Databricks-DE-Assoc Governance and Security — Timed 15 Questions

Question 1

An enterprise data governance team needs to ensure that junior data analysts can view customer transaction records, but their view must automatically mask the primary credit card number column. Which Unity Catalog feature accomplishes this requirement?

15 minute time limit — choose an answer to begin.

Accepted Answer

Row filters and column masks using SQL user-defined functions applied via ALTER TABLE statements.. In Unity Catalog, column masking is implemented using the 'MASK' clause within a 'CREATE VIEW' statement or an 'ALTER TABLE' statement, typically referencing a SQL UDF. The explanation correctly identifies the use of SQL UDFs and ALTER TABLE, but the phrasing 'Row filters and column masks using SQL user-defined functions applied via ALTER TABLE statements' is the standard way to describe this feature in Unity Catalog.

Answer

Table ACLs configured via legacy GRANT commands on Hive metastore tables.

Answer

Dynamic view creation combined with SQL conditional functions like CASE WHEN.

Answer

Cluster-level Spark configuration properties that filter DataFrame schema definitions at runtime.

Question 2

Which TWO of the following statements accurately describe the behavior and characteristics of managed tables versus external tables in Unity Catalog? (Choose TWO)

Accepted Answer

Dropping a Unity Catalog managed table deletes both its metadata from the metastore and its underlying data files from cloud storage.. Managed tables and external tables in Unity Catalog both provide ACID transactions and Delta Lake optimizations, but they differ significantly in storage lifecycle management. Managed tables store data in the metastore's root storage container and have their underlying files automatically deleted when dropped, whereas external tables point to custom cloud storage locations where files remain intact upon dropping.

Answer

Managed tables do not support Delta Lake ACID transaction guarantees, unlike external tables.

Answer

Dropping a Unity Catalog external table removes the underlying data files from cloud storage immediately.

Answer

External tables can only be queried by users who possess metastore admin privileges across all workspaces.

Question 3

A data engineer needs to ensure that PII data in a 'users' table is masked for all users except those in the 'HR' group. Which Unity Catalog feature should be used to implement this requirement?

Answer

Table Access Control Lists (ACLs)

Answer

Unity Catalog Dynamic Views

Answer

Row-level filtering only

Answer

Credential passthrough

Question 4

Which TWO of the following are true regarding the use of Personal Access Tokens (PATs) versus Service Principals for automated jobs in Unity Catalog?

Accepted Answer

Service principals are independent of individual user accounts.. Service Principals are independent of individual user accounts, which prevents service disruption when employees leave. Additionally, they do not require a standard interactive Databricks user license for API/automated job access. PATs are tied to users, making them a security risk upon offboarding and harder to audit globally compared to centralized service principals.

Answer

PATs are recommended for production job automation.

Answer

PATs have higher security than service principals.

Answer

PATs are easier to audit than service principals.

Question 5

If an organization wants to ensure that no data can be accessed unless it is explicitly granted, which Unity Catalog setting should be enforced?

Accepted Answer

Enable Unity Catalog for all workspaces.. Unity Catalog enforces a 'deny-by-default' security model by design once a workspace is enabled for Unity Catalog. There is no specific setting called 'Enable Unity Catalog for all workspaces' that acts as a toggle for this behavior; rather, it is the default state of the Unity Catalog metastore. The question is poorly phrased as it implies a configuration setting that doesn't exist in the Databricks documentation.

Answer

Enable external locations.

Answer

Use the 'Account Admin' role.

Answer

Define a default catalog.

Question 6

Refer to the exhibit. What is the final effective permission for 'data_scientists' on the 'sensitive_data' table?

Accepted Answer

SELECT access is granted.. Unity Catalog permissions are not determined by the 'most recent command' in a sequence. Unity Catalog uses an additive model where GRANTs are cumulative. If a user or group is granted a permission, it remains in effect unless explicitly revoked. The explanation incorrectly suggests that Unity Catalog behaves like a sequential script where the last command overwrites previous ones, which is factually incorrect for Unity Catalog's access control model.

