Databricks-DE-Pro Data Security and Compliance Practice Test 1 — 15 Questions

Question 1

Which THREE of the following are valid ways to audit data access within Databricks Unity Catalog?

Accepted Answer

Querying system tables (e.g., system.access.audit).. System tables (system.access.audit) provide a queryable interface for audit logs. Workspace-level audit logs (delivered to cloud storage) capture platform events. Account-level diagnostic logs are the primary mechanism for capturing Unity Catalog-specific events across the account. 'SHOW PERMISSIONS' is a command to view current privileges, not an audit log mechanism for historical data access.

Answer

Using the 'SHOW PERMISSIONS' SQL command.

Answer

Manually checking the user's home folder.

Question 2

An organization is auditing its Unity Catalog environment. Which THREE of the following actions require the 'Metastore Admin' role?

Accepted Answer

Creating a new catalog in the metastore.. The Metastore Admin role is responsible for managing objects within a Unity Catalog metastore, including creating catalogs, storage credentials, and external locations. However, configuring the metastore root location is an Account Admin task performed in the Account Console during metastore creation. Metastore Admins cannot change the root location of the metastore itself.

Answer

Granting SELECT access on a table.

Answer

Executing a 'REFRESH TABLE' command.

Question 3

An organization is using Databricks with Unity Catalog and needs to ensure that sensitive data remains encrypted even if the underlying cloud storage is compromised. What is the most effective solution?

Answer

Use a public IP for the workspace.

Answer

Enable Unity Catalog with masking policies.

Answer

Granting 'ALL PRIVILEGES' to the data team.

Answer

Disabling audit logs to improve performance.

Question 4

A data engineer at a healthcare company needs to configure a Unity Catalog external location so that the storage credential can be used only from a specific set of IP addresses. The company uses AWS and has a Databricks workspace with Unity Catalog enabled. Which of the following should the engineer do to meet this requirement?

Accepted Answer

Create a Unity Catalog storage credential with an IAM role that includes a condition restricting access to the specified IP addresses.. The correct approach is to create a storage credential with an IAM role that includes a condition limiting access to the specified IP addresses. This leverages AWS IAM policy conditions to enforce network restrictions at the identity level, which is the most secure and centralized method. Other options either do not exist as described or do not properly restrict the credential's usage.

Answer

Configure a Unity Catalog external location with a network policy that allows only the specified IP addresses.

Answer

Attach a cluster-scoped init script that configures iptables to block all traffic except from the specified IP addresses.

Answer

Enable Unity Catalog's IP access list feature on the metastore and add the specified IP addresses to the allow list.

Question 5

A data engineer is configuring Unity Catalog to control access to a table containing financial records. The security team requires that members of the 'finance_auditors' group can see individual transactions but cannot view the 'account_number' column, while all other columns remain accessible. The engineer creates a dynamic view that excludes the 'account_number' column and grants SELECT on the view to 'finance_auditors'. However, users in that group report they can still see the 'account_number' data when querying the underlying table directly. What is the most likely cause of this issue?

Accepted Answer

The users have been granted SELECT directly on the underlying table, allowing them to bypass the column-level restrictions enforced by the view.. To enforce column-level security with Unity Catalog, you must ensure users do not have direct access to the base table. Granting SELECT on a dynamic view alone is insufficient if users also have SELECT on the underlying table. Revoking direct table privileges forces all access through the view, where column filtering applies. This separation of privileges is critical for effective data masking.

Answer

The dynamic view was created without specifying the 'WITH GRANT OPTION', so the permissions are not cascading to the base table.

Answer

The dynamic view was not created with the SECURITY DEFINER clause, so users inherit their own permissions on the base table.

Answer

Unity Catalog does not support column-level security through views; the engineer must use attribute-based access control (ABAC) instead.

Question 6

A data engineer must grant a newly created service principal read access to a single external Delta table named `sales_raw` in Unity Catalog, without granting any other privileges on the catalog or schema. The service principal currently has no permissions. Which command should the data engineer run?

Accepted Answer

GRANT SELECT ON TABLE main.sales.sales_raw TO `sp-abc`;. Unity Catalog privileges are granted with GRANT statements that target a specific securable such as a catalog, schema, table, view, or function. To allow a service principal to read only one Delta table, the engineer must grant SELECT on that table. Broader grants at catalog or schema level, or ownership transfers, would exceed the required access and violate least privilege.

