12 DP-420 Scenarios, Sorted by Difficulty

Correct Answer: B

Session consistency guarantees read-your-own-writes, monotonic reads and monotonic writes within a client session, and it is the default level for Azure Cosmos DB accounts. Session reads are served from a single replica (using the session token), so a read costs the same RUs as Eventual. Strong and Bounded Staleness both read from two replicas (a local minority quorum), which doubles the RU cost of every read; they deliver more guarantee than the scenario needs at twice the read cost. Eventual has the same single-replica read cost as Session but gives no read-your-own-writes guarantee, which the scenario explicitly requires.

Correct Answer: D

Time to live is a built-in Azure Cosmos DB feature: set a default TTL in seconds on the container (86,400 for 24 hours) and the service deletes items automatically, counting from each item's last-modified timestamp, with no delete issued by the client. Expired items stop appearing in query results immediately, and on provisioned throughput the background deletion uses leftover RUs. You can also override the default per item. A change feed processor reacts to inserts and updates; it is not an expiry mechanism, so you would still be writing and hosting your own delete logic. A timer-triggered Azure Function and a nightly SDK bulk-delete job both mean writing and running cleanup code, which the scenario rules out, and both also leave carts in place between runs.

Correct Answer: C

VectorDistance compares the stored embedding with the embedding of the new question, so ordering by it returns the turns closest in meaning, even when they share no exact words. This is the semantic-memory retrieval pattern Microsoft documents for agent memories, and filtering on threadId keeps the search inside one logical partition. Ordering by c.timestamp DESC returns the most recent turns, which suits rebuilding chat history but ranks by recency, not relevance. FullTextScore ranks by BM25 keyword relevance, so it matches shared terms rather than meaning, and it needs a full-text index on the property. ST_DISTANCE measures distance between GeoJSON geometries such as points and polygons; it is a geospatial function, not a vector-similarity function.

Correct Answer: A

A private endpoint gives the account a private IP address from the virtual network's address space, and setting publicNetworkAccess to Disabled blocks all public and virtual network traffic. That flag takes precedence over any IP or virtual network rule, so a firewall rule added later cannot reopen public access. A virtual network service endpoint restricts access to a subnet, but the account is still reached through its public IP addresses rather than a private one. An IP firewall rule for the virtual network's outbound public IP keeps the account on the public endpoint and does nothing to block future rules. Accepting connections from within public Azure datacenters allows requests from any Azure subscription, including other customers' resources, which widens access instead of restricting it.

Correct Answer: A

A synthetic key such as deviceId plus date is built by concatenating property values into one partitionKey property. Each device-day becomes its own logical partition, which keeps every logical partition well under the 20 GB limit and spreads writes across many partitions. Because the dominant query supplies both the device and the day, the query can still be routed to a single partition. deviceId by itself matches the query filter, but each device would exceed the 20 GB per-logical-partition limit during the retention period. The reading date by itself sends every device's writes for the day to the same logical partition, the hot-partition pattern Microsoft warns against for time-based keys. A date with a random suffix spreads writes well, but a query for one device has no way to know which of the 400 suffixes holds its readings, so it fans out across partitions.

Correct Answer: A

The Azure Functions trigger for Azure Cosmos DB reads the orders container's change feed, using a lease container to track progress, and runs your function for every insert and update. Using the change feed to denormalize data across containers is a documented change feed design pattern, and it keeps the order service fully decoupled (with eventual consistency for the summary). A stored procedure is registered on one container and its execution is scoped to a single logical partition key, so it cannot write into a different container. Having the order-writing service also write the summary couples the two directly in application code, which the scenario rules out. A daily scheduled batch job leaves summaries up to a day out of date, which fails the requirement to stay current whenever an order changes.

Correct Answer: B

The default indexing policy indexes every property of every item. Excluding a path in a custom indexing policy stops that subtree from being indexed, and Microsoft documents that reducing the number of indexed paths substantially lowers the latency and RU charge of writes, while every other property stays indexed and queryable. Moving internalNotes into a separate container is a data-model change with a much larger blast radius than editing the indexing policy. Lazy indexing updates the index at low priority, which can return inconsistent or incomplete query results, and new containers cannot select it. Reducing provisioned throughput does not lower the RU cost of a write; it lowers the RUs available per second, which leads to throttling.

Correct Answer: D

Continuous backup mode lets you restore to any point in time within the configured retention tier (7, 30, or 35 days) through self-service restore in the portal, PowerShell, or CLI, which satisfies an arbitrary second within the past 7 days. Its 7-day tier carries no backup storage charge. Periodic backup with a 4-hour interval can only restore to the moments its backups captured, and periodic restores are requested through the support team rather than run by you. A second read region replicates every write, including bad ones, so it provides availability, not a way back to an earlier state. A daily container copy job captures one snapshot per day, so it cannot reach an arbitrary second between copies.

Correct Answer: B

Hierarchical partition keys support up to three levels. With /tenantId, then /userId, then /id, a tenant's data can span multiple physical partitions, so a single tenantId prefix can exceed 20 GB and 10,000 RU/s, and queries that filter on tenantId are routed only to the partitions that hold that tenant. Hierarchical keys cannot be added to an existing container, which is why the plan to create a new container and use a container copy job is correct. Using /id by itself spreads data perfectly, but every query that filters by tenant becomes a cross-partition query. Keeping /tenantId with a higher autoscale maximum does not lift the per-logical-partition limits of 20 GB and 10,000 RU/s. A synthetic tenantId plus userId key avoids the size limit, but queries for a whole tenant become cross-partition unless every user is known and listed in advance.

Correct Answer: C

Data plane role-based access control lets you assign a role such as Cosmos DB Built-in Data Reader to the reporting service's managed identity, which authenticates with Microsoft Entra ID instead of a key. Removing the role assignment revokes that identity alone, and disabling key-based authentication (disableLocalAuth) makes sure no client can fall back to account keys. Rotating the primary key still depends on distributing keys and revokes every key holder at once, not one identity. A resource token comes from Azure Cosmos DB's own users-and-permissions model: it is a time-bound token that your code must issue and refresh, not an identity managed in Microsoft Entra ID. Storing the primary key in Azure Key Vault protects it at rest, but the service still retrieves and holds the full account key, which the requirement forbids.

Correct Answer: D

Hybrid search in Azure Cosmos DB for NoSQL uses the RRF (Reciprocal Rank Fusion) function in an ORDER BY RANK clause to merge the VectorDistance ranking with the BM25 FullTextScore ranking into a single list, and you can pass weights to favor either side. Hybrid queries need a TOP (or LIMIT) clause. A pure vector query with a larger TOP value returns more results but still ranks purely by semantic similarity, so articles with the exact code stay low. A WHERE FullTextContains filter is a yes-or-no match: it drops every article without the literal term, which breaks the natural-language queries that contain no code. Running separate queries and appending the results client-side produces two lists stitched together rather than one fused ranking.

Correct Answer: C

Mirroring Azure Cosmos DB into Microsoft Fabric continuously replicates inserts, updates and deletes into OneLake in Delta format with no ETL and without consuming the RUs allocated to transactional workloads. Analysts can then query the mirrored data with T-SQL in the SQL query editor or with Spark. Continuous backup is a prerequisite, and the 7-day tier is free. Azure Synapse Link and the analytical store are a separate, deprecated path; Microsoft states that mirroring does not use the analytical store or Synapse Link. A change feed processor writing to a lakehouse is exactly the custom pipeline the scenario rules out, and change feed reads consume RUs on the monitored container. An extra read region still serves queries from the transactional engine, so every analytical query keeps consuming request units.