Databricks-DA-Assoc Securing Data — 25 Questions

Question 1

A data analyst needs to share a sensitive customer table with the marketing team in Databricks. The marketing team should only see customer records where the country is United States, and they must never see the credit_card column. Which Unity Catalog feature should be configured to meet both of these governance requirements simultaneously?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a dynamic row filter function for the country column and a column masking function for the credit_card column on the base table.. Unity Catalog provides fine-grained governance by allowing administrators to define both row filters and column masks on a single table. Applying a row filter restricts access to specific rows based on predicates, while column masking obfuscates sensitive data attributes. Combining these two capabilities on the same table ensures that users only view authorized subsets of information without duplicating underlying storage.

Answer

Create a standard SQL view that filters rows and omits the sensitive column, then grant access to the view.

Answer

Configure a table-level access control list (ACL) to restrict the marketing team from querying the credit_card column directly.

Answer

Set up table access properties in the Hive metastore using traditional GRANT and REVOKE statements for column security.

Question 2

A data analyst needs to share a sensitive customer table with the marketing team in Databricks. The marketing team should only see customer records where the country is United States, and they must never see the credit_card column. Which Unity Catalog feature should be configured to meet both of these governance requirements simultaneously?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a dynamic view with conditional logic for row filtering and a masking function using current_user() for the email column.. While dynamic views can achieve this, Unity Catalog now supports native Row Filters and Column Masks (applied via ALTER TABLE) which are distinct from dynamic views. Option B describes a dynamic view approach, which is a valid legacy pattern, but the explanation should clarify that these are implemented via Unity Catalog's native security features (Row Filters and Column Masks) rather than just 'dynamic views'.

Answer

Create a static view filtered by region and grant the regional team SELECT permission on that view instead of the base table.

Answer

Export the subset of regional data to a separate storage container and provide the regional team with direct read access via cloud IAM roles.

Answer

Revoke read permissions on the schema level and rely entirely on cluster-level access control lists to filter out unauthorized rows.

Question 3

A security administrator is configuring access control for a new Unity Catalog catalog containing financial reports. Which TWO actions can be performed by a user who has been granted the USE CATALOG privilege on this catalog? (Choose two.)

Accepted Answer

List all schemas contained within the target catalog using SQL or the Databricks user interface.. The USE CATALOG privilege is a foundational hierarchical permission in Unity Catalog. While it does not grant direct read access to data inside schemas and tables, it allows users to traverse the catalog structure to view metadata objects and list child entities such as schemas and functions, acting as a prerequisite for accessing deeper assets.

Answer

Execute SELECT queries against any table located inside the schemas of this catalog.

Answer

Grant the USE SCHEMA privilege on child schemas to other analysts within the same business unit.

Answer

Create new tables and views directly within the default schema of the targeted catalog.

Question 4

A data analyst needs to grant a marketing user access to a specific table in Unity Catalog while ensuring they cannot see sensitive PII columns. Which Unity Catalog feature should the analyst implement?

Accepted Answer

Use the GRANT command to provide SELECT access on individual columns.. Unity Catalog supports column-level security via GRANT/REVOKE statements (e.g., GRANT SELECT(col1, col2) ON TABLE table_name TO user). While dynamic views are a valid approach, they are no longer the only or primary way to restrict column access. The explanation incorrectly states that column-level GRANT is not a native feature.

Answer

Apply a Workspace-level ACL to the entire database.

Answer

Move the sensitive columns into a separate, restricted table.

Question 5

Refer to the exhibit. A user in the 'finance_team' reports they cannot see the 'main.sales.revenue' table in the Data Explorer UI. What is the most likely cause?

Accepted Answer

The user does not have USAGE on the metastore.. In Unity Catalog, to view objects in Data Explorer, a user must have the USAGE privilege on the parent catalog and the USAGE privilege on the parent schema, in addition to permissions on the table itself. Lacking USAGE on either the catalog or schema prevents the user from navigating or seeing child objects in the UI.

Answer

The user is missing the 'CATALOG_USER' role.

Answer

The user lacks the CREATE permission on the schema.