Answer

SELECT access is denied.

Answer

The permission is in an inconsistent state.

Answer

The grant fails due to a conflict.

Question 7

A data engineer is configuring Unity Catalog access control. Which TWO of the following statements accurately describe how privileges are inherited or applied in the hierarchy?

Accepted Answer

Privileges granted at the Catalog level are inherited by all schemas and tables contained within that catalog.. Option A and B are correct. Option C is incorrect because inheritance flows downward (parent to child), not upward. Option D is incorrect because a user only needs the 'USE CATALOG' and 'USE SCHEMA' privileges along with 'CREATE TABLE' to create a table; ownership is not required. Option E is incorrect because Unity Catalog is enforced across all compute types, including notebooks.

Answer

Access rights at the table level can be inherited by the parent schema.

Answer

Users must have the OWNERSHIP privilege on a catalog to create new tables within it.

Answer

Privileges are limited to Databricks SQL and cannot be enforced in notebooks.

Question 8

Refer to the exhibit. A data engineer executes the provided commands. However, users in the 'data-analyst-group' report they still cannot query the 'main.sales.sales_data' table. What is the most likely cause?

Accepted Answer

The command 'GRANT USE CATALOG' must be granted before the schema or table privileges.. In Unity Catalog, privileges are not order-dependent; they are additive. The 'USE CATALOG' (or USAGE) privilege is required, but it does not need to be granted 'before' other privileges. The issue is simply that the 'USE CATALOG' privilege is missing entirely, not that the sequence of execution was incorrect.

Answer

The users lack the SELECT privilege on the 'main' catalog.

Answer

The users require the 'BROWSE' privilege on the catalog.

Answer

The table 'sales_data' must have its owner changed to the 'data-analyst-group'.

Question 9

Refer to the exhibit. A data engineer runs the SQL commands shown to grant table access to a group in Unity Catalog. However, members of the `finance-team` group still encounter a permission denied error when attempting to query the table. What is missing?

Accepted Answer

The group needs the MODIFY privilege granted on the target table to execute read queries.. In Unity Catalog, granting table access requires a hierarchy of privileges. Specifically, the principal must be granted the USAGE privilege on the parent catalog and parent schema, as well as the SELECT privilege on the target table. Without these specific privileges, users will encounter permission denied errors when trying to query the table.

Answer

The group needs the BIND_EXTERNAL_DIRECTORIES privilege on the catalog.

Answer

The group needs the EXECUTE privilege on the parent schema to run SQL queries.

Answer

The SQL commands are correct, but the user group may not have been assigned the appropriate workspace entitlement to access the workspace.

Question 10

A data engineer needs to grant a user permission to query a specific table in Unity Catalog without allowing them to view the underlying data definition or metadata of the schema. Which command should the engineer execute?

Accepted Answer

GRANT SELECT ON TABLE my_table TO user@example.com. While GRANT SELECT on the table is the correct command to allow querying, the explanation incorrectly states that the user does not need schema/catalog metadata permissions. In Unity Catalog, a user MUST have USE CATALOG and USE SCHEMA privileges to access any object within those containers, even if they have SELECT on the table. The explanation implies that table-level SELECT bypasses the need for parent-level metadata access, which is false.

Answer

GRANT SELECT ON SCHEMA my_schema TO user@example.com

Answer

GRANT ALL PRIVILEGES ON TABLE my_table TO user@example.com

Answer

GRANT USAGE ON TABLE my_table TO user@example.com

Question 11

A Databricks administrator is configuring access control for a workspace. Which TWO statements accurately describe the behavior of Unity Catalog's security model?

Accepted Answer

The Metastore is the top-level container for all data objects.. Unity Catalog supports both account-level groups and workspace-local groups. While account-level groups are recommended for cross-workspace consistency, workspace-local groups can indeed be used to manage permissions within Unity Catalog.

