Databricks-DE-Assoc Governance and Security Practice Test 3 — 15 Questions

Question 1

What is the primary role of a 'Metastore Admin' in a Databricks Unity Catalog environment?

Accepted Answer

Managing permissions and resources at the catalog level.. The Metastore Admin is the highest-level security role within the Unity Catalog architecture. They possess full control over the metastore, including the ability to grant and revoke access to all objects, create catalogs, and manage storage credentials. This role is crucial for establishing the initial governance structure and delegating permissions to lower-level administrators while maintaining ultimate authority over the organization's entire data inventory and access security policies.

Answer

Creating and managing workspace-level notebooks.

Answer

Managing users and groups in the identity provider.

Answer

Running cluster maintenance and patching.

Question 2

Refer to the exhibit. A user who is a member of 'data_analysts_group' reports they cannot see the 'orders' table in the Catalog Explorer. What is the most likely cause?

Accepted Answer

The user lacks the 'USAGE' privilege on the parent objects.. In Unity Catalog, the 'USAGE' privilege is a mandatory prerequisite for navigating any parent object. Even if the user has SELECT access on the table, they must also hold USAGE on the parent catalog and schema to traverse the hierarchy and discover the table. Without these permissions, the object remains invisible to the user in the UI, even if they have technical access to the underlying data records.

Answer

The user lacks the 'SELECT' privilege.

Answer

The table is not registered in the Hive Metastore.

Answer

The group does not exist in the workspace.

Question 3

What must be configured to allow Databricks to access cloud storage on behalf of a user without the user needing to provide their own cloud credentials?

Accepted Answer

Storage Credential. A storage credential acts as a secure wrapper around cloud-provider authentication (like an IAM role or service account). By creating a storage credential in Unity Catalog, the administrator gives Databricks the permission to access the storage. Users then interact with 'External Locations' that reference these credentials, effectively decoupling user identity from raw cloud infrastructure access, which is the cornerstone of Unity Catalog's secure data governance model.

Answer

Credential Passthrough

Answer

Table ACLs

Answer

Instance Profiles

Question 4

Which TWO of the following are benefits of using Unity Catalog over the legacy Hive Metastore?

Accepted Answer

Unified governance across all workspaces.. Unity Catalog represents a modern approach to data governance, solving the fragmentation caused by having separate metastores in every workspace. By providing a centralized, account-level view of all data, it enables enterprise-wide discovery, consistent security policies, and deep integration with lineage and audit features. This shift simplifies the data engineer's job by reducing configuration overhead while significantly improving the organization's security posture and audit readiness for compliance requirements.

Answer

Support for more SQL dialects.

Answer

Increased query performance.

Answer

Lower storage costs.

Question 5

A data engineer needs to share a table in Unity Catalog with a partner organization using a different Databricks account. Which feature should be used to provide secure access without moving the data?

Accepted Answer

Delta Sharing. Delta Sharing is the industry-standard open protocol for secure data sharing across organizational boundaries in Databricks. By utilizing Unity Catalog, Delta Sharing allows data providers to share live data directly from the storage layer without replicating files. This ensures governance, auditing, and real-time data access while maintaining strict security boundaries, which is critical for compliance and data sovereignty in modern enterprise data architectures.

Answer

Databricks File System (DBFS) mount points

Answer

Unity Catalog External Locations

Answer

Cross-account IAM Role Assumption

Question 6

Which of the following best describes the purpose of 'Credential Passthrough' in Databricks?

Accepted Answer

It enables users to access cloud storage using their own identity rather than the cluster's service principal.. Credential Passthrough allows users to authenticate to cloud storage using their own identity from the Databricks environment. By passing the user's credentials to the storage layer, Databricks ensures that the storage provider enforces access policies, creating a seamless audit trail and simplifying security management in environments that require strict alignment between user access in Databricks and direct cloud storage access.

Answer

It allows a Databricks cluster to automatically scale based on storage latency.

Answer

It encrypts data in transit between the Databricks workspace and the cloud storage.

Answer

It forces all notebook users to use a single shared service principal for security.

Question 7

Which THREE of the following are benefits of using Unity Catalog over the legacy Hive Metastore?

Accepted Answer

Support for data lineage at the column level.. Unity Catalog provides a unified, centralized governance layer that spans all workspaces, clouds, and regions. Unlike the legacy Hive Metastore, which is often siloed and lacks granular control, Unity Catalog offers robust auditing, data lineage, and simplified access management. These features are vital for modern enterprises managing complex, multi-workspace environments that require consistent security postures and comprehensive visibility into data movement and usage patterns.

Answer

Automated data replication to other cloud vendors.

Answer

Automatic hardware upgrades for all clusters.

Question 8

Refer to the exhibit. A data engineer is configuring an IAM policy for a Databricks storage credential. Which of the following is the most significant security risk in this configuration?

Accepted Answer

The policy allows access to all objects in the bucket rather than using specific prefixes.. The policy uses overly permissive resource definitions and potentially excessive actions if not scoped correctly. In production environments, adhering to the principle of least privilege is critical. Granting broad 's3:ListBucket' or 's3:GetObject' access to an entire bucket without specific prefix scoping can lead to data exfiltration risks or unauthorized access to non-production data stored in the same bucket.