Answer

The user is not in the 'finance_team' group.

Question 6

An enterprise data analytics team needs to grant a junior data analyst the ability to view rows in a customer table where the region column matches the analyst's assigned territory, without giving them permission to see rows from other regions. Which Unity Catalog feature should the data analyst administer to achieve this row-level security requirement?

Accepted Answer

Apply a Unity Catalog row filter using a SQL function that evaluates current_user() against an authorization mapping table.. Row filters in Unity Catalog allow administrators to restrict row access dynamically based on user identity or mapping tables. By attaching a SQL user-defined function as a row filter to the table, data analysts only view rows matching their specific regional authorization context. This approach maintains a single source of truth for the table while enforcing fine-grained security policies directly at query execution time.

Answer

Create a dynamic view containing a WHERE clause filtering the region column by the current user identifier and grant SELECT on the view.

Answer

Configure a table-level access control list granting SELECT only when the analyst uses a specific cluster configured with an instance profile.

Answer

Execute an ALTER TABLE command to drop rows from the table that do not match the analyst's assigned regional territory before they run queries.

Question 7

A security administrator is preparing to share sensitive customer data across different Databricks accounts using Delta Sharing. The administrator wants to ensure that specific personally identifiable information columns are completely hidden from the recipient without creating a separate filtered copy of the Delta table. Which approach fulfills this requirement efficiently?

Accepted Answer

Configure Unity Catalog column masks on the shared table before publishing the share to the designated Delta Sharing recipient.. Column masking in Delta Sharing allows data providers to apply transformation functions or mask sensitive attributes dynamically for external recipients. This feature ensures compliance with data privacy regulations by preventing unauthorized data exposure without incurring the storage costs and synchronization overhead of maintaining derivative physical tables for sharing workflows.

Answer

Export the table to CSV files, manually redact the sensitive columns using a script, and upload the redacted files to an external cloud bucket for the recipient.

Answer

Revoke read permissions on the entire table and share a derived view created using the CREATE VIEW statement in the recipient's metastore.

Answer

Set up an Apache Spark caching job that overwrites the original table with null values in sensitive columns whenever an external recipient runs a query.

Question 8

A data analyst at a healthcare company needs to give a team of nurses read access to a single column named 'patient_id' in the Unity Catalog table 'main.clinical.patients', while preventing them from seeing any other columns. The nurses already have USE CATALOG on 'main' and USE SCHEMA on 'clinical'. Which Unity Catalog privilege should the analyst grant to the nurses on the table?

Accepted Answer

Create a view that selects only 'patient_id' from the table and grant SELECT on that view.. Unity Catalog enforces privileges at the table level, not the column level. To give read access to only one column, the analyst must create a view that selects that column and grant SELECT on the view. The nurses can then query the view without accessing other columns.

Answer

SELECT on the table 'main.clinical.patients'

Answer

SELECT on the column 'main.clinical.patients.patient_id'

Answer

Grant USAGE on the column 'patient_id'

Question 9

A data analyst needs to share a sensitive table with a group of users in Unity Catalog. The users should only be able to see aggregated results, not individual rows. Which TWO actions should the analyst take to achieve this? (Choose two.)

Accepted Answer

Revoke SELECT on the base table from the group to enforce that they can only access the aggregated view.. To ensure users only see aggregated results, the analyst should create a view that performs the aggregation and grant SELECT on that view. Additionally, revoking SELECT on the base table prevents users from bypassing the view to access individual rows. This combination enforces the desired access restriction.

Answer

Grant SELECT on the base table to the group but instruct them to use aggregation in their queries.

Answer

Grant MODIFY on the base table to the group so they can create their own aggregated tables.

Answer

Use dynamic views with row-level filters to mask individual rows.

Question 10

A data analyst at a retail company needs to share a Unity Catalog table 'main.sales.transactions' with an external partner using Delta Sharing. The partner should be able to query the table but must not be able to see the 'credit_card_number' column. The analyst wants to create a share and add the table. Which TWO actions should the analyst take to meet these requirements? (Choose two.)

