Databricks-DA-Assoc Securing Data — Timed 15 Questions

Question 1

A data analyst needs to share a sensitive customer table with the marketing team in Databricks. The marketing team should only see customer records where the country is United States, and they must never see the credit_card column. Which Unity Catalog feature should be configured to meet both of these governance requirements simultaneously?

15 minute time limit — choose an answer to begin.

Accepted Answer

Apply a dynamic row filter function for the country column and a column masking function for the credit_card column on the base table.. Unity Catalog provides fine-grained governance by allowing administrators to define both row filters and column masks on a single table. Applying a row filter restricts access to specific rows based on predicates, while column masking obfuscates sensitive data attributes. Combining these two capabilities on the same table ensures that users only view authorized subsets of information without duplicating underlying storage.

Answer

Create a standard SQL view that filters rows and omits the sensitive column, then grant access to the view.

Answer

Configure a table-level access control list (ACL) to restrict the marketing team from querying the credit_card column directly.

Answer

Set up table access properties in the Hive metastore using traditional GRANT and REVOKE statements for column security.

Question 2

A data analyst needs to share a sensitive customer table with the marketing team in Databricks. The marketing team should only see customer records where the country is United States, and they must never see the credit_card column. Which Unity Catalog feature should be configured to meet both of these governance requirements simultaneously?

15 minute time limit — choose an answer to begin.

Accepted Answer

Apply a dynamic view with conditional logic for row filtering and a masking function using current_user() for the email column.. While dynamic views can achieve this, Unity Catalog now supports native Row Filters and Column Masks (applied via ALTER TABLE) which are distinct from dynamic views. Option B describes a dynamic view approach, which is a valid legacy pattern, but the explanation should clarify that these are implemented via Unity Catalog's native security features (Row Filters and Column Masks) rather than just 'dynamic views'.

Answer

Create a static view filtered by region and grant the regional team SELECT permission on that view instead of the base table.

Answer

Export the subset of regional data to a separate storage container and provide the regional team with direct read access via cloud IAM roles.

Answer

Revoke read permissions on the schema level and rely entirely on cluster-level access control lists to filter out unauthorized rows.

Question 3

A security administrator is configuring access control for a new Unity Catalog catalog containing financial reports. Which TWO actions can be performed by a user who has been granted the USE CATALOG privilege on this catalog? (Choose two.)

Accepted Answer

List all schemas contained within the target catalog using SQL or the Databricks user interface.. The USE CATALOG privilege is a foundational hierarchical permission in Unity Catalog. While it does not grant direct read access to data inside schemas and tables, it allows users to traverse the catalog structure to view metadata objects and list child entities such as schemas and functions, acting as a prerequisite for accessing deeper assets.

Answer

Execute SELECT queries against any table located inside the schemas of this catalog.

Answer

Grant the USE SCHEMA privilege on child schemas to other analysts within the same business unit.

Answer

Create new tables and views directly within the default schema of the targeted catalog.

Question 4

A data analyst needs to grant a marketing user access to a specific table in Unity Catalog while ensuring they cannot see sensitive PII columns. Which Unity Catalog feature should the analyst implement?

Accepted Answer

Use the GRANT command to provide SELECT access on individual columns.. Unity Catalog supports column-level security via GRANT/REVOKE statements (e.g., GRANT SELECT(col1, col2) ON TABLE table_name TO user). While dynamic views are a valid approach, they are no longer the only or primary way to restrict column access. The explanation incorrectly states that column-level GRANT is not a native feature.

Answer

Apply a Workspace-level ACL to the entire database.

Answer

Move the sensitive columns into a separate, restricted table.

Question 5

Refer to the exhibit. A user in the 'finance_team' reports they cannot see the 'main.sales.revenue' table in the Data Explorer UI. What is the most likely cause?

Accepted Answer

The user does not have USAGE on the metastore.. In Unity Catalog, to view objects in Data Explorer, a user must have the USAGE privilege on the parent catalog and the USAGE privilege on the parent schema, in addition to permissions on the table itself. Lacking USAGE on either the catalog or schema prevents the user from navigating or seeing child objects in the UI.

Answer

The user is missing the 'CATALOG_USER' role.

Answer

The user lacks the CREATE permission on the schema.

Answer

The user is not in the 'finance_team' group.

