Databricks-DE-Pro Data Security and Compliance — All Questions With Answers

Question 1

Which THREE of the following are valid ways to audit data access within Databricks Unity Catalog?

Accepted Answer

Querying system tables (e.g., system.access.audit).. System tables (system.access.audit) provide a queryable interface for audit logs. Workspace-level audit logs (delivered to cloud storage) capture platform events. Account-level diagnostic logs are the primary mechanism for capturing Unity Catalog-specific events across the account. 'SHOW PERMISSIONS' is a command to view current privileges, not an audit log mechanism for historical data access.

Answer

Using the 'SHOW PERMISSIONS' SQL command.

Answer

Manually checking the user's home folder.

Question 2

An organization is auditing its Unity Catalog environment. Which THREE of the following actions require the 'Metastore Admin' role?

Accepted Answer

Creating a new catalog in the metastore.. The Metastore Admin role is responsible for managing objects within a Unity Catalog metastore, including creating catalogs, storage credentials, and external locations. However, configuring the metastore root location is an Account Admin task performed in the Account Console during metastore creation. Metastore Admins cannot change the root location of the metastore itself.

Answer

Granting SELECT access on a table.

Answer

Executing a 'REFRESH TABLE' command.

Question 3

An organization is using Databricks with Unity Catalog and needs to ensure that sensitive data remains encrypted even if the underlying cloud storage is compromised. What is the most effective solution?

Answer

Use a public IP for the workspace.

Answer

Enable Unity Catalog with masking policies.

Answer

Granting 'ALL PRIVILEGES' to the data team.

Answer

Disabling audit logs to improve performance.

Question 4

A data engineer at a healthcare company needs to configure a Unity Catalog external location so that the storage credential can be used only from a specific set of IP addresses. The company uses AWS and has a Databricks workspace with Unity Catalog enabled. Which of the following should the engineer do to meet this requirement?

Accepted Answer

Create a Unity Catalog storage credential with an IAM role that includes a condition restricting access to the specified IP addresses.. The correct approach is to create a storage credential with an IAM role that includes a condition limiting access to the specified IP addresses. This leverages AWS IAM policy conditions to enforce network restrictions at the identity level, which is the most secure and centralized method. Other options either do not exist as described or do not properly restrict the credential's usage.

Answer

Configure a Unity Catalog external location with a network policy that allows only the specified IP addresses.

Answer

Attach a cluster-scoped init script that configures iptables to block all traffic except from the specified IP addresses.

Answer

Enable Unity Catalog's IP access list feature on the metastore and add the specified IP addresses to the allow list.

Question 5

A data engineer is configuring Unity Catalog to control access to a table containing financial records. The security team requires that members of the 'finance_auditors' group can see individual transactions but cannot view the 'account_number' column, while all other columns remain accessible. The engineer creates a dynamic view that excludes the 'account_number' column and grants SELECT on the view to 'finance_auditors'. However, users in that group report they can still see the 'account_number' data when querying the underlying table directly. What is the most likely cause of this issue?

Accepted Answer

The users have been granted SELECT directly on the underlying table, allowing them to bypass the column-level restrictions enforced by the view.. To enforce column-level security with Unity Catalog, you must ensure users do not have direct access to the base table. Granting SELECT on a dynamic view alone is insufficient if users also have SELECT on the underlying table. Revoking direct table privileges forces all access through the view, where column filtering applies. This separation of privileges is critical for effective data masking.

Answer

The dynamic view was created without specifying the 'WITH GRANT OPTION', so the permissions are not cascading to the base table.

Answer

The dynamic view was not created with the SECURITY DEFINER clause, so users inherit their own permissions on the base table.

Answer

Unity Catalog does not support column-level security through views; the engineer must use attribute-based access control (ABAC) instead.

Question 6

A data engineer must grant a newly created service principal read access to a single external Delta table named `sales_raw` in Unity Catalog, without granting any other privileges on the catalog or schema. The service principal currently has no permissions. Which command should the data engineer run?

