Databricks-DE-Assoc Governance and Security Practice Test 2 — 15 Questions

Question 1

A data engineer needs to allow a service principal `etl_sp` to read from an external location `s3://corp-data/raw/` in Unity Catalog. The storage credential `s3_cred` already exists and has been granted to the `etl_sp` service principal. The engineer also creates an external location `raw_loc` pointing to `s3://corp-data/raw/` and grants `READ FILES` on `raw_loc` to `etl_sp`. When `etl_sp` runs a query reading a Parquet file from that path, it fails with a permission error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service principal lacks `READ FILES` on the external location, or the grant was issued on a different path than the one being read.. In Unity Catalog, reading files directly from cloud storage through an external location requires `READ FILES` on that external location, plus `USE STORAGE CREDENTIAL` on the credential it references. The scenario states the credential was granted, so the remaining likely gap is that `READ FILES` was not effectively granted on the exact external location being read, or the path mismatch means the authorization does not cover the requested path.

Answer

The service principal lacks `USE CATALOG` and `USE SCHEMA` privileges on the catalog and schema containing the external location.

Answer

The service principal lacks `USE STORAGE CREDENTIAL` privilege on `s3_cred`.

Answer

The service principal lacks `CREATE EXTERNAL LOCATION` privilege on the metastore.

Question 2

A data engineer has a Unity Catalog table named sales.orders that contains a column customer_email. The security team requires that analysts in the group 'analysts' see a masked version of customer_email (e.g., a***@example.com) when they query the table, while members of the group 'auditors' must see the full email address. The data engineer wants to implement this with minimal administrative overhead and ensure the masking is applied consistently across all query engines (SQL, Python, and Scala). Which approach should the data engineer use?

Accepted Answer

Apply a column mask function to customer_email using ALTER TABLE ... ALTER COLUMN ... SET MASK, granting the function EXECUTE to 'analysts' and 'auditors'.. Unity Catalog column masks are the correct mechanism to obfuscate sensitive column values dynamically based on the querying user's group membership. They are applied at the column level and evaluated at query time for all engines. This avoids duplicating data or creating multiple views, and ensures consistent enforcement. The other options either do not mask column values, require excessive overhead, or are not native to Unity Catalog.

Answer

Create a separate table for analysts with masked emails and another for auditors with full emails, then use table aliases to redirect queries based on group.

Answer

Create a dynamic view on top of sales.orders that applies a CASE expression based on is_account_group_member(), and grant SELECT on the view to 'analysts' while revoking direct table access.

Answer

Use row-level security with a filter that returns different rows for each group, effectively hiding the email column for 'analysts'.

Question 3

A data engineer is managing access to a Unity Catalog table `finance.transactions` that contains sensitive financial data. The table is owned by the `finance_admin` group. The data engineer needs to ensure that members of the `auditor` group can query the table but cannot modify its structure or data. Additionally, the `auditor` group should be able to grant `SELECT` privileges on the table to other users. Which two privileges should be granted to the `auditor` group to meet these requirements? (Choose two.)

Accepted Answer

SELECT. To allow auditors to query the table, they need `SELECT`. To allow them to grant `SELECT` to others, they need the `GRANT` privilege on the table. These two privileges together meet the requirements without granting unnecessary permissions like `MODIFY` or `ALL PRIVILEGES`. The `GRANT` privilege is specifically designed for delegating grant authority.

Answer

MODIFY

Answer

USAGE

Answer

ALL PRIVILEGES

Question 4

A data engineer is configuring a Unity Catalog storage credential to access an AWS S3 bucket. The S3 bucket has a bucket policy that allows access only from a specific IAM role. The data engineer creates a storage credential with an IAM role ARN and then creates an external location using that storage credential. When querying a table at that external location, users receive an access denied error. The data engineer verifies that the IAM role has the correct S3 permissions and the bucket policy allows the role. What is the most likely cause of the error?

Accepted Answer

The IAM role's trust policy does not allow the Databricks AWS account to assume it, so the storage credential cannot obtain temporary credentials.. The most likely cause is that the IAM role's trust policy does not permit Databricks to assume it. Unity Catalog storage credentials rely on a trust relationship between the IAM role and Databricks' AWS account. Without a correct trust policy, the storage credential cannot obtain temporary credentials, leading to access denied errors. Verifying the trust policy is a critical step when configuring storage credentials.