Answer

The policy restricts access to only a single file.

Answer

The policy lacks an explicit 'Deny' statement for all other resources.

Answer

The policy is missing a condition to require multi-factor authentication (MFA).

Question 9

What is the primary function of an 'Access Connector' for Azure Databricks when using Unity Catalog?

Accepted Answer

It allows Databricks to access storage without managing account keys directly.. An Access Connector is a dedicated Azure resource that provides a secure, identity-based bridge between Unity Catalog and Azure Data Lake Storage (ADLS). It manages the identity used by Databricks to read and write data, ensuring that Unity Catalog can enforce access policies without requiring the storage account keys to be shared directly with users or hard-coded into notebooks.

Answer

It acts as a firewall between the Databricks workspace and the public internet.

Answer

It automatically scales the compute resources of the cluster.

Answer

It provides a user interface for browsing the storage account content.

Question 10

Which security feature should a data engineer configure to ensure that audit logs from all Databricks workspaces are captured and stored in a single, centralized location?

Accepted Answer

Diagnostic logs.. Databricks diagnostic logs are the primary mechanism for collecting security, governance, and operational audit information. By configuring diagnostic log streaming to a centralized location, such as a cloud-native log repository (e.g., Azure Log Analytics or AWS S3), organizations can perform centralized monitoring, anomaly detection, and compliance reporting across their entire Databricks estate, ensuring no audit trail is lost or siloed in individual workspaces.

Answer

Cluster event logs.

Answer

System schema (system.access).

Answer

Workspace-local storage.

Question 11

Which of the following is the best practice for managing service principals in a Databricks workspace?

Accepted Answer

Assign the service principal a dedicated identity with scoped permissions.. Service principals are non-human identities used for automated processes. The best practice is to assign them only the minimum privileges required for the task (least privilege), store their credentials in a secure secrets manager (like Databricks Secrets or Azure Key Vault), and treat them as distinct entities from human users to ensure that automated jobs are isolated and easily auditable.

Answer

Use the workspace admin's personal access token for all automated jobs.

Answer

Store service principal credentials in plaintext variables within notebook code.

Answer

Grant the service principal 'Admin' rights to avoid configuration errors.

Question 12

A data engineer needs to share a table in Unity Catalog with external partners who do not have access to the Databricks workspace. Which feature should the data engineer configure?

Accepted Answer

Create a Delta Sharing recipient and publish tables to a sharing share object.. Delta Sharing enables secure data sharing with external organizations without requiring recipients to have access to your Databricks workspace or even be on the same cloud platform. It leverages cloud object storage credentials and open protocols to ensure governed data exchange.

Answer

Configure cross-workspace table linking using standard Spark mount points.

Answer

Create a shared Unity Catalog metastore and provision external IAM database users.

Answer

Export the Delta table files to CSV format and upload them to a public cloud bucket.

Question 13

A data engineering team must implement dynamic row-level filtering on a customer analytics table in Unity Catalog so that regional analysts only view records corresponding to their assigned territory. Which TWO steps are required to achieve this using Unity Catalog features? (Choose 2)

Accepted Answer

Create a SQL user-defined function (UDF) that returns a boolean expression evaluating user identity and territory.. Implementing row-level security in Unity Catalog requires creating a SQL user-defined function that evaluates the current user's identity or group membership against a territory mapping table, and then applying that function to the target table using an ALTER TABLE command.

Answer

Modify the underlying cloud storage bucket IAM policy to restrict read access based on user session tags.

Answer

Create separate physical views for each regional analyst group and grant SELECT privileges exclusively on those views.

Answer

Configure cluster-level Spark configurations to automatically inject WHERE clauses into user queries.

Question 14

Refer to the exhibit. An organization needs to ensure that members of the 'analyst_group' can only view data where the region column equals 'US'. Based on the provided configuration, what is the best approach to implement this in Unity Catalog?

Accepted Answer

Create a Dynamic View with a WHERE clause and grant SELECT access to the view.. To implement row-level security in Databricks, developers use Dynamic Views. By defining a view that contains a filter clause, you can restrict which rows are returned to the user based on their context or group membership. This ensures that sensitive data is hidden at query time without physically duplicating data or creating multiple siloed tables for different regions.

Answer

Apply the policy directly to the table using an ALTER TABLE command.

Answer

Use the GRANT FILTER command to apply the condition to the analyst_group.

Answer

Enable Column-Level Security in the Unity Catalog metastore settings.

Question 15

Which security feature in Databricks allows administrators to mask sensitive data, such as email addresses or social security numbers, in query results based on user-defined functions?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking allows you to define a masking function that hides or transforms data based on the user's role. By applying these functions to specific columns in a view or table, sensitive information is obscured in the results returned to the user, providing an effective way to maintain compliance with data privacy regulations like GDPR or HIPAA.

Answer

Row-Level Security

Answer

Table ACLs

Answer

Workspace-level isolation