DP-203 key terms

Azure Blob Storage with a hierarchical namespace enabled, giving file-system semantics and directory-level access control. It is the usual landing zone for big-data workloads in Azure and supports POSIX-style ACLs alongside role-based access.

A storage account setting that organizes blobs into real directories rather than a flat key space. It enables atomic directory renames and cheaper directory-scoped operations, which improves performance for analytics engines that list and move many files.

A permission model granting read, write, and execute rights to specific users, groups, or the owning user and group on a file or directory. Access ACLs govern the object itself; default ACLs are inherited by newly created children.

Authorization by assigning built-in or custom role definitions to security principals at a scope such as subscription, resource group, storage account, or container. Effective permissions are the union of assignments, and management-plane and data-plane roles are distinct.

An automatically managed identity in Microsoft Entra ID that a compute resource uses to obtain tokens without storing credentials. System-assigned identities share the resource lifetime; user-assigned identities are standalone resources shareable across services.

A non-human identity registered in Microsoft Entra ID with credentials such as a client secret or certificate, used by applications and automation. It receives role assignments like a user and is often created automatically by resource deployments.

A signed URL granting time-limited, scoped access to storage resources without exposing account keys. It can be a service, account, or user delegation SAS; the user delegation type is secured by Microsoft Entra credentials rather than the account key.

A named policy defined on a container, queue, table, or file share that groups start time, expiry, and permissions. A service SAS references the policy, so permissions can be revoked or changed without reissuing the signature.

A cloud service for storing secrets, keys, and certificates with access controlled by Microsoft Entra ID and optional hardware security modules. Data services can reference vault secrets so credentials never appear in code or configuration files.

An encryption key you create and control in Key Vault or Managed HSM, used to encrypt the account-level key that protects data at rest. It enables key rotation and revocation, and it requires a managed identity with wrap and unwrap permissions.

A SQL feature where client drivers encrypt sensitive columns so the database engine never sees plaintext. Deterministic encryption permits equality comparisons and joins; randomized encryption is more secure but blocks those operations unless using secure enclaves.

A policy that rewrites query results to hide sensitive column values from users lacking the UNMASK permission. It masks only the presentation layer; the underlying data stays intact and can still be exposed through other query paths.

A predicate-based filter, typically implemented with an inline table-valued function and a security policy, that restricts which rows a user can read or modify. It applies at the database engine, so every query path is filtered.

An analytics platform combining dedicated SQL pools, serverless SQL, Spark pools, pipelines, and a shared workspace. Dedicated pools store data in a proprietary columnar format, while serverless and Spark query files directly in the lake.

A provisioned Synapse component with reserved compute units called DWUs that stores tables in a distributed, columnar format. Performance tuning centers on distribution choice, partitioning, statistics, and minimizing data movement across nodes.

A query service that reads files in the lake on demand and bills per terabyte scanned, requiring no provisioned capacity. It supports external tables, views, and OPENROWSET over Parquet, CSV, and JSON, making it useful for exploration.

A managed Synapse or Azure Databricks cluster of driver and worker nodes running Spark. Jobs read and write lake files, and autoscaling plus automatic pause reduce cost when clusters are idle.

The assignment of table rows to Synapse compute nodes: hash on a chosen column, round-robin, or replicated to every node. Choosing well colocates joins and aggregations, while poor choices cause costly shuffles called data movement.

The shuffle of rows between Synapse compute nodes during a query, occurring when joined or aggregated tables are not distributed compatibly. It is the dominant cost in poorly designed dedicated pool queries and is visible in the execution plan.

A dedicated SQL pool feature that stores completed query results in the database so identical queries return instantly without re-executing. It is enabled by default, invalidated when underlying table data changes, and can be disabled per session.

A persisted precomputed result set that the engine maintains as base tables change. In dedicated SQL pools it requires a clustered columnstore index and improves repeated aggregations over large fact tables.

A storage format that groups column values into compressed segments and is the default for dedicated SQL pool tables. It delivers high compression and fast large scans but suits batch loads better than single-row updates.

An optimizer technique that skips reading file or table partitions whose key values cannot satisfy the query filter. It depends on predicates referencing the partition column directly and on consistent folder or partition layout.

Splitting a large table or file set into smaller segments by a key such as date, so queries touch only relevant segments and maintenance acts on subsets. Over-partitioning creates small files that hurt scan throughput.