Question 6

An enterprise data analytics team needs to grant a junior data analyst the ability to view rows in a customer table where the region column matches the analyst's assigned territory, without giving them permission to see rows from other regions. Which Unity Catalog feature should the data analyst administer to achieve this row-level security requirement?

Accepted Answer

Apply a Unity Catalog row filter using a SQL function that evaluates current_user() against an authorization mapping table.. Row filters in Unity Catalog allow administrators to restrict row access dynamically based on user identity or mapping tables. By attaching a SQL user-defined function as a row filter to the table, data analysts only view rows matching their specific regional authorization context. This approach maintains a single source of truth for the table while enforcing fine-grained security policies directly at query execution time.

Answer

Create a dynamic view containing a WHERE clause filtering the region column by the current user identifier and grant SELECT on the view.

Answer

Configure a table-level access control list granting SELECT only when the analyst uses a specific cluster configured with an instance profile.

Answer

Execute an ALTER TABLE command to drop rows from the table that do not match the analyst's assigned regional territory before they run queries.

Question 7

A security administrator is preparing to share sensitive customer data across different Databricks accounts using Delta Sharing. The administrator wants to ensure that specific personally identifiable information columns are completely hidden from the recipient without creating a separate filtered copy of the Delta table. Which approach fulfills this requirement efficiently?

Accepted Answer

Configure Unity Catalog column masks on the shared table before publishing the share to the designated Delta Sharing recipient.. Column masking in Delta Sharing allows data providers to apply transformation functions or mask sensitive attributes dynamically for external recipients. This feature ensures compliance with data privacy regulations by preventing unauthorized data exposure without incurring the storage costs and synchronization overhead of maintaining derivative physical tables for sharing workflows.

Answer

Export the table to CSV files, manually redact the sensitive columns using a script, and upload the redacted files to an external cloud bucket for the recipient.

Answer

Revoke read permissions on the entire table and share a derived view created using the CREATE VIEW statement in the recipient's metastore.

Answer

Set up an Apache Spark caching job that overwrites the original table with null values in sensitive columns whenever an external recipient runs a query.

Question 8

A data analyst at a healthcare company needs to give a team of nurses read access to a single column named 'patient_id' in the Unity Catalog table 'main.clinical.patients', while preventing them from seeing any other columns. The nurses already have USE CATALOG on 'main' and USE SCHEMA on 'clinical'. Which Unity Catalog privilege should the analyst grant to the nurses on the table?

Accepted Answer

Create a view that selects only 'patient_id' from the table and grant SELECT on that view.. Unity Catalog enforces privileges at the table level, not the column level. To give read access to only one column, the analyst must create a view that selects that column and grant SELECT on the view. The nurses can then query the view without accessing other columns.

Answer

SELECT on the table 'main.clinical.patients'

Answer

SELECT on the column 'main.clinical.patients.patient_id'

Answer

Grant USAGE on the column 'patient_id'

Question 9

A data analyst needs to share a sensitive table with a group of users in Unity Catalog. The users should only be able to see aggregated results, not individual rows. Which TWO actions should the analyst take to achieve this? (Choose two.)

Accepted Answer

Revoke SELECT on the base table from the group to enforce that they can only access the aggregated view.. To ensure users only see aggregated results, the analyst should create a view that performs the aggregation and grant SELECT on that view. Additionally, revoking SELECT on the base table prevents users from bypassing the view to access individual rows. This combination enforces the desired access restriction.

Answer

Grant SELECT on the base table to the group but instruct them to use aggregation in their queries.

Answer

Grant MODIFY on the base table to the group so they can create their own aggregated tables.

Answer

Use dynamic views with row-level filters to mask individual rows.

Question 10

A data analyst at a retail company needs to share a Unity Catalog table 'main.sales.transactions' with an external partner using Delta Sharing. The partner should be able to query the table but must not be able to see the 'credit_card_number' column. The analyst wants to create a share and add the table. Which TWO actions should the analyst take to meet these requirements? (Choose two.)

Accepted Answer

Create a view that selects all columns except 'credit_card_number' and add that view to the share.. Delta Sharing shares are defined by adding assets such as tables or views. To exclude a column, the analyst must create a view that omits the sensitive column and add that view to the share. Granting SELECT on the base table is unnecessary and would not restrict columns.