Accepted Answer

GRANT SELECT ON TABLE main.sales.sales_raw TO `sp-abc`;. Unity Catalog privileges are granted with GRANT statements that target a specific securable such as a catalog, schema, table, view, or function. To allow a service principal to read only one Delta table, the engineer must grant SELECT on that table. Broader grants at catalog or schema level, or ownership transfers, would exceed the required access and violate least privilege.

Answer

ALTER TABLE main.sales.sales_raw OWNER TO `sp-abc`;

Answer

GRANT SELECT ON CATALOG main TO `sp-abc`;

Answer

GRANT USAGE ON TABLE main.sales.sales_raw TO `sp-abc`;

Question 7

A Data Engineer at a healthcare analytics company manages a Unity Catalog table `prod.claims.phi_records` that contains protected health information. An auditor requires that any user who queries this table must first have an approved, time-bound justification recorded, and that access automatically expires after 8 hours. The engineer also wants to avoid granting permanent table privileges to the analytics group. Which Unity Catalog feature should the engineer implement?

Accepted Answer

An access request workflow using Unity Catalog privilege approvals with a time-bound grant. The requirement combines three controls: an approval with recorded justification, a time limit, and no permanent group privilege. A time-bound privilege approval workflow in Unity Catalog provides exactly these, because the grant is created only after approval and is automatically revoked at expiry, leaving an auditable record. Row filters, column masks, temporary credentials, and WITH GRANT OPTION each address a different problem and none enforces pre-access approval with automatic expiry.

Answer

A Unity Catalog temporary credential issued through a dedicated access policy

Answer

Table-level GRANT SELECT with a WITH GRANT OPTION clause

Answer

Row filter and column mask functions applied to the table

Question 8

A financial institution uses Unity Catalog and needs to ensure that all data access is logged for compliance. They want to capture both successful and failed attempts to read a specific table named 'transactions' in the 'finance' schema. The audit logs must be retained for 7 years. Which of the following should the data engineer configure to meet these requirements?

Accepted Answer

Enable audit logs in the Databricks workspace and configure delivery to an S3 bucket with a lifecycle policy for 7-year retention.. Enabling workspace audit logs and delivering them to S3 with a lifecycle policy is the correct method. Databricks audit logs include Unity Catalog access events, both successful and failed, and can be retained long-term in customer-controlled storage. Other options either do not exist, have limited retention, or do not capture the required events.

Answer

Use Unity Catalog's built-in audit logging feature and set the retention period to 7 years in the metastore settings.

Answer

Configure Databricks SQL alerts to monitor access to the 'transactions' table and log alerts to a separate system for 7 years.

Answer

Create a Delta table that captures access events by querying the system.access.audit table and set up a scheduled job to archive it for 7 years.

Question 9

A data engineer needs to ensure that a Delta table in Unity Catalog is accessible only from a specific set of IP addresses, while other tables in the same workspace remain accessible from anywhere. The workspace has Unity Catalog enabled and uses a network security perimeter. Which approach should the data engineer use?

Accepted Answer

Configure the table's external location or workspace network policy to restrict access to the specified IP addresses.. IP-based restrictions in Databricks are enforced through network controls such as workspace network policies and external location configurations within a network security perimeter, not through row filters or column masks. Row filters and column masks operate on data values and user identity, so they cannot restrict access by client IP. The correct approach applies network-level policy to the specific table's storage or workspace context.

Answer

Use a Unity Catalog storage credential with a network policy that allows only the specified IP range.

Answer

Create a Unity Catalog row filter on the table that checks the client IP address.

Answer

Apply a Unity Catalog column mask to all columns of the table.