A condition where many tiny files force the engine to open and list each one, dominating query time and metadata overhead. Compaction, larger write batches, and periodic OPTIMIZE or rewrite operations mitigate it.

An open table format layering a transaction log over Parquet files, providing ACID transactions, schema enforcement, time travel, and upserts. It supports batch and streaming reads and writes on the same table.

A Delta Lake capability to query a table as of a version number or timestamp by reading earlier transaction log entries. It supports auditing, reproducing reports, and recovering from bad writes, bounded by log and file retention.

An operation that inserts new rows and updates existing ones in a single statement, matched on a key. In Delta Lake it is performed with MERGE, and in relational databases with MERGE or vendor-specific syntax.

A modeling pattern for tracking attribute history in dimension tables. Type 1 overwrites values, Type 2 adds new rows with validity dates and a current flag, and Type 3 keeps limited prior values in extra columns.

A dimensional model with a central fact table of measures and foreign keys surrounded by denormalized dimension tables. It minimizes joins and is the preferred layout for analytical engines and columnstore storage.

A table whose metadata points to files in a data lake rather than storing rows in the database. Queries read the underlying files, so the table must be refreshed or recreated when new files arrive.

A T-SQL function that reads files directly by path in serverless SQL pools, inferring or declaring the schema. It is used for ad hoc exploration and for building views over lake data.

A Synapse and SQL Server technology for querying external data and loading it through T-SQL, using external data sources, file formats, and tables. It supports parallel loads from the lake into dedicated pools.

A T-SQL bulk load command in Synapse dedicated pools that reads files from storage with high throughput and flexible options. It is the recommended replacement for PolyBase loading and supports Parquet, ORC, and delimited text.

A cloud orchestration service with pipelines, activities, linked services, and datasets for moving and transforming data. Mapping data flows provide visual Spark-based transformation, and triggers schedule or event-start runs.

The compute infrastructure Data Factory uses to execute activities. Azure, self-hosted, and Azure-SSIS variants differ in network reach; the self-hosted type runs on your machines to reach private networks.

A Data Factory transformation executed on managed Spark clusters, defined visually as sources, transformations, and sinks. It supports schema drift, parameterization, and partitioning hints for large-scale transformations.

A Data Factory trigger for recurring runs over fixed, non-overlapping, contiguous time windows with a specified start time. It retains state per window and supports backfill and dependency on other tumbling window triggers.

A Data Factory trigger that starts a pipeline in response to a storage event such as blob creation, using Event Grid. It suits arrival-driven ingestion but does not guarantee ordering or exactly-once delivery.

A Spark API treating a live data source as an unbounded table, with checkpoints for fault tolerance and output modes for incremental results. It supports exactly-once sinks and watermarking for late data.

A threshold in stream processing declaring how late data may arrive, letting the engine drop older events and bound state. It enables correct results for windowed aggregations without unbounded memory growth.

A feature that automatically writes Event Hubs streams to storage in Avro format, partitioned by time and throughput unit. It provides a cheap archival path without custom consumer code.

A Synapse or Data Factory feature that isolates compute in a Microsoft-managed network with private endpoints. It prevents data exfiltration and lets workspaces reach secured sources without exposing public access.

A network interface in your subnet that connects privately to a PaaS resource, removing public internet exposure. Combined with public network access disabled, it forces traffic through your virtual network and DNS configuration.

A platform collecting metrics, activity logs, and resource logs for Azure services, with alerting and dashboards. Diagnostic settings route logs to Log Analytics, storage, or event hubs for querying and retention.

A workspace storing structured logs queried with Kusto Query Language. It is the destination for diagnostic settings and the basis for workbooks, alerts, and long-term operational analysis.

A condition evaluated against metrics or log query results that fires an action group such as email, webhook, or automation runbook. Severity, frequency, and evaluation window control sensitivity and noise.

A system view exposing server and query state, such as current requests, waits, and index usage. In Synapse dedicated pools the equivalents reveal data movement, tempdb usage, and skew across distributions.

An uneven distribution of rows or work across partitions or nodes, leaving some busy and others idle. It lengthens query tails and is detected by comparing per-distribution row counts or task durations.

A computation grouping streaming events into time windows, such as tumbling, hopping, or sliding, before aggregating. Window choice determines result latency and how late-arriving events are handled.