Answer

Grant the recipient SELECT on the table 'main.sales.transactions'.

Answer

Use the Delta Sharing REST API to define a partition filter on the share.

Answer

Apply a column mask on 'credit_card_number' to redact values for the recipient.

Question 11

A data analyst is working with a table that contains sensitive data and wants to ensure that only users from the 'finance' group can query it. The analyst decides to use Unity Catalog privileges. Which approach is most appropriate?

Accepted Answer

Grant SELECT on the table to the 'finance' group and revoke SELECT from all other users and groups.. The most secure approach is to grant SELECT only to the 'finance' group and revoke SELECT from all other users and groups. This ensures that only members of the finance group can access the sensitive table, adhering to the principle of least privilege. Relying on broad grants or row filtering does not meet the requirement of restricting access to a specific group.

Answer

Grant SELECT on the table to all users and rely on the 'finance' group membership to restrict access.

Answer

Create a view that filters rows based on the user's group and grant SELECT on the view to all users.

Answer

Grant USAGE on the schema to all users and SELECT on the table to the 'finance' group.

Question 12

A data analyst is configuring access control for a new Unity Catalog schema that will contain sensitive HR data. The analyst wants to ensure that only members of the `hr_team` group can query tables in the schema, and that they can also create new tables. Which two privileges should the analyst grant to the `hr_team` group on the schema? (Choose two.)

Accepted Answer

CREATE TABLE. To allow the `hr_team` group to query tables and create new tables in the schema, the analyst must grant `USE SCHEMA` so they can access the schema, and `CREATE TABLE` so they can create new tables. `SELECT` on the schema is not a valid privilege; `SELECT` must be granted on individual tables. Granting `ALL PRIVILEGES` would include unnecessary privileges.

Answer

ALL PRIVILEGES

Answer

MODIFY

Answer

SELECT

Question 13

A data analyst is configuring dynamic view functions to enforce row-level security on a table `main.hr.employees`. The analyst wants to ensure that users in the 'hr_admins' group can see all rows, while other users can see only rows where `department` matches their group membership. Which TWO steps are required to implement this with Unity Catalog? (Choose two.)

Accepted Answer

Create a view that uses `current_user()` or `is_account_group_member()` in the WHERE clause to filter rows dynamically.. Implementing row-level security via dynamic views requires creating a view that filters rows based on the querying user, and then granting access to the view while revoking direct access to the base table. This ensures all queries go through the view's logic. The other options either grant excessive privileges or use a different mechanism not requested.

Answer

Grant `SELECT` on the underlying table to all users who need access, and also grant `SELECT` on the view.

Answer

Create a row filter function using `CREATE FUNCTION` and apply it to the table with `ALTER TABLE ... SET ROW FILTER`.

Answer

Use `GRANT SELECT ON TABLE main.hr.employees TO hr_admins` and rely on the view's WHERE clause to filter for others.

Question 14

A data analyst is reviewing audit logs in Unity Catalog to investigate unauthorized access attempts to a sensitive table. Which audit log event should the analyst look for to identify failed attempts to read data from the table?

Accepted Answer

`getTable` with `statusCode` 403. To identify unauthorized read attempts, the analyst should look for `getTable` events with a 403 status code. These events are generated when a user tries to access a table but lacks the necessary permissions. Successful reads would have a 200 status code, and other events like `createTable` or `deleteTable` are unrelated to reading data.

Answer

`deleteTable` with `statusCode` 403

Answer

`queryTable` with `statusCode` 200

Answer

`createTable` with `statusCode` 403

Question 15

A data analyst is preparing a Unity Catalog managed table that stores raw clickstream events. The security team requires that analysts who query this table must never see the raw IP address values, but the table must still be readable for aggregation. The analyst decides to use a column mask on the ip_address column. Which Unity Catalog privilege must the analyst hold to apply this column mask so that unauthorized users see a masked value instead of the real one?

Accepted Answer

OWNER on the table. A column mask is a security policy that transforms column values for readers who lack the UNMASK privilege, so it must be attached by someone with full control over the table's definition. Ownership carries that authority, while data-manipulation and read privileges do not. This is why the analyst must be the table owner to apply the mask, ensuring the governance rule is enforced for all downstream consumers of the clickstream data.

Answer

SELECT on the table only

Answer

MODIFY on the table

Answer

MANAGE on the table