Databricks-DE-Pro Data Security and Compliance Practice Test 2 — 15 Questions

Question 1

An organization is migrating to Unity Catalog and needs to secure sensitive data. Which TWO of the following statements regarding Unity Catalog security best practices are correct?

Accepted Answer

Use groups instead of individual users for access grants.. Effective security in Unity Catalog requires a deep understanding of object ownership and the principle of least privilege. By ensuring that objects are owned by a group rather than an individual, organizations prevent access gaps when staff turnover occurs. Additionally, using service principals for automated pipelines ensures that data access is tied to the workload rather than a user, maintaining consistent security postures across environments.

Answer

Assign table ownership to individual users for better tracking.

Answer

Ensure that the metastore admin has access to all data.

Answer

Public access should be granted to the root catalog.

Question 2

A Data Engineer needs to encrypt data at rest within a Databricks workspace that uses a customer-managed key (CMK). What is the primary purpose of this configuration?

Accepted Answer

To control the lifecycle of the encryption keys used for storage.. Using a customer-managed key (CMK) provides an additional layer of security and control over data at rest in cloud storage, such as S3 or ADLS. By managing the key in the cloud provider's Key Management Service (KMS), the organization can revoke access to the data at any time by disabling the key. This is a common requirement for high-compliance industries that need verifiable control over their encrypted data.

Answer

To increase the read throughput of Delta tables.

Answer

To enable transient data encryption for cluster nodes.

Answer

To bypass the need for Unity Catalog permissions.

Question 3

An organization wants to restrict data access to only allow connections from specific corporate IP ranges. Which Databricks feature should be configured to implement this network security requirement?

Accepted Answer

IP Access Lists.. Network-level security is a cornerstone of enterprise data governance. By using IP access lists, Databricks allows administrators to define a whitelist of allowed CIDR blocks. This ensures that even if a user has valid credentials, they cannot access the Databricks workspace unless they are connecting from a trusted corporate network, effectively mitigating the risk of unauthorized access from public or malicious locations.

Answer

Unity Catalog access controls.

Answer

Cluster-level Spark configurations.

Answer

Workspace-level SSO integration.

Question 4

What is the primary function of a 'Personal Access Token' (PAT) in Databricks, and why is it considered a security risk if not managed properly?

Accepted Answer

It provides long-lived programmatic access to the API.. Personal Access Tokens (PATs) are used for programmatic access to Databricks REST APIs. They authenticate the user and inherit their permissions. The risk lies in their longevity; if an unexpired token is leaked, an attacker can impersonate the user without needing to re-authenticate via SSO. Therefore, limiting token duration and using service principals for automated tasks are crucial security measures to protect the platform.

Answer

It allows users to bypass multi-factor authentication.

Answer

It is intended for end-user dashboard access.

Answer

It encrypts data stored in the workspace.

Question 5

Which of the following describes the correct behavior of Unity Catalog's 'Data Lineage' when used for security compliance?

Accepted Answer

It captures table-to-table data dependencies.. Data Lineage in Unity Catalog automatically captures the flow of data from source to target. This is invaluable for security compliance, as it allows administrators to trace sensitive data across the environment, identify which tables are derived from PII sources, and understand the impact of modifying or deleting specific tables. By visualizing these dependencies, teams can ensure that security policies are consistently applied throughout the data lifecycle.

Answer

It shows which users accessed the data.

Answer

It manually triggers an alert when PII is detected.

Answer

It permanently stores the raw data content.

Question 6

Which of the following is the most secure method for a Data Engineer to provide access to a specific Delta table for a temporary project?

Accepted Answer

Adding the user to a temporary Unity Catalog group.. Granting temporary access should be done using time-bound permissions or dedicated temporary groups. In Unity Catalog, the best approach is to manage access through a group and remove the user from that group when the project concludes. This ensures a clean, auditable, and repeatable process for managing temporary access requests, which is essential for maintaining a secure environment and avoiding the 'permission creep' that happens when users retain access indefinitely.

Answer

Granting ownership of the table to the user.

Answer

Sharing the credentials of a Service Principal.

Answer

Creating a copy of the table for the user.

Question 7

Which TWO of the following are benefits of using Unity Catalog for managing data governance in a multi-workspace environment?

Accepted Answer

Centralized access control across all workspaces.. Unity Catalog provides a unified, centralized governance layer that spans all workspaces in a Databricks account. This eliminates the need for siloed management, ensuring that users have consistent access rights, audit trails, and data discovery across the entire organization. By streamlining these processes, Unity Catalog simplifies compliance and improves collaboration while maintaining strict control over who can access which data objects across the enterprise.

Answer

Workspaces can have independent, non-overlapping governance.

Answer

Increased performance for all SQL queries.

Answer

Automatic data encryption at the application level.

Question 8

When migrating an existing Hive metastore to Unity Catalog, what is the most important security consideration regarding object naming?

Accepted Answer

The object names must fit the catalog.schema.table structure.. In Unity Catalog, the three-level namespace (catalog.schema.table) is mandatory. Existing Hive metastore objects often lack this structure and may contain characters or naming patterns that are incompatible with Unity Catalog's standards. Ensuring a clean naming convention during migration is not just a structural requirement; it is a security necessity to ensure that existing access policies can be correctly migrated and enforced in the new, more rigorous governance environment.

