Databricks-DE-Assoc Governance and Security Practice Test 4 — 15 Questions

Question 1

A data engineer is tasked with securing sensitive PII data in Unity Catalog. Which THREE actions are recommended to ensure robust security and compliance?

Accepted Answer

Apply Dynamic Data Masking to columns containing PII.. Implementing a defense-in-depth strategy is crucial for PII. Using Unity Catalog's fine-grained access controls, dynamic masking, and audit logs provides a layered approach to security. These tools allow organizations to restrict access, obscure sensitive values, and maintain a verifiable trail of who accessed what data, which is essential for meeting regulatory requirements and minimizing the risk of unauthorized data breaches.

Answer

Grant SELECT access to all users to ensure data accessibility.

Answer

Store all PII data in the root metastore directory for easy access.

Question 2

Which identity management approach is mandatory for the implementation of Unity Catalog within a Databricks environment?

Accepted Answer

Account-level identities. Unity Catalog requires users to be managed at the account level, rather than at the individual workspace level. This synchronization ensures that permissions and identities are consistent across all workspaces in the account, which is a fundamental requirement for the unified governance model that Unity Catalog provides to the Databricks platform.

Answer

Workspace-local users

Answer

Local SQL-only credentials

Answer

Personal access tokens for every user

Question 3

A data engineering team needs to restrict access to a sensitive customer table in Unity Catalog so that junior data engineers can only view non-PII columns, while senior engineers can view all columns. Which approach should be used to implement this requirement securely and efficiently?

Accepted Answer

Define a SQL user-defined function combined with a dynamic view utilizing the IS_MEMBER function to conditionally mask sensitive columns based on the querying user's group membership.. Row and column-level security in Unity Catalog is implemented by defining SQL user-defined functions and applying dynamic views or masking policies. Creating a dynamic view using the IS_MEMBER function allows the database engine to evaluate user group membership at query execution time and conditionally mask or exclude sensitive columns without duplicating the underlying physical dataset, ensuring optimal storage and compliance.

Answer

Create separate physical copies of the customer table for junior and senior engineers, applying access control lists directly on the underlying files in cloud object storage using IAM policies.

Answer

Revoke ALL PRIVILEGES on the customer table from the junior engineers group and grant SELECT privilege only after they sign a data access request form stored in a shared workspace notebook.

Answer

Apply table ACLs directly on the raw Delta table by executing GRANT SELECT ON TABLE customer TO `junior-engineers` while writing custom Spark UDFs in every notebook to drop PII columns.

Question 4

A data engineer has a Unity Catalog table `prod.sales.orders` that contains a column `customer_email`. They need to allow analysts in the `marketing` group to query the table but only see a masked version of `customer_email` (e.g., `a***@example.com`). The masking logic is implemented as a SQL user-defined function `prod.security.mask_email`. Which statement should the engineer execute to apply the mask?

Accepted Answer

ALTER TABLE prod.sales.orders ALTER COLUMN customer_email SET MASK prod.security.mask_email;. Unity Catalog column masks are applied using ALTER TABLE ... ALTER COLUMN ... SET MASK <function>. This associates a user-defined function with the column. Users without the UNMASK privilege automatically see the function's output, while privileged users see raw data. The other options either use invalid syntax or fail to enforce masking at the column level.

Answer

CREATE VIEW prod.sales.orders_masked AS SELECT customer_email, prod.security.mask_email(customer_email) AS customer_email FROM prod.sales.orders;

Answer

ALTER TABLE prod.sales.orders SET TBLPROPERTIES ('mask.customer_email' = 'prod.security.mask_email');

Answer

GRANT SELECT ON TABLE prod.sales.orders TO `marketing` WITH MASK prod.security.mask_email ON customer_email;

Question 5

A data engineer is configuring Unity Catalog row-level security on a table `prod.finance.transactions`. They want to ensure that users in the `us_team` group can only see rows where `region = 'US'`, while users in the `eu_team` group can only see rows where `region = 'EU'`. They create a row filter function `prod.security.region_filter`. Which TWO statements accurately describe how to implement and manage this row-level security? (Choose two.)

Accepted Answer

The row filter function must accept the column(s) as parameters and return a BOOLEAN value indicating whether the row should be visible.. Row-level security in Unity Catalog is implemented by attaching a row filter function to a table using ALTER TABLE ... SET ROW FILTER. The function receives column values and returns a boolean, often using identity functions to filter based on group membership. Both managed and external tables support row filters, and bypassing them requires the BYPASS ROW FILTER privilege.

