Objective 4.2 Secure a Pipeline (includes Maintenance) AIP-210 Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A research institute runs an ML pipeline that ingests sensitive survey data from a partner organization via an SFTP drop, processes it in Azure Databricks, and stores the output in Azure Data Lake Storage Gen2. The partner uploads files that contain personally identifiable information (PII). The institute wants to minimize the risk of PII exposure to data scientists who only need aggregate statistics. What should the pipeline architect configure?

   • AApply Azure Storage Service Encryption to the Data Lake, use TLS for the SFTP-to-Azure transfer, and apply a data masking transformation in Databricks that removes PII columns before the data is made available to data scientists.
   • BStore the raw files in a public container and rely on the obscurity of the container name to protect the data.
   • CDisable the SFTP endpoint after the upload and have data scientists connect directly to the partner's database.
   • DUse a shared access signature (SAS) with write-only permissions for the partner and grant data scientists Storage Blob Data Reader on the same container.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A global pharmaceutical company's ML pipeline processes clinical trial data that is subject to both GDPR and HIPAA. The pipeline runs in Azure, and the compliance team requires that all data be encrypted at rest and in transit, that access be logged, and that data be stored only in approved regions. The ML team wants to use a multi-region deployment for disaster recovery. What is the most appropriate architecture?

   • AUse a secondary region that is not approved for data storage, but encrypt all data with a customer-managed key stored in the primary region.
   • BUse a primary region for storage and compute, and configure a secondary region for disaster recovery that also meets the approved-region requirement, with geo-replication for storage and cross-region logging.
   • CReplicate all data to a global region and rely on the cloud provider's compliance certifications for GDPR and HIPAA.
   • DUse a single region for all resources to simplify compliance, and accept the risk of no disaster recovery.
   Reveal Solution Discussion Select an answer first