Accepted Answer

Create a view that selects all columns except 'credit_card_number' and add that view to the share.. Delta Sharing shares are defined by adding assets such as tables or views. To exclude a column, the analyst must create a view that omits the sensitive column and add that view to the share. Granting SELECT on the base table is unnecessary and would not restrict columns.

Answer

Grant the recipient SELECT on the table 'main.sales.transactions'.

Answer

Use the Delta Sharing REST API to define a partition filter on the share.

Answer

Apply a column mask on 'credit_card_number' to redact values for the recipient.

Question 11

A data analyst is working with a table that contains sensitive data and wants to ensure that only users from the 'finance' group can query it. The analyst decides to use Unity Catalog privileges. Which approach is most appropriate?

Accepted Answer

Grant SELECT on the table to the 'finance' group and revoke SELECT from all other users and groups.. The most secure approach is to grant SELECT only to the 'finance' group and revoke SELECT from all other users and groups. This ensures that only members of the finance group can access the sensitive table, adhering to the principle of least privilege. Relying on broad grants or row filtering does not meet the requirement of restricting access to a specific group.

Answer

Grant SELECT on the table to all users and rely on the 'finance' group membership to restrict access.

Answer

Create a view that filters rows based on the user's group and grant SELECT on the view to all users.

Answer

Grant USAGE on the schema to all users and SELECT on the table to the 'finance' group.

Question 12

A data analyst is configuring access control for a new Unity Catalog schema that will contain sensitive HR data. The analyst wants to ensure that only members of the `hr_team` group can query tables in the schema, and that they can also create new tables. Which two privileges should the analyst grant to the `hr_team` group on the schema? (Choose two.)

Accepted Answer

CREATE TABLE. To allow the `hr_team` group to query tables and create new tables in the schema, the analyst must grant `USE SCHEMA` so they can access the schema, and `CREATE TABLE` so they can create new tables. `SELECT` on the schema is not a valid privilege; `SELECT` must be granted on individual tables. Granting `ALL PRIVILEGES` would include unnecessary privileges.

Answer

ALL PRIVILEGES

Answer

MODIFY

Answer

SELECT

Question 13

A data analyst is configuring dynamic view functions to enforce row-level security on a table `main.hr.employees`. The analyst wants to ensure that users in the 'hr_admins' group can see all rows, while other users can see only rows where `department` matches their group membership. Which TWO steps are required to implement this with Unity Catalog? (Choose two.)

Accepted Answer

Create a view that uses `current_user()` or `is_account_group_member()` in the WHERE clause to filter rows dynamically.. Implementing row-level security via dynamic views requires creating a view that filters rows based on the querying user, and then granting access to the view while revoking direct access to the base table. This ensures all queries go through the view's logic. The other options either grant excessive privileges or use a different mechanism not requested.

Answer

Grant `SELECT` on the underlying table to all users who need access, and also grant `SELECT` on the view.

Answer

Create a row filter function using `CREATE FUNCTION` and apply it to the table with `ALTER TABLE ... SET ROW FILTER`.

Answer

Use `GRANT SELECT ON TABLE main.hr.employees TO hr_admins` and rely on the view's WHERE clause to filter for others.

Question 14

A data analyst is reviewing audit logs in Unity Catalog to investigate unauthorized access attempts to a sensitive table. Which audit log event should the analyst look for to identify failed attempts to read data from the table?

Accepted Answer

`getTable` with `statusCode` 403. To identify unauthorized read attempts, the analyst should look for `getTable` events with a 403 status code. These events are generated when a user tries to access a table but lacks the necessary permissions. Successful reads would have a 200 status code, and other events like `createTable` or `deleteTable` are unrelated to reading data.

Answer

`deleteTable` with `statusCode` 403

Answer

`queryTable` with `statusCode` 200

Answer

`createTable` with `statusCode` 403

Question 15

A data analyst is preparing a Unity Catalog managed table that stores raw clickstream events. The security team requires that analysts who query this table must never see the raw IP address values, but the table must still be readable for aggregation. The analyst decides to use a column mask on the ip_address column. Which Unity Catalog privilege must the analyst hold to apply this column mask so that unauthorized users see a masked value instead of the real one?