Question 10

A data engineer must implement column-level masking on a Unity Catalog table so that only members of the group 'pii_readers' can see actual values in the 'ssn' column, while all other users see a masked value. The engineer plans to use a user-defined function (UDF) as a column mask. Which two actions are required to make the column mask effective? (Choose two.)

Accepted Answer

Create a UDF that returns the original value for members of 'pii_readers' and a masked value for others, then apply it to the 'ssn' column with ALTER TABLE ... ALTER COLUMN ... SET MASK.. Column masks in Unity Catalog are implemented by attaching a UDF to a column. The UDF must be executable by the users who query the table, so EXECUTE must be granted. Applying the mask with ALTER TABLE ... ALTER COLUMN ... SET MASK is the other required step. Together, these ensure that the mask is evaluated for every query and that unauthorized users see masked data.

Answer

Set the table property 'delta.columnMapping.mode' to 'name' to enable column masking.

Answer

Create a view that excludes the 'ssn' column and grant SELECT on the view to all users instead of the table.

Answer

Grant SELECT on the table to all users, and grant SELECT on the 'ssn' column only to 'pii_readers'.

Question 11

A data engineer is setting up a new Unity Catalog metastore for a company that must comply with GDPR. The company wants to ensure that data stored in Delta tables can be permanently deleted when a user requests erasure. Which Unity Catalog feature should the engineer use to support this requirement?

Accepted Answer

Delta Lake's DELETE operation combined with the VACUUM command and Unity Catalog's managed table deletion.. To support GDPR erasure, the engineer should use Delta Lake's DELETE and VACUUM to remove data and old files, and for managed tables, dropping the table deletes the data. This combination ensures physical deletion from the primary storage. Other features like masking or lineage do not delete data.

Answer

Unity Catalog's row-level filtering and column masking to hide personal data.

Answer

Delta Lake's DELETE operation with the VACUUM command to remove old files.

Answer

Unity Catalog's data lineage to track and then manually delete all copies of the data.

Question 12

A multinational retailer uses Unity Catalog with workspaces in three regions. A compliance rule states that customer data must remain in the region where it was collected, and that users in one region must not be able to query tables in another region's catalog. The Data Engineer needs to enforce this at the metastore level. Which Unity Catalog capability should the engineer use?

Accepted Answer

Workspace-catalog bindings that limit each workspace to catalogs in its own region. Data residency at the catalog level is enforced by binding catalogs to the workspaces in their region. A workspace can only see catalogs bound to it, so users in one region cannot query another region's catalog. Row filters, table constraints, and storage credentials operate at row, data-quality, or storage-access layers and do not prevent cross-region catalog visibility, so they cannot satisfy the residency rule.

Answer

Row filters on every table that compare the user's region to a stored region column

Answer

Delta Lake table constraints that validate a `region` column against the user's home region

Answer

Storage credentials scoped to each region's cloud storage account

Question 13

A startup uses Unity Catalog and wants to give a new data engineer the ability to create tables in the `analytics` schema, read all existing tables there, and nothing else. The security lead insists on least privilege. Which set of grants should the Data Engineer's administrator apply?

Accepted Answer

GRANT USAGE ON SCHEMA analytics, GRANT CREATE ON SCHEMA analytics, and GRANT SELECT ON SCHEMA analytics to the engineer. Reading existing tables and creating new ones in a single schema requires USAGE, CREATE, and SELECT granted on that schema. USAGE permits interaction, CREATE permits new tables, and SELECT on the schema extends read access to all tables within it. Catalog-level grants are too broad, and USAGE plus CREATE alone leaves existing tables unreadable.

Answer

GRANT ALL PRIVILEGES ON SCHEMA analytics TO the engineer

Answer

GRANT USAGE ON CATALOG and GRANT CREATE ON CATALOG to the engineer

Answer

GRANT USAGE ON SCHEMA analytics and GRANT CREATE ON SCHEMA analytics to the engineer

Question 14

A data engineer is managing a Unity Catalog metastore and needs to grant a service principal permission to create tables in a specific schema named 'sales' within the catalog 'prod'. The service principal should not have any other privileges. Which SQL statement should the engineer execute?