Answer

ALTER TABLE main.sales.sales_raw OWNER TO `sp-abc`;

Answer

GRANT SELECT ON CATALOG main TO `sp-abc`;

Answer

GRANT USAGE ON TABLE main.sales.sales_raw TO `sp-abc`;

Question 7

A Data Engineer at a healthcare analytics company manages a Unity Catalog table `prod.claims.phi_records` that contains protected health information. An auditor requires that any user who queries this table must first have an approved, time-bound justification recorded, and that access automatically expires after 8 hours. The engineer also wants to avoid granting permanent table privileges to the analytics group. Which Unity Catalog feature should the engineer implement?

Accepted Answer

An access request workflow using Unity Catalog privilege approvals with a time-bound grant. The requirement combines three controls: an approval with recorded justification, a time limit, and no permanent group privilege. A time-bound privilege approval workflow in Unity Catalog provides exactly these, because the grant is created only after approval and is automatically revoked at expiry, leaving an auditable record. Row filters, column masks, temporary credentials, and WITH GRANT OPTION each address a different problem and none enforces pre-access approval with automatic expiry.

Answer

A Unity Catalog temporary credential issued through a dedicated access policy

Answer

Table-level GRANT SELECT with a WITH GRANT OPTION clause

Answer

Row filter and column mask functions applied to the table

Question 8

A financial institution uses Unity Catalog and needs to ensure that all data access is logged for compliance. They want to capture both successful and failed attempts to read a specific table named 'transactions' in the 'finance' schema. The audit logs must be retained for 7 years. Which of the following should the data engineer configure to meet these requirements?

Accepted Answer

Enable audit logs in the Databricks workspace and configure delivery to an S3 bucket with a lifecycle policy for 7-year retention.. Enabling workspace audit logs and delivering them to S3 with a lifecycle policy is the correct method. Databricks audit logs include Unity Catalog access events, both successful and failed, and can be retained long-term in customer-controlled storage. Other options either do not exist, have limited retention, or do not capture the required events.

Answer

Use Unity Catalog's built-in audit logging feature and set the retention period to 7 years in the metastore settings.

Answer

Configure Databricks SQL alerts to monitor access to the 'transactions' table and log alerts to a separate system for 7 years.

Answer

Create a Delta table that captures access events by querying the system.access.audit table and set up a scheduled job to archive it for 7 years.

Question 9

A data engineer needs to ensure that a Delta table in Unity Catalog is accessible only from a specific set of IP addresses, while other tables in the same workspace remain accessible from anywhere. The workspace has Unity Catalog enabled and uses a network security perimeter. Which approach should the data engineer use?

Accepted Answer

Configure the table's external location or workspace network policy to restrict access to the specified IP addresses.. IP-based restrictions in Databricks are enforced through network controls such as workspace network policies and external location configurations within a network security perimeter, not through row filters or column masks. Row filters and column masks operate on data values and user identity, so they cannot restrict access by client IP. The correct approach applies network-level policy to the specific table's storage or workspace context.

Answer

Use a Unity Catalog storage credential with a network policy that allows only the specified IP range.

Answer

Create a Unity Catalog row filter on the table that checks the client IP address.

Answer

Apply a Unity Catalog column mask to all columns of the table.

Question 10

A data engineer must implement column-level masking on a Unity Catalog table so that only members of the group 'pii_readers' can see actual values in the 'ssn' column, while all other users see a masked value. The engineer plans to use a user-defined function (UDF) as a column mask. Which two actions are required to make the column mask effective? (Choose two.)

Accepted Answer

Create a UDF that returns the original value for members of 'pii_readers' and a masked value for others, then apply it to the 'ssn' column with ALTER TABLE ... ALTER COLUMN ... SET MASK.. Column masks in Unity Catalog are implemented by attaching a UDF to a column. The UDF must be executable by the users who query the table, so EXECUTE must be granted. Applying the mask with ALTER TABLE ... ALTER COLUMN ... SET MASK is the other required step. Together, these ensure that the mask is evaluated for every query and that unauthorized users see masked data.

Answer

Set the table property 'delta.columnMapping.mode' to 'name' to enable column masking.

Answer

Create a view that excludes the 'ssn' column and grant SELECT on the view to all users instead of the table.

Answer

Grant SELECT on the table to all users, and grant SELECT on the 'ssn' column only to 'pii_readers'.

Question 11

A data engineer is setting up a new Unity Catalog metastore for a company that must comply with GDPR. The company wants to ensure that data stored in Delta tables can be permanently deleted when a user requests erasure. Which Unity Catalog feature should the engineer use to support this requirement?

