Databricks-DE-Pro Data Security and Compliance — 10 Questions

Question 1

Which THREE of the following are valid ways to audit data access within Databricks Unity Catalog?

Accepted Answer

Querying system tables (e.g., system.access.audit).. System tables (system.access.audit) provide a queryable interface for audit logs. Workspace-level audit logs (delivered to cloud storage) capture platform events. Account-level diagnostic logs are the primary mechanism for capturing Unity Catalog-specific events across the account. 'SHOW PERMISSIONS' is a command to view current privileges, not an audit log mechanism for historical data access.

Answer

Using the 'SHOW PERMISSIONS' SQL command.

Answer

Manually checking the user's home folder.

Question 2

An organization is auditing its Unity Catalog environment. Which THREE of the following actions require the 'Metastore Admin' role?

Accepted Answer

Creating a new catalog in the metastore.. The Metastore Admin role is responsible for managing objects within a Unity Catalog metastore, including creating catalogs, storage credentials, and external locations. However, configuring the metastore root location is an Account Admin task performed in the Account Console during metastore creation. Metastore Admins cannot change the root location of the metastore itself.

Answer

Granting SELECT access on a table.

Answer

Executing a 'REFRESH TABLE' command.

Question 3

An organization is using Databricks with Unity Catalog and needs to ensure that sensitive data remains encrypted even if the underlying cloud storage is compromised. What is the most effective solution?

Answer

Use a public IP for the workspace.

Answer

Enable Unity Catalog with masking policies.

Answer

Granting 'ALL PRIVILEGES' to the data team.

Answer

Disabling audit logs to improve performance.

Question 4

A data engineer at a healthcare company needs to configure a Unity Catalog external location so that the storage credential can be used only from a specific set of IP addresses. The company uses AWS and has a Databricks workspace with Unity Catalog enabled. Which of the following should the engineer do to meet this requirement?

Accepted Answer

Create a Unity Catalog storage credential with an IAM role that includes a condition restricting access to the specified IP addresses.. The correct approach is to create a storage credential with an IAM role that includes a condition limiting access to the specified IP addresses. This leverages AWS IAM policy conditions to enforce network restrictions at the identity level, which is the most secure and centralized method. Other options either do not exist as described or do not properly restrict the credential's usage.

Answer

Configure a Unity Catalog external location with a network policy that allows only the specified IP addresses.

Answer

Attach a cluster-scoped init script that configures iptables to block all traffic except from the specified IP addresses.

Answer

Enable Unity Catalog's IP access list feature on the metastore and add the specified IP addresses to the allow list.

Question 5

A data engineer is configuring Unity Catalog to control access to a table containing financial records. The security team requires that members of the 'finance_auditors' group can see individual transactions but cannot view the 'account_number' column, while all other columns remain accessible. The engineer creates a dynamic view that excludes the 'account_number' column and grants SELECT on the view to 'finance_auditors'. However, users in that group report they can still see the 'account_number' data when querying the underlying table directly. What is the most likely cause of this issue?

Accepted Answer

The users have been granted SELECT directly on the underlying table, allowing them to bypass the column-level restrictions enforced by the view.. To enforce column-level security with Unity Catalog, you must ensure users do not have direct access to the base table. Granting SELECT on a dynamic view alone is insufficient if users also have SELECT on the underlying table. Revoking direct table privileges forces all access through the view, where column filtering applies. This separation of privileges is critical for effective data masking.

Answer

The dynamic view was created without specifying the 'WITH GRANT OPTION', so the permissions are not cascading to the base table.

Answer

The dynamic view was not created with the SECURITY DEFINER clause, so users inherit their own permissions on the base table.

Answer

Unity Catalog does not support column-level security through views; the engineer must use attribute-based access control (ABAC) instead.

Question 6

A data engineer must grant a newly created service principal read access to a single external Delta table named `sales_raw` in Unity Catalog, without granting any other privileges on the catalog or schema. The service principal currently has no permissions. Which command should the data engineer run?

Accepted Answer

GRANT SELECT ON TABLE main.sales.sales_raw TO `sp-abc`;. Unity Catalog privileges are granted with GRANT statements that target a specific securable such as a catalog, schema, table, view, or function. To allow a service principal to read only one Delta table, the engineer must grant SELECT on that table. Broader grants at catalog or schema level, or ownership transfers, would exceed the required access and violate least privilege.