Accepted Answer

GRANT CREATE ON SCHEMA prod.sales TO `service-principal`;. The CREATE privilege on a schema in Unity Catalog allows a principal to create tables, views, and functions within that schema. It is the minimal privilege needed for the task. Granting USAGE alone is insufficient, and ALL PRIVILEGES is excessive. The correct syntax uses 'GRANT CREATE ON SCHEMA'.

Answer

GRANT CREATE TABLE ON SCHEMA prod.sales TO `service-principal`;

Answer

GRANT ALL PRIVILEGES ON SCHEMA prod.sales TO `service-principal`;

Answer

GRANT USAGE ON SCHEMA prod.sales TO `service-principal`;

Question 15

A Data Engineer needs to ensure that PII data in a Delta table is accessible only to members of the 'hr_admin' group, while allowing all other users to view the non-PII columns. Which Unity Catalog feature is the most efficient way to implement this requirement?

Accepted Answer

Apply a column mask using a SQL function in Unity Catalog.. Unity Catalog's row-level security and column-level masking allow for fine-grained access control directly at the table level. By defining a masking function or a column filter, the Data Engineer ensures that the security policy is enforced consistently across all SQL warehouses and Databricks Runtime versions. This approach centralizes governance, reduces administrative overhead compared to view-based security, and ensures that data privacy compliance is maintained without duplicating data or creating multiple table versions.

Answer

Create separate physical tables for HR and general users.

Answer

Use standard SQL views for every user to filter columns.

Answer

Assign the 'SELECT' permission on individual columns in the UI.

Question 16

An organization is migrating to Unity Catalog and needs to secure sensitive data. Which TWO of the following statements regarding Unity Catalog security best practices are correct?

Accepted Answer

Use groups instead of individual users for access grants.. Effective security in Unity Catalog requires a deep understanding of object ownership and the principle of least privilege. By ensuring that objects are owned by a group rather than an individual, organizations prevent access gaps when staff turnover occurs. Additionally, using service principals for automated pipelines ensures that data access is tied to the workload rather than a user, maintaining consistent security postures across environments.

Answer

Assign table ownership to individual users for better tracking.

Answer

Ensure that the metastore admin has access to all data.

Answer

Public access should be granted to the root catalog.

Question 17

A Data Engineer needs to encrypt data at rest within a Databricks workspace that uses a customer-managed key (CMK). What is the primary purpose of this configuration?

Accepted Answer

To control the lifecycle of the encryption keys used for storage.. Using a customer-managed key (CMK) provides an additional layer of security and control over data at rest in cloud storage, such as S3 or ADLS. By managing the key in the cloud provider's Key Management Service (KMS), the organization can revoke access to the data at any time by disabling the key. This is a common requirement for high-compliance industries that need verifiable control over their encrypted data.

Answer

To increase the read throughput of Delta tables.

Answer

To enable transient data encryption for cluster nodes.

Answer

To bypass the need for Unity Catalog permissions.

Question 18

An organization wants to restrict data access to only allow connections from specific corporate IP ranges. Which Databricks feature should be configured to implement this network security requirement?

Accepted Answer

IP Access Lists.. Network-level security is a cornerstone of enterprise data governance. By using IP access lists, Databricks allows administrators to define a whitelist of allowed CIDR blocks. This ensures that even if a user has valid credentials, they cannot access the Databricks workspace unless they are connecting from a trusted corporate network, effectively mitigating the risk of unauthorized access from public or malicious locations.

Answer

Unity Catalog access controls.

Answer

Cluster-level Spark configurations.

Answer

Workspace-level SSO integration.

Question 19

What is the primary function of a 'Personal Access Token' (PAT) in Databricks, and why is it considered a security risk if not managed properly?