Answer

Row filters can only be applied to external tables, not managed tables, because managed tables do not support fine-grained access control.

Answer

The row filter function must be defined in the same schema as the table it protects.

Answer

Users with the MODIFY privilege on the table automatically bypass the row filter and see all rows.

Question 6

A data engineer needs to grant the `analyst` group the ability to read data from a Unity Catalog table `sales.fact_orders`. They also want to ensure that members of `analyst` can see the table in the catalog explorer but cannot modify it. Which privilege should be granted to the `analyst` group on the table?

Accepted Answer

GRANT SELECT ON TABLE sales.fact_orders TO `analyst`;. To allow read-only access to a Unity Catalog table, the SELECT privilege is granted. It permits querying and viewing metadata without modification rights. MODIFY would allow changes, ALL PRIVILEGES is excessive, and USAGE is not applicable to tables. SELECT is the least privilege that meets the requirement.

Answer

GRANT USAGE ON TABLE sales.fact_orders TO `analyst`;

Answer

GRANT MODIFY ON TABLE sales.fact_orders TO `analyst`;

Answer

GRANT ALL PRIVILEGES ON TABLE sales.fact_orders TO `analyst`;

Question 7

A data engineer stores a Delta table in Unity Catalog at the managed location of the schema 'sales'. The table is later dropped using DROP TABLE. What happens to the underlying data files?

Accepted Answer

The data files are deleted from the managed storage location.. In Unity Catalog, managed tables have their data lifecycle controlled by the metastore. When you drop a managed table, the system deletes the data files from the managed storage location. This contrasts with external tables, where the data remains in the external location. Understanding this behavior is critical for data retention and cost management, as dropping a managed table permanently removes the data.

Answer

The data files remain in the managed storage location and can be re-registered later.

Answer

The data files are deleted after the default retention period of 30 days.

Answer

The data files are moved to a recycle bin and can be restored by an account admin.

Question 8

A data engineer has configured a storage credential in Unity Catalog to access an AWS S3 bucket. The credential uses an IAM role with a trust policy that allows Databricks to assume it. The engineer now needs to ensure that only a specific set of users can create external tables pointing to that S3 bucket. Which Unity Catalog object should be used to control this access?

Accepted Answer

External location. An external location in Unity Catalog associates a cloud storage path with a storage credential. By granting privileges on the external location, administrators control which users can create external tables that reference that path. This provides the necessary granularity to restrict table creation to a specific set of users for a given S3 bucket.

Answer

Catalog

Answer

Metastore

Answer

Storage credential

Question 9

A data engineer has a Unity Catalog table named `sales.raw.orders` that contains a column `credit_card` with sensitive data. The security team requires that users in the `analyst` group see only the last four digits of the credit card number when querying this table, while all other users with appropriate privileges see the full value. The data engineer wants to implement this with minimal disruption to existing queries. Which approach should the data engineer take?

Accepted Answer

Apply a column mask function to the `credit_card` column that checks if the user is in the `analyst` group and, if so, returns only the last four digits.. Unity Catalog column masks allow dynamic data masking at query time without altering the underlying data or requiring separate views. A mask function can evaluate the current user's group memberships and return a transformed value, such as the last four digits. This meets the security requirement while preserving existing queries and access patterns.

Answer

Use a column mask function with Unity Catalog to apply row-level filtering based on the user's group membership.

Answer

Create a row filter on the table that restricts analysts to rows where the credit card number ends with certain digits, and grant them access to the table.

Answer

Create a dynamic view that applies a masking function to the `credit_card` column, and grant the `analyst` group access to the view instead of the table.

Question 10

A data engineer has a Unity Catalog table `prod.sales.orders` containing a column `customer_email`. Company policy requires that users in the `analyst_group` see only the domain part of the email (e.g., `***@example.com`), while members of `pii_admin_group` must see the full email. The engineer wants to enforce this at query time without creating separate views. Which approach should the engineer use?

Accepted Answer

Create a column mask function that returns the full email for `pii_admin_group` and a masked email otherwise, then apply it to the `customer_email` column.. Column masks in Unity Catalog let you attach a user-defined function to a specific column so that different users see different values for the same data. The function can inspect `is_account_group_member()` to return the raw email for the privileged group and a masked string for everyone else. This enforces the policy dynamically at query time and avoids creating separate views or duplicating the table.