Accepted Answer

Delta Lake's DELETE operation combined with the VACUUM command and Unity Catalog's managed table deletion.. To support GDPR erasure, the engineer should use Delta Lake's DELETE and VACUUM to remove data and old files, and for managed tables, dropping the table deletes the data. This combination ensures physical deletion from the primary storage. Other features like masking or lineage do not delete data.

Answer

Unity Catalog's row-level filtering and column masking to hide personal data.

Answer

Delta Lake's DELETE operation with the VACUUM command to remove old files.

Answer

Unity Catalog's data lineage to track and then manually delete all copies of the data.

Question 12

A multinational retailer uses Unity Catalog with workspaces in three regions. A compliance rule states that customer data must remain in the region where it was collected, and that users in one region must not be able to query tables in another region's catalog. The Data Engineer needs to enforce this at the metastore level. Which Unity Catalog capability should the engineer use?

Accepted Answer

Workspace-catalog bindings that limit each workspace to catalogs in its own region. Data residency at the catalog level is enforced by binding catalogs to the workspaces in their region. A workspace can only see catalogs bound to it, so users in one region cannot query another region's catalog. Row filters, table constraints, and storage credentials operate at row, data-quality, or storage-access layers and do not prevent cross-region catalog visibility, so they cannot satisfy the residency rule.

Answer

Row filters on every table that compare the user's region to a stored region column

Answer

Delta Lake table constraints that validate a `region` column against the user's home region

Answer

Storage credentials scoped to each region's cloud storage account

Question 13

A startup uses Unity Catalog and wants to give a new data engineer the ability to create tables in the `analytics` schema, read all existing tables there, and nothing else. The security lead insists on least privilege. Which set of grants should the Data Engineer's administrator apply?

Accepted Answer

GRANT USAGE ON SCHEMA analytics, GRANT CREATE ON SCHEMA analytics, and GRANT SELECT ON SCHEMA analytics to the engineer. Reading existing tables and creating new ones in a single schema requires USAGE, CREATE, and SELECT granted on that schema. USAGE permits interaction, CREATE permits new tables, and SELECT on the schema extends read access to all tables within it. Catalog-level grants are too broad, and USAGE plus CREATE alone leaves existing tables unreadable.

Answer

GRANT ALL PRIVILEGES ON SCHEMA analytics TO the engineer

Answer

GRANT USAGE ON CATALOG and GRANT CREATE ON CATALOG to the engineer

Answer

GRANT USAGE ON SCHEMA analytics and GRANT CREATE ON SCHEMA analytics to the engineer

Question 14

A data engineer is managing a Unity Catalog metastore and needs to grant a service principal permission to create tables in a specific schema named 'sales' within the catalog 'prod'. The service principal should not have any other privileges. Which SQL statement should the engineer execute?

Accepted Answer

GRANT CREATE ON SCHEMA prod.sales TO `service-principal`;. The CREATE privilege on a schema in Unity Catalog allows a principal to create tables, views, and functions within that schema. It is the minimal privilege needed for the task. Granting USAGE alone is insufficient, and ALL PRIVILEGES is excessive. The correct syntax uses 'GRANT CREATE ON SCHEMA'.

Answer

GRANT CREATE TABLE ON SCHEMA prod.sales TO `service-principal`;

Answer

GRANT ALL PRIVILEGES ON SCHEMA prod.sales TO `service-principal`;

Answer

GRANT USAGE ON SCHEMA prod.sales TO `service-principal`;

Question 15

A Data Engineer needs to ensure that PII data in a Delta table is accessible only to members of the 'hr_admin' group, while allowing all other users to view the non-PII columns. Which Unity Catalog feature is the most efficient way to implement this requirement?

Accepted Answer

Apply a column mask using a SQL function in Unity Catalog.. Unity Catalog's row-level security and column-level masking allow for fine-grained access control directly at the table level. By defining a masking function or a column filter, the Data Engineer ensures that the security policy is enforced consistently across all SQL warehouses and Databricks Runtime versions. This approach centralizes governance, reduces administrative overhead compared to view-based security, and ensures that data privacy compliance is maintained without duplicating data or creating multiple table versions.

Answer

Create separate physical tables for HR and general users.

Answer

Use standard SQL views for every user to filter columns.

Answer

Assign the 'SELECT' permission on individual columns in the UI.