Accepted Answer

It provides long-lived programmatic access to the API.. Personal Access Tokens (PATs) are used for programmatic access to Databricks REST APIs. They authenticate the user and inherit their permissions. The risk lies in their longevity; if an unexpired token is leaked, an attacker can impersonate the user without needing to re-authenticate via SSO. Therefore, limiting token duration and using service principals for automated tasks are crucial security measures to protect the platform.

Answer

It allows users to bypass multi-factor authentication.

Answer

It is intended for end-user dashboard access.

Answer

It encrypts data stored in the workspace.

Question 20

Which of the following describes the correct behavior of Unity Catalog's 'Data Lineage' when used for security compliance?

Accepted Answer

It captures table-to-table data dependencies.. Data Lineage in Unity Catalog automatically captures the flow of data from source to target. This is invaluable for security compliance, as it allows administrators to trace sensitive data across the environment, identify which tables are derived from PII sources, and understand the impact of modifying or deleting specific tables. By visualizing these dependencies, teams can ensure that security policies are consistently applied throughout the data lifecycle.

Answer

It shows which users accessed the data.

Answer

It manually triggers an alert when PII is detected.

Answer

It permanently stores the raw data content.

Databricks-DE-Pro Data Security and Compliance — All Questions With Answers

Which THREE of the following are valid ways to audit data access within Databricks Unity Catalog?

An organization is auditing its Unity Catalog environment. Which THREE of the following actions require the 'Metastore Admin' role?

An organization is using Databricks with Unity Catalog and needs to ensure that sensitive data remains encrypted even if the underlying cloud storage is compromised. What is the most effective solution?

A startup uses Unity Catalog and wants to give a new data engineer the ability to create tables in the `analytics` schema, read all existing tables there, and nothing else. The security lead insists on least privilege. Which set of grants should the Data Engineer's administrator apply?

A data engineer is managing a Unity Catalog metastore and needs to grant a service principal permission to create tables in a specific schema named 'sales' within the catalog 'prod'. The service principal should not have any other privileges. Which SQL statement should the engineer execute?

A Data Engineer needs to ensure that PII data in a Delta table is accessible only to members of the 'hr_admin' group, while allowing all other users to view the non-PII columns. Which Unity Catalog feature is the most efficient way to implement this requirement?

An organization is migrating to Unity Catalog and needs to secure sensitive data. Which TWO of the following statements regarding Unity Catalog security best practices are correct?

A Data Engineer needs to encrypt data at rest within a Databricks workspace that uses a customer-managed key (CMK). What is the primary purpose of this configuration?

An organization wants to restrict data access to only allow connections from specific corporate IP ranges. Which Databricks feature should be configured to implement this network security requirement?

What is the primary function of a 'Personal Access Token' (PAT) in Databricks, and why is it considered a security risk if not managed properly?

Which of the following describes the correct behavior of Unity Catalog's 'Data Lineage' when used for security compliance?

Which of the following is the most secure method for a Data Engineer to provide access to a specific Delta table for a temporary project?

Which TWO of the following are benefits of using Unity Catalog for managing data governance in a multi-workspace environment?

When migrating an existing Hive metastore to Unity Catalog, what is the most important security consideration regarding object naming?

A data engineer needs to ensure that PII data in a Delta table is accessible only to users in the 'HR_Manager' group. Which approach provides the most granular and scalable security implementation?

An organization requires that all data stored in their S3 bucket used by Databricks be encrypted using a Customer Managed Key (CMK). Which configuration must be performed to meet this requirement?

Refer to the exhibit. A data engineer executes this command in a Unity Catalog-enabled workspace. What is the immediate effect on the 'analyst_group'?

Exhibit

Which TWO of the following are primary benefits of using Unity Catalog for data governance in Databricks?

A data engineer is tasked with ensuring that sensitive information in a 'customer' table is masked for all users except the 'Data_Science' group. What is the correct Unity Catalog feature to implement?

