Secure, Monitor, and Optimize Data Storage and Data Processing
Core concepts
Security in Azure analytics involves Azure Active Directory (AAD) authentication, role-based access control (RBAC), ACLs on ADLS Gen2, managed identities, and private endpoints. Understand column-level security, row-level security, and dynamic data masking in Synapse. For monitoring, know Azure Monitor, Log Analytics, Synapse Studio monitoring, and Databricks cluster metrics. Optimization includes file sizing (target 256 MB–1 GB per file), compaction, statistics, caching, and compute scaling.
Traps
Questions often test the difference between RBAC (coarse-grained, subscription/resource level) and ACLs (fine-grained, directory/file level). Another trap: managed identity vs service principal for authentication; managed identity avoids secret management. Also watch for dynamic data masking limitations (not enforced for users with UNMASK permission) and result-set caching vs persistent cache.
Worked example
A team needs to restrict access to a sensitive column for most users but allow analysts to see masked values. Implement dynamic data masking on the column and grant UNMASK only to privileged users. For directory-level control, use ADLS Gen2 ACLs with AAD groups.
Key rule
Apply defense in depth: network isolation (private endpoints), identity (managed identity), authorization (RBAC + ACLs), and data protection (masking, encryption). Monitor costs and performance with Azure Monitor and optimize file layout regularly.