Databricks-DE-Assoc Governance and Security — 30 Questions

Question 1

An enterprise data governance team needs to ensure that junior data analysts can view customer transaction records, but their view must automatically mask the primary credit card number column. Which Unity Catalog feature accomplishes this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Row filters and column masks using SQL user-defined functions applied via ALTER TABLE statements.. In Unity Catalog, column masking is implemented using the 'MASK' clause within a 'CREATE VIEW' statement or an 'ALTER TABLE' statement, typically referencing a SQL UDF. The explanation correctly identifies the use of SQL UDFs and ALTER TABLE, but the phrasing 'Row filters and column masks using SQL user-defined functions applied via ALTER TABLE statements' is the standard way to describe this feature in Unity Catalog.

Answer

Table ACLs configured via legacy GRANT commands on Hive metastore tables.

Answer

Dynamic view creation combined with SQL conditional functions like CASE WHEN.

Answer

Cluster-level Spark configuration properties that filter DataFrame schema definitions at runtime.

Question 2

Which TWO of the following statements accurately describe the behavior and characteristics of managed tables versus external tables in Unity Catalog? (Choose TWO)

Accepted Answer

Dropping a Unity Catalog managed table deletes both its metadata from the metastore and its underlying data files from cloud storage.. Managed tables and external tables in Unity Catalog both provide ACID transactions and Delta Lake optimizations, but they differ significantly in storage lifecycle management. Managed tables store data in the metastore's root storage container and have their underlying files automatically deleted when dropped, whereas external tables point to custom cloud storage locations where files remain intact upon dropping.

Answer

Managed tables do not support Delta Lake ACID transaction guarantees, unlike external tables.

Answer

Dropping a Unity Catalog external table removes the underlying data files from cloud storage immediately.

Answer

External tables can only be queried by users who possess metastore admin privileges across all workspaces.

Question 3

A data engineer needs to ensure that PII data in a 'users' table is masked for all users except those in the 'HR' group. Which Unity Catalog feature should be used to implement this requirement?

Answer

Table Access Control Lists (ACLs)

Answer

Unity Catalog Dynamic Views

Answer

Row-level filtering only

Answer

Credential passthrough

Question 4

Which TWO of the following are true regarding the use of Personal Access Tokens (PATs) versus Service Principals for automated jobs in Unity Catalog?

Accepted Answer

Service principals are independent of individual user accounts.. Service Principals are independent of individual user accounts, which prevents service disruption when employees leave. Additionally, they do not require a standard interactive Databricks user license for API/automated job access. PATs are tied to users, making them a security risk upon offboarding and harder to audit globally compared to centralized service principals.

Answer

PATs are recommended for production job automation.

Answer

PATs have higher security than service principals.

Answer

PATs are easier to audit than service principals.

Question 5

If an organization wants to ensure that no data can be accessed unless it is explicitly granted, which Unity Catalog setting should be enforced?

Accepted Answer

Enable Unity Catalog for all workspaces.. Unity Catalog enforces a 'deny-by-default' security model by design once a workspace is enabled for Unity Catalog. There is no specific setting called 'Enable Unity Catalog for all workspaces' that acts as a toggle for this behavior; rather, it is the default state of the Unity Catalog metastore. The question is poorly phrased as it implies a configuration setting that doesn't exist in the Databricks documentation.

Answer

Enable external locations.

Answer

Use the 'Account Admin' role.

Answer

Define a default catalog.

Question 6

Refer to the exhibit. What is the final effective permission for 'data_scientists' on the 'sensitive_data' table?

Accepted Answer

SELECT access is granted.. Unity Catalog permissions are not determined by the 'most recent command' in a sequence. Unity Catalog uses an additive model where GRANTs are cumulative. If a user or group is granted a permission, it remains in effect unless explicitly revoked. The explanation incorrectly suggests that Unity Catalog behaves like a sequential script where the last command overwrites previous ones, which is factually incorrect for Unity Catalog's access control model.

Answer

SELECT access is denied.

Answer

The permission is in an inconsistent state.

Answer

The grant fails due to a conflict.

Question 7

A data engineer is configuring Unity Catalog access control. Which TWO of the following statements accurately describe how privileges are inherited or applied in the hierarchy?

