed around partitioning, event ordering, retries, idempotency, and throughput so that high-volume event ingestion does not create hot partitions or sustained throttling.

Q8. IoT Hub must route device telemetry directly to Azure Cosmos DB as a custom destination. Which integration should you configure?

1. Change feed estimator
2. Azure Cosmos DB as a custom endpoint for Azure IoT Hub
3. Integrated cache
4. Continuous backup

Correct Answer: 2. Azure Cosmos DB as a custom endpoint for Azure IoT Hub

Explanation: Azure IoT Hub can route device telemetry to supported endpoints, and Azure Cosmos DB can be configured as a custom endpoint for suitable scenarios. This allows device events to flow into Cosmos DB for operational storage and downstream processing. The target data model and partition key should be designed to avoid hot partitions as telemetry volume increases. The change feed estimator monitors change-processing lag, integrated cache improves repeated reads, and continuous backup provides recovery. IoT ingestion architectures should also consider retention, TTL, message volume, partition distribution, and whether additional stream processing is required.

Q9. You need to provision the same Azure Cosmos DB account configuration consistently across development, test, and production environments. Which approach is most appropriate?

1. Use Azure Resource Manager templates or another declarative infrastructure-as-code approach.
2. Configure every environment manually in the portal.
3. Store configuration values in application documents.
4. Use continuation tokens.

Correct Answer: 1. Use Azure Resource Manager templates or another declarative infrastructure-as-code approach.

Explanation: Declarative infrastructure-as-code allows Azure Cosmos DB resources and configuration to be defined in version-controlled templates and deployed consistently across environments. This reduces configuration drift and supports repeatable DevOps processes. Azure Resource Manager templates can define account properties and many related resource settings, allowing changes to be reviewed and automated. Manual portal configuration is harder to reproduce reliably, while application documents and continuation tokens do not provision Azure resources. Infrastructure code should be managed through source control and validated through deployment pipelines before production rollout.

Q10. You need to change an existing Cosmos DB workload from standard manual provisioned throughput to autoscale by using automation. Which tools should you consider?

1. TTL and change feed
2. Integrated cache and analytical store
3. Session tokens
4. Azure CLI or PowerShell

Correct Answer: 4. Azure CLI or PowerShell

Explanation: Azure CLI and PowerShell can automate management operations for Azure Cosmos DB, including supported throughput configuration changes such as moving between standard and autoscale throughput. This is useful in DevOps workflows where resource changes should be scripted, repeatable, and auditable rather than performed manually in the portal. TTL and change feed concern data lifecycle and event processing, while integrated cache and analytical store serve performance and analytics scenarios. Session tokens are part of consistency behavior. Automated management commands should be tested in nonproduction environments and incorporated into controlled deployment procedures.

Q11. You need to initiate a planned regional failover of a Cosmos DB account from an automated runbook. Which tools can perform this management operation?

1. Query continuation tokens
2. Azure CLI or PowerShell
3. Integrated cache
4. SQL UDFs

Correct Answer: 2. Azure CLI or PowerShell

Explanation: Azure CLI and PowerShell can automate supported Cosmos DB management tasks, including initiating regional failover for appropriate account configurations. This allows failover operations to be incorporated into runbooks, disaster-recovery tests, or controlled maintenance procedures. Continuation tokens manage query pagination, integrated cache serves eligible reads, and SQL UDFs provide custom query logic. Regional failover should be tested periodically because application behavior also depends on SDK preferred regions, consistency settings, DNS, networking, and deployment topology. Automation should include validation steps before and after the failover.

Q12. Your team wants indexing policies to be version controlled and deployed consistently with the rest of the Cosmos DB infrastructure. What should you do?

1. Configure indexes manually after each deployment.
2. Store index definitions in application items.
3. Maintain indexing policies in infrastructure-as-code templates.
4. Disable indexing in production.

Correct Answer: 3. Maintain indexing policies in infrastructure-as-code templates.

Explanation: Managing indexing policies through declarative infrastructure-as-code keeps production configuration version controlled, reviewable, and repeatable. Changes can be tested before deployment and promoted through environments alongside other infrastructure settings. Manual changes increase configuration drift and make troubleshooting harder because actual settings may differ from source-controlled expectations. Application items do not define container indexing policies. Disabling indexing indiscriminately can severely affect queries. Production indexing changes should also account for index transformation time, write overhead, and the query patterns that depend on the affected paths.

Q13. Your organization requires encryption keys for Cosmos DB to be stored under its own Key Vault control and rotated according to internal policy. Which design should you use?

1. Customer-managed keys backed by Azure Key Vault
2. A continuation token
3. Eventual consistency
4. Query metrics

Correct Answer: 1. Customer-managed keys backed by Azure Key Vault

Explanation: Customer-managed keys allow organizations to manage the key-encryption key used for Cosmos DB data encryption through Azure Key Vault. This can support compliance requirements that demand organizational control over key lifecycle and rotation. Proper Key Vault permissions and availability are essential because Cosmos DB must be able to access the configured key. Continuation tokens support query paging, consistency levels affect read behavior, and query metrics measure query execution. Key management should be included in disaster-recovery and operational procedures because accidentally removing or disabling the required key can affect data access.

Q14. You want account keys used by a legacy Cosmos DB application to be centrally stored and retrieved securely instead of being placed in configuration files. Which Azure service should you use?