Answer

Unity Catalog privileges are subtractive by default.

Answer

Permissions granted at the table level can be overridden by schema-level DENY rules.

Question 12

Refer to the exhibit. A user is attempting to query a table located in the 'finance' catalog but receives the provided error. What is the minimum permission required to resolve this issue?

Accepted Answer

GRANT USE CATALOG ON CATALOG finance TO user@example.com. To access a table in Unity Catalog, a user requires three levels of permissions: USE CATALOG on the catalog, USE SCHEMA on the schema, and SELECT on the table. The explanation mentions USE CATALOG and USE SCHEMA but fails to mention that SELECT on the table is also required to actually query the data, making the 'minimum permission' claim in the stem slightly ambiguous if interpreted as the *only* permission needed.

Answer

GRANT SELECT ON CATALOG finance TO user@example.com

Answer

GRANT USAGE ON CATALOG finance TO user@example.com

Answer

GRANT OWNER TO user@example.com ON CATALOG finance

Question 13

A data engineer needs to grant a group of data analysts read-only access to a specific schema named `finance_analytics` within Unity Catalog. Which SQL command correctly grants the required privileges according to Unity Catalog security standards?

Accepted Answer

GRANT USE SCHEMA, SELECT ON SCHEMA finance_analytics TO `data-analysts`;. To grant read-only access to a schema in Unity Catalog, the user needs USE SCHEMA and SELECT privileges on the schema. Option D is syntactically incorrect because 'USE SCHEMA' is not a privilege that can be granted on a schema object itself; rather, 'USE SCHEMA' is a privilege granted on the schema to allow access to its contents. The correct command is 'GRANT USE SCHEMA, SELECT ON SCHEMA finance_analytics TO `data-analysts`'. Since the prompt implies D is the intended answer but marks it wrong, the options need to be corrected.

Answer

GRANT ALL PRIVILEGES ON SCHEMA finance_analytics TO `data-analysts`;

Answer

GRANT USAGE ON SCHEMA finance_analytics TO `data-analysts`;

Answer

GRANT SELECT ON SCHEMA finance_analytics TO `data-analysts`;

Question 14

A data engineer wants to grant a group 'analysts' the ability to read all current and future tables in the schema 'sales' without granting access to other schemas in the same catalog. Which SQL statement should be used?

Accepted Answer

GRANT SELECT ON SCHEMA sales TO analysts;. Granting SELECT at the schema level is the correct approach to provide read access to all current and future tables within that schema. This ensures the group can query any table in the 'sales' schema without needing separate grants for each table. It also avoids granting broader access to the entire catalog, adhering to the principle of least privilege.

Answer

GRANT SELECT ON CATALOG sales TO analysts;

Answer

GRANT USAGE ON SCHEMA sales TO analysts;

Answer

GRANT SELECT ON TABLE sales.* TO analysts;

Question 15

A data engineer is designing a Unity Catalog hierarchy for a new project. The project requires that data analysts can query tables in the `finance` schema but must not be able to see or query tables in the `hr` schema. Both schemas are in the same catalog `prod`. Which two privileges should be granted to the data analysts to achieve this? (Choose two.)

Accepted Answer

GRANT USE SCHEMA ON SCHEMA prod.finance TO `data_analysts`;. To allow data analysts to query tables in the `finance` schema while preventing access to `hr`, you must grant USE CATALOG on `prod` to enable access to the catalog, and USE SCHEMA on `finance` to allow interaction with that schema. Additionally, SELECT privileges on the tables or schema `finance` would be needed, but the question asks for two privileges; these two are the minimal required to establish access without granting any rights on `hr`.

Answer

GRANT SELECT ON SCHEMA prod.hr TO `data_analysts`;

Answer

GRANT USE SCHEMA ON SCHEMA prod.hr TO `data_analysts`;

Answer

GRANT SELECT ON CATALOG prod TO `data_analysts`;