Accepted Answer

Privileges granted at the Catalog level are inherited by all schemas and tables contained within that catalog.. Option A and B are correct. Option C is incorrect because inheritance flows downward (parent to child), not upward. Option D is incorrect because a user only needs the 'USE CATALOG' and 'USE SCHEMA' privileges along with 'CREATE TABLE' to create a table; ownership is not required. Option E is incorrect because Unity Catalog is enforced across all compute types, including notebooks.

Answer

Access rights at the table level can be inherited by the parent schema.

Answer

Users must have the OWNERSHIP privilege on a catalog to create new tables within it.

Answer

Privileges are limited to Databricks SQL and cannot be enforced in notebooks.

Question 8

Refer to the exhibit. A data engineer executes the provided commands. However, users in the 'data-analyst-group' report they still cannot query the 'main.sales.sales_data' table. What is the most likely cause?

Accepted Answer

The command 'GRANT USE CATALOG' must be granted before the schema or table privileges.. In Unity Catalog, privileges are not order-dependent; they are additive. The 'USE CATALOG' (or USAGE) privilege is required, but it does not need to be granted 'before' other privileges. The issue is simply that the 'USE CATALOG' privilege is missing entirely, not that the sequence of execution was incorrect.

Answer

The users lack the SELECT privilege on the 'main' catalog.

Answer

The users require the 'BROWSE' privilege on the catalog.

Answer

The table 'sales_data' must have its owner changed to the 'data-analyst-group'.

Question 9

Refer to the exhibit. A data engineer runs the SQL commands shown to grant table access to a group in Unity Catalog. However, members of the `finance-team` group still encounter a permission denied error when attempting to query the table. What is missing?

Accepted Answer

The group needs the MODIFY privilege granted on the target table to execute read queries.. In Unity Catalog, granting table access requires a hierarchy of privileges. Specifically, the principal must be granted the USAGE privilege on the parent catalog and parent schema, as well as the SELECT privilege on the target table. Without these specific privileges, users will encounter permission denied errors when trying to query the table.

Answer

The group needs the BIND_EXTERNAL_DIRECTORIES privilege on the catalog.

Answer

The group needs the EXECUTE privilege on the parent schema to run SQL queries.

Answer

The SQL commands are correct, but the user group may not have been assigned the appropriate workspace entitlement to access the workspace.

Question 10

A data engineer needs to grant a user permission to query a specific table in Unity Catalog without allowing them to view the underlying data definition or metadata of the schema. Which command should the engineer execute?

Accepted Answer

GRANT SELECT ON TABLE my_table TO user@example.com. While GRANT SELECT on the table is the correct command to allow querying, the explanation incorrectly states that the user does not need schema/catalog metadata permissions. In Unity Catalog, a user MUST have USE CATALOG and USE SCHEMA privileges to access any object within those containers, even if they have SELECT on the table. The explanation implies that table-level SELECT bypasses the need for parent-level metadata access, which is false.

Answer

GRANT SELECT ON SCHEMA my_schema TO user@example.com

Answer

GRANT ALL PRIVILEGES ON TABLE my_table TO user@example.com

Answer

GRANT USAGE ON TABLE my_table TO user@example.com

Question 11

A Databricks administrator is configuring access control for a workspace. Which TWO statements accurately describe the behavior of Unity Catalog's security model?

Accepted Answer

The Metastore is the top-level container for all data objects.. Unity Catalog supports both account-level groups and workspace-local groups. While account-level groups are recommended for cross-workspace consistency, workspace-local groups can indeed be used to manage permissions within Unity Catalog.

Answer

Unity Catalog privileges are subtractive by default.

Answer

Permissions granted at the table level can be overridden by schema-level DENY rules.

Question 12

Refer to the exhibit. A user is attempting to query a table located in the 'finance' catalog but receives the provided error. What is the minimum permission required to resolve this issue?

Accepted Answer

GRANT USE CATALOG ON CATALOG finance TO user@example.com. To access a table in Unity Catalog, a user requires three levels of permissions: USE CATALOG on the catalog, USE SCHEMA on the schema, and SELECT on the table. The explanation mentions USE CATALOG and USE SCHEMA but fails to mention that SELECT on the table is also required to actually query the data, making the 'minimum permission' claim in the stem slightly ambiguous if interpreted as the *only* permission needed.