When configuring a Service Principal to access a Unity Catalog-enabled workspace, which THREE steps are required to ensure secure and functional access?

A data engineer is setting up a new Unity Catalog metastore. What is the primary purpose of the 'Metastore Admin' role?

Refer to the exhibit. A user encounters this error when running a query. What is the correct action to resolve this issue while maintaining the security model?

Exhibit

A data engineer is configuring audit logging for a Unity Catalog-enabled workspace. The security team wants to capture all access to tables and the granting of privileges. Which Databricks feature should the engineer enable to collect these audit events?

Databricks-DE-Pro Data Security and Compliance — All Questions With Answers

Which THREE of the following are valid ways to audit data access within Databricks Unity Catalog?

An organization is auditing its Unity Catalog environment. Which THREE of the following actions require the 'Metastore Admin' role?

An organization is using Databricks with Unity Catalog and needs to ensure that sensitive data remains encrypted even if the underlying cloud storage is compromised. What is the most effective solution?

A startup uses Unity Catalog and wants to give a new data engineer the ability to create tables in the `analytics` schema, read all existing tables there, and nothing else. The security lead insists on least privilege. Which set of grants should the Data Engineer's administrator apply?

A data engineer is managing a Unity Catalog metastore and needs to grant a service principal permission to create tables in a specific schema named 'sales' within the catalog 'prod'. The service principal should not have any other privileges. Which SQL statement should the engineer execute?

A Data Engineer needs to ensure that PII data in a Delta table is accessible only to members of the 'hr_admin' group, while allowing all other users to view the non-PII columns. Which Unity Catalog feature is the most efficient way to implement this requirement?

An organization is migrating to Unity Catalog and needs to secure sensitive data. Which TWO of the following statements regarding Unity Catalog security best practices are correct?

A Data Engineer needs to encrypt data at rest within a Databricks workspace that uses a customer-managed key (CMK). What is the primary purpose of this configuration?

An organization wants to restrict data access to only allow connections from specific corporate IP ranges. Which Databricks feature should be configured to implement this network security requirement?

What is the primary function of a 'Personal Access Token' (PAT) in Databricks, and why is it considered a security risk if not managed properly?

Which of the following describes the correct behavior of Unity Catalog's 'Data Lineage' when used for security compliance?

Which of the following is the most secure method for a Data Engineer to provide access to a specific Delta table for a temporary project?

Which TWO of the following are benefits of using Unity Catalog for managing data governance in a multi-workspace environment?

When migrating an existing Hive metastore to Unity Catalog, what is the most important security consideration regarding object naming?

A data engineer needs to ensure that PII data in a Delta table is accessible only to users in the 'HR_Manager' group. Which approach provides the most granular and scalable security implementation?

An organization requires that all data stored in their S3 bucket used by Databricks be encrypted using a Customer Managed Key (CMK). Which configuration must be performed to meet this requirement?

Refer to the exhibit. A data engineer executes this command in a Unity Catalog-enabled workspace. What is the immediate effect on the 'analyst_group'?

Exhibit

Which TWO of the following are primary benefits of using Unity Catalog for data governance in Databricks?

A data engineer is tasked with ensuring that sensitive information in a 'customer' table is masked for all users except the 'Data_Science' group. What is the correct Unity Catalog feature to implement?

When configuring a Service Principal to access a Unity Catalog-enabled workspace, which THREE steps are required to ensure secure and functional access?

A data engineer is setting up a new Unity Catalog metastore. What is the primary purpose of the 'Metastore Admin' role?

Refer to the exhibit. A user encounters this error when running a query. What is the correct action to resolve this issue while maintaining the security model?

Exhibit

A data engineer is configuring audit logging for a Unity Catalog-enabled workspace. The security team wants to capture all access to tables and the granting of privileges. Which Databricks feature should the engineer enable to collect these audit events?