Answer

Apply a table-level tag `pii` to `prod.sales.orders` and configure a tag-based policy that automatically masks all string columns for non-admin users.

Answer

Grant `SELECT` on `prod.sales.orders` only to `pii_admin_group` and grant `SELECT` on a view that excludes `customer_email` to `analyst_group`.

Answer

Create a row filter function that returns TRUE for `pii_admin_group` and FALSE for others, then apply it to `prod.sales.orders`.

Question 11

A data engineer is configuring a Unity Catalog storage credential to access an AWS S3 bucket. The S3 bucket policy grants access to an IAM role. The data engineer creates a storage credential with that IAM role's ARN. However, when attempting to create an external location using this storage credential, the operation fails with an error indicating insufficient permissions. The data engineer verifies that the IAM role has the correct S3 permissions. What is the most likely cause of the failure?

Accepted Answer

The IAM role's trust policy does not allow the Databricks AWS account to assume the role.. When creating a storage credential, Databricks must be able to assume the IAM role. This requires a trust relationship between the IAM role and the Databricks AWS account. Even if the role has correct S3 permissions, without a proper trust policy, Databricks cannot assume the role, causing external location creation to fail. The trust policy is a separate configuration from permissions.

Answer

The S3 bucket policy does not grant the necessary permissions to the IAM role.

Answer

The storage credential was created without the `READ FILES` privilege on the S3 bucket.

Answer

The storage credential was created without the `CREATE EXTERNAL LOCATION` privilege on the metastore.

Question 12

A data engineer needs to ensure that only members of the 'finance' group can view a specific column containing credit card numbers in a Unity Catalog table. Which feature should be used?

Accepted Answer

Column masks. Column masks are designed to control access to specific columns by applying a masking function that evaluates the user's identity or group membership. This allows sensitive data like credit card numbers to be visible only to authorized groups. Other features like row-level security or dynamic views address different aspects of data access and are not the direct solution for column-level control.

Answer

Column-level privileges with GRANT SELECT ON COLUMN

Answer

Row-level security with filter conditions

Answer

Dynamic views with CASE statements

Question 13

A data engineer is configuring a storage credential in Unity Catalog to access an AWS S3 bucket. The engineer creates an IAM role with the necessary permissions and sets up the storage credential using the role ARN. What additional step is required to allow Databricks to assume the role?

Accepted Answer

Modify the role's trust policy to allow the Databricks AWS account to assume it.. For Databricks to assume an IAM role, the role's trust policy must explicitly allow the Databricks AWS account to assume it. This is a critical step in setting up a storage credential. The trust policy defines which principals can assume the role, and without it, the assumption fails regardless of the role's permissions.

Answer

Enable AWS IAM Identity Center and configure SAML federation for the role.

Answer

Create an access key and secret key for the IAM role and store them in Databricks secrets.

Answer

Attach an IAM policy to the role that grants sts:AssumeRole to the Databricks AWS account.

Question 14

A data engineer needs to ensure that all queries against a Unity Catalog table are logged for audit purposes. The logs must include the user identity, the query text, and the timestamp. Which Databricks feature should be enabled to capture this information?

Accepted Answer

Audit logs. Audit logs are the Databricks feature designed to capture detailed activity logs, including query text, user identity, and timestamps. They are essential for security auditing and compliance. Enabling audit logs and configuring delivery to a central system meets the requirement to log all queries against Unity Catalog tables.

Answer

Query history

Answer

Unity Catalog data lineage

Answer

Delta Live Tables event log

Question 15

A data engineer is designing an access control model in Unity Catalog for a new catalog `finance`. The team wants to follow the principle of least privilege while still enabling collaboration. Which TWO of the following practices best align with Unity Catalog's privilege model? (Choose two.)

Accepted Answer

Use account-level groups as principals for grants rather than individual users, so membership changes automatically update effective permissions.. Least privilege in Unity Catalog is achieved by granting `USE CATALOG` broadly only where navigation is needed, limiting `USE SCHEMA` to required schemas, and using account-level groups as principals so membership changes propagate automatically. Broad grants such as `ALL PRIVILEGES`, `SELECT` to `public`, or `MANAGE` to large groups violate least privilege and should be avoided.

Answer

Grant `SELECT` on all tables in `finance` to the `public` group to ensure no one is blocked during onboarding.

Answer

Grant `ALL PRIVILEGES` on the `finance` catalog to the engineering group to simplify administration.

Answer

Grant `MANAGE` on the `finance` catalog to the data engineering group so they can delegate privileges to others.