Answer

GRANT SELECT ON CATALOG finance TO user@example.com

Answer

GRANT USAGE ON CATALOG finance TO user@example.com

Answer

GRANT OWNER TO user@example.com ON CATALOG finance

Question 13

A data engineer needs to grant a group of data analysts read-only access to a specific schema named `finance_analytics` within Unity Catalog. Which SQL command correctly grants the required privileges according to Unity Catalog security standards?

Accepted Answer

GRANT USE SCHEMA, SELECT ON SCHEMA finance_analytics TO `data-analysts`;. To grant read-only access to a schema in Unity Catalog, the user needs USE SCHEMA and SELECT privileges on the schema. Option D is syntactically incorrect because 'USE SCHEMA' is not a privilege that can be granted on a schema object itself; rather, 'USE SCHEMA' is a privilege granted on the schema to allow access to its contents. The correct command is 'GRANT USE SCHEMA, SELECT ON SCHEMA finance_analytics TO `data-analysts`'. Since the prompt implies D is the intended answer but marks it wrong, the options need to be corrected.

Answer

GRANT ALL PRIVILEGES ON SCHEMA finance_analytics TO `data-analysts`;

Answer

GRANT USAGE ON SCHEMA finance_analytics TO `data-analysts`;

Answer

GRANT SELECT ON SCHEMA finance_analytics TO `data-analysts`;

Question 14

A data engineer wants to grant a group 'analysts' the ability to read all current and future tables in the schema 'sales' without granting access to other schemas in the same catalog. Which SQL statement should be used?

Accepted Answer

GRANT SELECT ON SCHEMA sales TO analysts;. Granting SELECT at the schema level is the correct approach to provide read access to all current and future tables within that schema. This ensures the group can query any table in the 'sales' schema without needing separate grants for each table. It also avoids granting broader access to the entire catalog, adhering to the principle of least privilege.

Answer

GRANT SELECT ON CATALOG sales TO analysts;

Answer

GRANT USAGE ON SCHEMA sales TO analysts;

Answer

GRANT SELECT ON TABLE sales.* TO analysts;

Question 15

A data engineer is designing a Unity Catalog hierarchy for a new project. The project requires that data analysts can query tables in the `finance` schema but must not be able to see or query tables in the `hr` schema. Both schemas are in the same catalog `prod`. Which two privileges should be granted to the data analysts to achieve this? (Choose two.)

Accepted Answer

GRANT USE SCHEMA ON SCHEMA prod.finance TO `data_analysts`;. To allow data analysts to query tables in the `finance` schema while preventing access to `hr`, you must grant USE CATALOG on `prod` to enable access to the catalog, and USE SCHEMA on `finance` to allow interaction with that schema. Additionally, SELECT privileges on the tables or schema `finance` would be needed, but the question asks for two privileges; these two are the minimal required to establish access without granting any rights on `hr`.

Answer

GRANT SELECT ON SCHEMA prod.hr TO `data_analysts`;

Answer

GRANT USE SCHEMA ON SCHEMA prod.hr TO `data_analysts`;

Answer

GRANT SELECT ON CATALOG prod TO `data_analysts`;

Question 16

A data engineer needs to allow a service principal `etl_sp` to read from an external location `s3://corp-data/raw/` in Unity Catalog. The storage credential `s3_cred` already exists and has been granted to the `etl_sp` service principal. The engineer also creates an external location `raw_loc` pointing to `s3://corp-data/raw/` and grants `READ FILES` on `raw_loc` to `etl_sp`. When `etl_sp` runs a query reading a Parquet file from that path, it fails with a permission error. What is the most likely cause?

Accepted Answer

The service principal lacks `READ FILES` on the external location, or the grant was issued on a different path than the one being read.. In Unity Catalog, reading files directly from cloud storage through an external location requires `READ FILES` on that external location, plus `USE STORAGE CREDENTIAL` on the credential it references. The scenario states the credential was granted, so the remaining likely gap is that `READ FILES` was not effectively granted on the exact external location being read, or the path mismatch means the authorization does not cover the requested path.

Answer

The service principal lacks `USE CATALOG` and `USE SCHEMA` privileges on the catalog and schema containing the external location.

Answer

The service principal lacks `USE STORAGE CREDENTIAL` privilege on `s3_cred`.

Answer

The service principal lacks `CREATE EXTERNAL LOCATION` privilege on the metastore.