Answer

The external location was created without specifying the storage credential, so Unity Catalog is using a default credential that lacks permissions.

Answer

The storage credential must be granted USAGE on the external location, but it was not, so access is denied.

Answer

The S3 bucket policy must explicitly allow the Databricks workspace IAM role, not the storage credential IAM role.

Question 5

A data engineer is setting up a new Unity Catalog metastore for an organization. The organization has multiple Databricks workspaces in different regions and wants to ensure that all workspaces can access the same Unity Catalog data and governance policies. What is the correct approach to configure the metastore?

Accepted Answer

Create one Unity Catalog metastore per region and assign it to all workspaces in that region, ensuring that workspaces in different regions use their regional metastore.. Unity Catalog metastores are regional. To support multiple workspaces across regions, you create one metastore per region and assign all workspaces in that region to it. This provides centralized governance within each region while accommodating data residency and performance needs. It is not possible to have a single global metastore or to connect workspaces to a metastore in a different region.

Answer

Create a single global Unity Catalog metastore and attach it to all workspaces regardless of region.

Answer

Create a separate Unity Catalog metastore for each workspace and replicate the data and policies manually.

Answer

Use a single workspace as the metastore host and have other workspaces connect to it via a remote connection.

Question 6

A data engineer is preparing to create an external table in Unity Catalog that points to a path in an Azure Data Lake Storage Gen2 container. The engineer will run the CREATE TABLE statement from a Databricks SQL warehouse. The storage location already contains Parquet files, and the engineer wants Unity Catalog to manage permissions on the table. What must the engineer configure first to allow Databricks to access the storage?

Accepted Answer

A storage credential in Unity Catalog that references an Azure managed identity with access to the container.. To create an external table in Unity Catalog, the engineer must first create a storage credential that encapsulates an Azure managed identity with permissions on the ADLS Gen2 container. This credential is then referenced by an external location, which grants access to the specific path. Without a storage credential, Unity Catalog cannot authenticate to the cloud storage, and the external table creation would fail.

Answer

A personal access token stored in Databricks secrets that grants access to the container.

Answer

A cluster-scoped init script that mounts the ADLS Gen2 container to DBFS.

Answer

An external location in Unity Catalog that maps to the container path.

Question 7

A data engineer needs to share a Delta table managed by Unity Catalog with external partners who do not have access to the Databricks workspace. Which feature should be used to securely grant read-only access to this table without replicating the data?

Accepted Answer

Create a Delta Sharing share, add the table to the share, and grant access to a recipient object configured for the partners.. Delta Sharing is an open protocol for secure data sharing that allows organizations to share data directly from cloud storage without copying files. Unity Catalog integrates natively with Delta Sharing, enabling governance teams to manage access for external recipients securely using tokens and activation links, making it the ideal solution for cross-organization data collaboration.

Answer

Configure cross-account IAM role assumption to grant direct AWS S3 bucket read permissions to the external partners.

Answer

Set up a Databricks SQL endpoint and create individual workspace user accounts for every external partner.

Answer

Export the Delta table to CSV format and upload the files to an external SFTP server on a nightly schedule.

Question 8

A data engineer is configuring Unity Catalog governance for a multi-department organization. Which TWO actions require the metastore admin or catalog owner to have a workspace-independent metastore assigned? (Choose TWO)

Accepted Answer

Binding a workspace to a Unity Catalog metastore to enable catalog-level data access.. A Unity Catalog metastore is the top-level container for metadata, governing three levels of namespacing (catalog, schema, table). Certain administrative tasks like assigning a metastore to workspaces or managing root storage locations require specific privileges and architectural scopes, ensuring centralized security governance across multiple workspaces.

Answer

Creating a new catalog inside the Unity Catalog metastore.

Answer

Granting the SELECT privilege on a specific schema to a group of data analysts.

Answer

Defining a custom dynamic view with column-level masking functions for auditing.

Question 9

An organization requires that all data access logs across multiple Databricks workspaces be captured and sent to a centralized security information and event management (SIEM) system. Which Databricks feature should be configured to capture these audit events?