Accepted Answer

OWNER on the table. A column mask is a security policy that transforms column values for readers who lack the UNMASK privilege, so it must be attached by someone with full control over the table's definition. Ownership carries that authority, while data-manipulation and read privileges do not. This is why the analyst must be the table owner to apply the mask, ensuring the governance rule is enforced for all downstream consumers of the clickstream data.

Answer

SELECT on the table only

Answer

MODIFY on the table

Answer

MANAGE on the table

Question 16

A data analyst needs to share a sensitive customer table with the marketing team in Databricks. The marketing team should only see customer records where the country is United States, and they must never see the credit_card column. Which Unity Catalog feature should be configured to meet both of these governance requirements simultaneously?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply row filters and column masks using SQL functions within Unity Catalog to restrict data visibility dynamically for the marketing group.. Row-level and column-level filtering in Unity Catalog allow administrators and data owners to secure fine-grained access to tables using SQL functions. By applying a dynamic view with conditional logic, users see only permitted rows and columns. This ensures regulatory compliance and data minimization principles are met without duplicating physical storage assets across different business units.

Answer

Create a static clone of the table, drop the restricted column, and grant SELECT permission on the clone to the marketing group.

Answer

Configure an access control list on the parent catalog to deny SELECT access on specific columns for the marketing group.

Answer

Export the filtered subset of data into CSV files and upload them to a secured volume inside the marketing team's schema.

Question 17

A data analyst needs to grant a colleague read access to a specific table named 'quarterly_sales' within Unity Catalog without exposing other tables in the same schema. Which SQL command should the analyst execute?

Accepted Answer

GRANT SELECT ON TABLE quarterly_sales TO `colleague@company.com`;. Granting granular access in Unity Catalog is performed using standard SQL GRANT syntax. To allow a user to read data from a specific table, the SELECT privilege must be granted directly on that table securable object while ensuring parent container traversal permissions are present.

Answer

GRANT ALL PRIVILEGES ON SCHEMA sales_schema TO `colleague@company.com`;

Answer

GRANT READ ACCESS ON CATALOG main TO `colleague@company.com`;

Answer

GRANT USE TABLE ON quarterly_sales TO `colleague@company.com`;

Question 18

Which identity management approach is required to utilize Unity Catalog for centralized governance across multiple Databricks workspaces?

Accepted Answer

Account-level identity provisioning using SCIM.. Unity Catalog requires that all users and groups are managed at the account level rather than individual workspace levels. By using an Account-level metastore, Databricks ensures a single source of truth for identities and permissions. This centralized model simplifies auditing, security, and data sharing, as permissions propagate consistently across all workspaces linked to that specific metastore.

Answer

Local workspace-level user management.

Answer

Database-level authentication via JDBC drivers.

Answer

Private Link connectivity for all users.

Question 19

An administrator needs to secure a table containing sensitive customer data. Which TWO options represent valid ways to restrict access using Unity Catalog?

Accepted Answer

Use GRANT SELECT on the table to specific users or groups.. Unity Catalog provides robust security primitives including standard SQL GRANT/REVOKE commands and dynamic masking. By using these features, administrators can define who sees what data without altering the underlying data files. These two methods are the standard, best-practice approaches for ensuring that sensitive data is protected while maintaining a clean, performant analytics environment for end users.

Answer

Delete the sensitive rows from the table manually.

Answer

Rotate the workspace passwords weekly.

Answer

Disable the table for all users except the owner.

Question 20

What is the primary function of a Storage Credential in Unity Catalog?

Accepted Answer

To provide a secure way to access cloud storage locations.. A Storage Credential is an object in Unity Catalog that encapsulates long-term cloud provider credentials (like an AWS IAM role or Azure Service Principal). It allows Databricks to access data in cloud storage without requiring users to configure individual cloud credentials on every cluster. This centralizes security by keeping sensitive cloud keys away from end users and developers.

Answer

To encrypt files stored in the S3 bucket.

Answer

To manage user passwords for the Databricks workspace.

Answer

To define table schema definitions for external tables.