Answer

Table names must be all uppercase.

Answer

Legacy object owners must be deleted.

Answer

All tables must be converted to Parquet.

Question 9

A data engineer needs to ensure that PII data in a Delta table is accessible only to users in the 'HR_Manager' group. Which approach provides the most granular and scalable security implementation?

Accepted Answer

Apply a row filter function to the table using Unity Catalog.. Using Unity Catalog's Row-Level Security (RLS) via SQL functions is the standard best practice. It dynamically filters rows at query time based on the execution context, such as the current user's group membership. This approach avoids duplicating data into siloed tables, minimizes maintenance overhead, and ensures consistent enforcement across different BI tools and compute resources connecting to the same catalog.

Answer

Create separate views for each group and grant access to those views.

Answer

Implement column-level masking on the PII column.

Answer

Use data partitioning to store HR data in separate folders.

Question 10

An organization requires that all data stored in their S3 bucket used by Databricks be encrypted using a Customer Managed Key (CMK). Which configuration must be performed to meet this requirement?

Accepted Answer

Configure the workspace to use a Customer Managed Key for DBFS root.. When using Customer Managed Keys (CMK) for storage encryption, the Databricks environment must be configured with the appropriate IAM policies and KMS key grants. This ensures that the Databricks compute resources have the necessary permissions to perform cryptographic operations. Configuring this correctly at the storage and workspace level is essential for compliance with data protection standards like HIPAA or GDPR.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3).

Answer

Set the encryption policy in the Spark configuration of every cluster.

Answer

Apply an IAM role to the storage bucket that restricts access to the root user.

Question 11

Refer to the exhibit. A data engineer executes this command in a Unity Catalog-enabled workspace. What is the immediate effect on the 'analyst_group'?

Accepted Answer

The group gains permission to read data but not to modify table metadata.. The command grants 'SELECT' privileges on the 'orders' table to the 'analyst_group' within the 'sales' schema of the 'main' catalog. This is a standard Unity Catalog operation that enables users within the group to query the table. Understanding these permissions is vital for auditors and engineers managing data access lifecycle, ensuring only authorized groups can read sensitive business records.

Answer

The group gains ownership of the table, allowing them to drop it.

Answer

The command fails because 'main.sales.orders' is not a fully qualified name.

Answer

The group gains access to both the data and the underlying S3 files directly.

Question 12

Which TWO of the following are primary benefits of using Unity Catalog for data governance in Databricks?

Accepted Answer

It provides a centralized interface for managing permissions across multiple workspaces.. Unity Catalog provides a unified governance layer that simplifies security across different workspaces. Its primary value lies in centralized access control and a unified auditing capability. By providing a single source of truth for permissions and data lineage, it significantly reduces the complexity of managing large-scale data environments while ensuring compliance with internal security policies and regulatory frameworks.

Answer

It automatically encrypts all data files at rest using AES-256.

Answer

It allows users to bypass Spark SQL for direct file-system operations.

Answer

It replaces the need for IAM roles when accessing external data.

Question 13

A data engineer is tasked with ensuring that sensitive information in a 'customer' table is masked for all users except the 'Data_Science' group. What is the correct Unity Catalog feature to implement?

Accepted Answer

Apply a masking policy using a SQL function to the table column.. Dynamic data masking in Unity Catalog allows for the creation of masking functions that return obfuscated values based on the current user's role. By assigning these functions to columns, administrators ensure that sensitive data is protected while remaining available for authorized users. This approach is highly effective for maintaining data usability without compromising the security of PII.

Answer

Create a view that performs a CASE statement to mask the column.

Answer

Use the 'DROP COLUMN' command to remove sensitive columns.

Answer

Encrypt the column using an external library before writing to Delta.

Question 14

When configuring a Service Principal to access a Unity Catalog-enabled workspace, which THREE steps are required to ensure secure and functional access?

Accepted Answer

Create the Service Principal in the cloud provider's IAM.. Service Principals are the recommended way to automate CI/CD and production jobs. Configuring them correctly involves provisioning the identity in the cloud provider, syncing it with the Databricks account, and granting specific permissions on the data objects. This lifecycle management is critical for operational security and ensuring that automated processes have the least privilege required to function correctly in a production environment.

Answer

Assign the Service Principal the 'Owner' role on the entire workspace.

Answer

Enable multi-factor authentication (MFA) for the Service Principal.

Question 15

A data engineer is setting up a new Unity Catalog metastore. What is the primary purpose of the 'Metastore Admin' role?

Accepted Answer

To define the root storage location and manage top-level catalogs.. The Metastore Admin is the highest-privilege role in Unity Catalog, responsible for the initial configuration and top-level governance settings. This role is essential for establishing the security foundation of the platform, including catalog creation and cross-workspace access control. Proper management of this role is critical to prevent privilege escalation and ensure that only authorized personnel can define the organization's overall data governance strategy.

Answer

To create and manage compute clusters for all users.

Answer

To monitor and respond to daily system health alerts.

Answer

To approve all requests for new user sign-ups.