Accepted Answer

Configure diagnostic log delivery to stream account and workspace audit logs to cloud storage or event hubs.. Databricks audit logs capture workspace-level and account-level user activities, including data access, administrative actions, and permission changes. Organizations configure audit log delivery to route these JSON event logs directly to cloud storage buckets, where SIEM tools like Splunk or Datadog can ingest and analyze them for compliance.

Answer

Enable Spark event logs in the cluster configuration UI for every running compute cluster.

Answer

Run a nightly notebook that queries the system.information schema for active user sessions.

Answer

Install a Python logging package on every cluster driver node to intercept SQL queries.

Question 10

A data engineer is migrating legacy tables to Unity Catalog. Which TWO of the following statements regarding the transition to three-level namespace (catalog.schema.table) are true?

Accepted Answer

Three-level namespace applies to all Unity Catalog objects.. Unity Catalog introduces a hierarchical namespace that forces a clear separation between data assets. Understanding this structure is critical for governance, as permissions are inherited down from the catalog and schema levels. By adopting this structure, organizations can enforce consistent policies across environments, simplify cross-workspace data sharing, and ensure that all metadata is discoverable through a centralized catalog that replaces the legacy Hive Metastore structure.

Answer

Hive Metastore objects are automatically migrated to Unity Catalog.

Answer

External locations are not required for three-level namespace tables.

Answer

Three-level namespace is optional in Unity Catalog.

Question 11

Refer to the exhibit. A data engineer attempts to run the GRANT statement above in a Databricks SQL query editor. What is the most likely reason for failure?

Accepted Answer

The table must be referenced using a three-level namespace.. The command fails because Unity Catalog requires the full three-level namespace (catalog.schema.table). Without specifying 'main.prod.sales_data', the engine cannot locate the table within the hierarchical metadata store. This strict requirement ensures that all data access is explicitly scoped, preventing ambiguity in multi-catalog or multi-schema environments, which is a fundamental tenet of Unity Catalog's governance model for enterprise-grade security and asset management.

Answer

The syntax of the GRANT statement is incorrect.

Answer

The table does not exist.

Answer

The group 'data_scientists' does not exist.

Question 12

Which feature in Unity Catalog is primarily used to track data movement and transformation history for compliance and auditing?

Accepted Answer

Data Lineage. Data lineage provides a graphical and programmatic representation of data flow from source tables to downstream targets. It is vital for governance as it allows administrators to see exactly where data came from and how it was processed. This transparency is critical for compliance audits, allowing teams to quickly identify the impact of changes or potential data leakage points within the entire data ecosystem.

Answer

Audit Logs

Answer

Delta Sharing

Answer

Catalog Explorer

Question 13

Which THREE of the following represent core security principles enforced by Unity Catalog?

Accepted Answer

Centralized access control. Unity Catalog simplifies security by moving away from cloud-specific credential management to a unified identity-based model. By centralizing access control, audit logs, and data lineage, it ensures consistent security posture across all Databricks workspaces. This consolidation reduces the complexity of managing disparate security policies, ensuring that governance is applied uniformly and that administrators can easily monitor and report on data access across the entire data estate.

Answer

Direct cloud storage access via IAM

Answer

Workspace-specific metastores

Question 14

A data engineer needs to share a subset of a table with an external partner who does not have access to the internal Databricks workspace. What is the most appropriate method to achieve this?

Accepted Answer

Use Delta Sharing to share a table.. Delta Sharing is the secure, open-standard solution for sharing data externally. It allows the recipient to access data directly from cloud storage without needing to provision an account in the provider's Databricks workspace. This process is secure because it uses short-lived tokens and does not require complex credential management, ensuring that data stays governed and that the provider retains control over what is being shared.

Answer

Create a service principal with restricted access.

Answer

Export data to CSV and email it.

Answer

Grant the partner access to a shared S3 bucket.

Question 15

Which of the following describes the correct order of operations to configure a new external location in Unity Catalog?

Accepted Answer

Create credential, create location, grant privileges.. The process begins with creating a storage credential, which holds the cloud-specific security details (like an IAM role or service account). This credential is then used to define the external location, which points to a specific path in cloud storage. Finally, you grant the user or service the 'READ FILES' or 'WRITE FILES' privilege on the external location to permit interaction with the underlying data files within the Unity Catalog framework.

Answer

Grant privileges, create location, create credential.

Answer

Create location, grant privileges, create credential.

Answer

Create credential, grant privileges, create location.