Answer

ALTER TABLE main.sales.sales_raw OWNER TO `sp-abc`;

Answer

GRANT SELECT ON CATALOG main TO `sp-abc`;

Answer

GRANT USAGE ON TABLE main.sales.sales_raw TO `sp-abc`;

Question 7

A Data Engineer at a healthcare analytics company manages a Unity Catalog table `prod.claims.phi_records` that contains protected health information. An auditor requires that any user who queries this table must first have an approved, time-bound justification recorded, and that access automatically expires after 8 hours. The engineer also wants to avoid granting permanent table privileges to the analytics group. Which Unity Catalog feature should the engineer implement?

Accepted Answer

An access request workflow using Unity Catalog privilege approvals with a time-bound grant. The requirement combines three controls: an approval with recorded justification, a time limit, and no permanent group privilege. A time-bound privilege approval workflow in Unity Catalog provides exactly these, because the grant is created only after approval and is automatically revoked at expiry, leaving an auditable record. Row filters, column masks, temporary credentials, and WITH GRANT OPTION each address a different problem and none enforces pre-access approval with automatic expiry.

Answer

A Unity Catalog temporary credential issued through a dedicated access policy

Answer

Table-level GRANT SELECT with a WITH GRANT OPTION clause

Answer

Row filter and column mask functions applied to the table

Question 8

A financial institution uses Unity Catalog and needs to ensure that all data access is logged for compliance. They want to capture both successful and failed attempts to read a specific table named 'transactions' in the 'finance' schema. The audit logs must be retained for 7 years. Which of the following should the data engineer configure to meet these requirements?

Accepted Answer

Enable audit logs in the Databricks workspace and configure delivery to an S3 bucket with a lifecycle policy for 7-year retention.. Enabling workspace audit logs and delivering them to S3 with a lifecycle policy is the correct method. Databricks audit logs include Unity Catalog access events, both successful and failed, and can be retained long-term in customer-controlled storage. Other options either do not exist, have limited retention, or do not capture the required events.

Answer

Use Unity Catalog's built-in audit logging feature and set the retention period to 7 years in the metastore settings.

Answer

Configure Databricks SQL alerts to monitor access to the 'transactions' table and log alerts to a separate system for 7 years.

Answer

Create a Delta table that captures access events by querying the system.access.audit table and set up a scheduled job to archive it for 7 years.

Question 9

A data engineer needs to ensure that a Delta table in Unity Catalog is accessible only from a specific set of IP addresses, while other tables in the same workspace remain accessible from anywhere. The workspace has Unity Catalog enabled and uses a network security perimeter. Which approach should the data engineer use?

Accepted Answer

Configure the table's external location or workspace network policy to restrict access to the specified IP addresses.. IP-based restrictions in Databricks are enforced through network controls such as workspace network policies and external location configurations within a network security perimeter, not through row filters or column masks. Row filters and column masks operate on data values and user identity, so they cannot restrict access by client IP. The correct approach applies network-level policy to the specific table's storage or workspace context.

Answer

Use a Unity Catalog storage credential with a network policy that allows only the specified IP range.

Answer

Create a Unity Catalog row filter on the table that checks the client IP address.

Answer

Apply a Unity Catalog column mask to all columns of the table.

Question 10

A data engineer must implement column-level masking on a Unity Catalog table so that only members of the group 'pii_readers' can see actual values in the 'ssn' column, while all other users see a masked value. The engineer plans to use a user-defined function (UDF) as a column mask. Which two actions are required to make the column mask effective? (Choose two.)

Accepted Answer

Create a UDF that returns the original value for members of 'pii_readers' and a masked value for others, then apply it to the 'ssn' column with ALTER TABLE ... ALTER COLUMN ... SET MASK.. Column masks in Unity Catalog are implemented by attaching a UDF to a column. The UDF must be executable by the users who query the table, so EXECUTE must be granted. Applying the mask with ALTER TABLE ... ALTER COLUMN ... SET MASK is the other required step. Together, these ensure that the mask is evaluated for every query and that unauthorized users see masked data.

Answer

Set the table property 'delta.columnMapping.mode' to 'name' to enable column masking.

Answer

Create a view that excludes the 'ssn' column and grant SELECT on the view to all users instead of the table.

Answer

Grant SELECT on the table to all users, and grant SELECT on the 'ssn' column only to 'pii_readers'.