1. Azure Event Hubs
2. Azure Monitor
3. Microsoft Fabric Warehouse
4. Azure Key Vault

Correct Answer: 4. Azure Key Vault

Explanation: Azure Key Vault provides centralized secure storage for secrets such as account keys, connection strings, certificates, and cryptographic keys. A legacy application that still relies on Cosmos DB account keys can retrieve them securely at runtime instead of embedding them in source code or plain configuration files. Where possible, Microsoft Entra authentication with managed identities may reduce the need for shared secrets altogether. Event Hubs provides event streaming, Azure Monitor provides observability, and Fabric Warehouse serves analytical workloads. Secret storage should be combined with access policies, rotation procedures, and audit monitoring.

Q15. A web application’s Cosmos DB account should reject all network traffic except requests from approved networks and private endpoints. Which control should you configure?

1. Network-level access controls.
2. A SQL UDF.
3. TTL.
4. Change feed leases.

Correct Answer: 1. Network-level access controls.

Explanation: Cosmos DB network-level access controls can restrict which network paths are allowed to reach the account. Organizations can use public network restrictions, firewall rules, virtual-network integration, and private endpoints as appropriate to their architecture. These controls reduce exposure but should be combined with identity-based authentication and authorization. SQL UDFs provide query logic, TTL controls expiration, and change feed leases coordinate processors. Network security must also consider DNS and routing, particularly when private endpoints are used, so that authorized applications resolve and connect through the intended private network path.

Q16. An application must query Cosmos DB using Microsoft Entra authentication rather than account keys. What should you configure?

1. Only CORS.
2. Microsoft Entra identity and appropriate Cosmos DB data-plane role assignments.
3. TTL on all containers.
4. A composite index.

Correct Answer: 2. Microsoft Entra identity and appropriate Cosmos DB data-plane role assignments.

Explanation: Microsoft Entra ID can authenticate application identities to Azure Cosmos DB, while data-plane role assignments authorize the operations those identities may perform. Managed identities are especially useful for Azure-hosted applications because they avoid storing application credentials. CORS addresses browser-origin policies, TTL controls expiration, and composite indexes optimize query patterns. Role assignments should follow least-privilege principles, granting only the databases, containers, and operations required by each application. Identity-based access also simplifies credential rotation compared with applications that depend on long-lived account keys.

Q17. You need to migrate a very large Cosmos DB dataset through a distributed Spark processing job that transforms documents during the move. Which integration is appropriate?

1. Azure Cosmos DB Spark connector.
2. Data alert.
3. Integrated cache.
4. Unique key policy only.

Correct Answer: 1. Azure Cosmos DB Spark connector.

Explanation: The Azure Cosmos DB Spark connector supports distributed reads and writes between Spark and the Cosmos DB transactional store. It is appropriate for large-scale transformation or migration scenarios where Spark processing is already part of the architecture. The connector can leverage Spark parallelism, but the migration must still respect partition-key design and available RU throughput. Data alerts are unrelated, integrated cache is for eligible reads, and unique keys enforce constraints. Migration jobs should also plan for retries, validation, cutover, and how ongoing production changes are synchronized during long-running moves.

Q18. You need to move a continuous stream of events through Azure Stream Analytics and persist the processed results to Cosmos DB. What architecture should you use?

1. Only periodic backup.
2. Azure Stream Analytics with Azure Cosmos DB as an output destination.
3. Manual failover.
4. A SQL UDF inside Cosmos DB for the entire streaming pipeline.

Correct Answer: 2. Azure Stream Analytics with Azure Cosmos DB as an output destination.

Explanation: Azure Stream Analytics is designed for real-time stream processing and can write processed results to supported destinations such as Azure Cosmos DB. This can be useful for telemetry, event enrichment, aggregation, and real-time operational applications. The target container should use a partition key that distributes incoming events appropriately. Backup and failover solve resilience concerns rather than streaming transformation. Cosmos DB UDFs operate within database queries and are not a replacement for a dedicated stream-processing engine. Streaming throughput should be coordinated with provisioned Cosmos DB RU capacity.

Q19. You need to distinguish between authorization to manage the Cosmos DB account and authorization to read and write documents. Which statement is correct?

1. Control-plane and data-plane access are separate permission models.
2. A control-plane role automatically grants unrestricted document access.
3. Data-plane roles automatically grant Azure subscription Owner.
4. There is no distinction between management and data access.

Correct Answer: 1. Control-plane and data-plane access are separate permission models.

Explanation: Cosmos DB distinguishes resource-management operations from data operations. Control-plane permissions govern actions such as configuring throughput, networking, account regions, or resource settings. Data-plane permissions govern reading, creating, updating, querying, and deleting application data. Separating the two allows organizations to implement least privilege and separation of duties. An infrastructure administrator may not require access to customer documents, while an application identity may need data access but no account-management permissions. Understanding this distinction is essential when designing Azure RBAC and Microsoft Entra authorization for Cosmos DB solutions.

Q20. You deploy a new indexing policy to production. What operational concern should you monitor after deployment?

1. Session-token size only.
2. Index transformation progress and query/write performance.
3. The Azure subscription display name.
4. TTL expiration only.

Correct Answer: 2. Index transformation progress and query/write performance.

Explanation: A significant indexing-policy change can trigger an index transformation over existing data. During and after the change, operators should monitor transformation progress, request-unit consumption, write overhead, and the performance of queries that depend on the affected indexes. A policy that improves one query can increase write cost, so production validation should use representative workload metrics. Session tokens and subscription names do not reveal index health, while TTL is a separate feature. Index policies should be treated as production configuration that requires testing, version control, staged deployment, and monitoring.