Question 17

A data engineer has a Unity Catalog table named sales.orders that contains a column customer_email. The security team requires that analysts in the group 'analysts' see a masked version of customer_email (e.g., a***@example.com) when they query the table, while members of the group 'auditors' must see the full email address. The data engineer wants to implement this with minimal administrative overhead and ensure the masking is applied consistently across all query engines (SQL, Python, and Scala). Which approach should the data engineer use?

Accepted Answer

Apply a column mask function to customer_email using ALTER TABLE ... ALTER COLUMN ... SET MASK, granting the function EXECUTE to 'analysts' and 'auditors'.. Unity Catalog column masks are the correct mechanism to obfuscate sensitive column values dynamically based on the querying user's group membership. They are applied at the column level and evaluated at query time for all engines. This avoids duplicating data or creating multiple views, and ensures consistent enforcement. The other options either do not mask column values, require excessive overhead, or are not native to Unity Catalog.

Answer

Create a separate table for analysts with masked emails and another for auditors with full emails, then use table aliases to redirect queries based on group.

Answer

Create a dynamic view on top of sales.orders that applies a CASE expression based on is_account_group_member(), and grant SELECT on the view to 'analysts' while revoking direct table access.

Answer

Use row-level security with a filter that returns different rows for each group, effectively hiding the email column for 'analysts'.

Question 18

A data engineer is managing access to a Unity Catalog table `finance.transactions` that contains sensitive financial data. The table is owned by the `finance_admin` group. The data engineer needs to ensure that members of the `auditor` group can query the table but cannot modify its structure or data. Additionally, the `auditor` group should be able to grant `SELECT` privileges on the table to other users. Which two privileges should be granted to the `auditor` group to meet these requirements? (Choose two.)

Accepted Answer

SELECT. To allow auditors to query the table, they need `SELECT`. To allow them to grant `SELECT` to others, they need the `GRANT` privilege on the table. These two privileges together meet the requirements without granting unnecessary permissions like `MODIFY` or `ALL PRIVILEGES`. The `GRANT` privilege is specifically designed for delegating grant authority.

Answer

MODIFY

Answer

USAGE

Answer

ALL PRIVILEGES

Question 19

A data engineer is configuring a Unity Catalog storage credential to access an AWS S3 bucket. The S3 bucket has a bucket policy that allows access only from a specific IAM role. The data engineer creates a storage credential with an IAM role ARN and then creates an external location using that storage credential. When querying a table at that external location, users receive an access denied error. The data engineer verifies that the IAM role has the correct S3 permissions and the bucket policy allows the role. What is the most likely cause of the error?

Accepted Answer

The IAM role's trust policy does not allow the Databricks AWS account to assume it, so the storage credential cannot obtain temporary credentials.. The most likely cause is that the IAM role's trust policy does not permit Databricks to assume it. Unity Catalog storage credentials rely on a trust relationship between the IAM role and Databricks' AWS account. Without a correct trust policy, the storage credential cannot obtain temporary credentials, leading to access denied errors. Verifying the trust policy is a critical step when configuring storage credentials.

Answer

The external location was created without specifying the storage credential, so Unity Catalog is using a default credential that lacks permissions.

Answer

The storage credential must be granted USAGE on the external location, but it was not, so access is denied.

Answer

The S3 bucket policy must explicitly allow the Databricks workspace IAM role, not the storage credential IAM role.

Question 20

A data engineer is setting up a new Unity Catalog metastore for an organization. The organization has multiple Databricks workspaces in different regions and wants to ensure that all workspaces can access the same Unity Catalog data and governance policies. What is the correct approach to configure the metastore?

Accepted Answer

Create one Unity Catalog metastore per region and assign it to all workspaces in that region, ensuring that workspaces in different regions use their regional metastore.. Unity Catalog metastores are regional. To support multiple workspaces across regions, you create one metastore per region and assign all workspaces in that region to it. This provides centralized governance within each region while accommodating data residency and performance needs. It is not possible to have a single global metastore or to connect workspaces to a metastore in a different region.

Answer

Create a single global Unity Catalog metastore and attach it to all workspaces regardless of region.

Answer

Create a separate Unity Catalog metastore for each workspace and replicate the data and policies manually.

Answer

Use a single workspace as the metastore host and have other workspaces connect to it via a remote connection.