Databricks-DE-Pro Data Sharing and Federation — 10 Questions

Question 1

Refer to the exhibit. A Data Engineer wants to share only the North American data from the 'revenue' table with 'partner_corp'. The user observes that the recipient is still seeing all regional data. What is the cause of this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The partition filter must be applied using an 'ALTER SHARE' command.. In Unity Catalog, partition filters are applied using the 'ALTER SHARE ... ADD TABLE ... PARTITION (...)' command, not a generic 'ALTER SHARE' command. Furthermore, the exhibit (implied) likely shows a misconfiguration where the filter was not applied correctly during the ADD TABLE phase or the ALTER SHARE command was never executed. Option A is misleading because 'ALTER SHARE' alone does not apply a filter; the filter is part of the table addition/modification syntax.

Answer

The partition filter is ignored because the column is not a clustered column.

Answer

The partner organization does not support Delta Sharing partition filters.

Answer

The table must be converted to a Liquid-clustered table first.

Question 2

Refer to the exhibit. A user is attempting to access a Delta Sharing share but receives this error. What is the most likely cause?

Accepted Answer

The recipient's token has expired.. Delta Sharing tokens have an expiration period. When a token expires, the recipient can no longer authenticate with the provider's Delta Sharing server, resulting in a 401 Unauthorized error. The Data Engineer must rotate the token and provide a new credential file to the recipient. This security measure prevents long-term unauthorized access and ensures that recipients must periodically renew their access permissions to continue querying the shared datasets.

Answer

The shared table has been moved to a different metastore.

Answer

The recipient is using an outdated Delta Sharing client library.

Answer

The provider has revoked the recipient's access to the share.

Question 3

A Data Engineer is configuring a new Delta Share. Which THREE requirements must be satisfied for the recipient to access the data successfully?

Accepted Answer

The recipient must have a valid Delta Sharing credential file.. The three requirements for Delta Sharing are: 1) The provider must create a share and add tables to it (D), 2) The provider must create a recipient object and grant them access to the share (B), and 3) The recipient must use the activation link/credential file provided by the provider to authenticate (A). Option C is incorrect because Delta Sharing is an open protocol and does not require the recipient to have a Databricks account.

Answer

The recipient must be using a Databricks account.

Answer

The recipient must have the provider's private encryption keys.

Question 4

Refer to the exhibit. A Data Engineer applied these permissions, but the users in the 'data_analysts' group still cannot query the tables. What is the missing step?

Accepted Answer

GRANT USAGE ON CATALOG postgres_sales TO `data_analysts`;. In Unity Catalog, to access a table, a user needs USAGE on the Catalog, USAGE on the Schema, and SELECT on the Table. The explanation incorrectly states that USAGE on the connection is required for catalog access (connections are for Lakehouse Federation, not standard catalog access) and incorrectly claims the exhibit grants SELECT on the catalog (which is not a valid privilege for a catalog).

Answer

GRANT READ ON CONNECTION postgres_conn TO `data_analysts`;

Answer

GRANT SELECT ON SCHEMA postgres_sales TO `data_analysts`;

Answer

GRANT MODIFY ON FOREIGN CATALOG postgres_sales TO `data_analysts`;

Question 5

A Data Engineer is configuring a Databricks-to-Databricks Delta Share for a partner who uses a Unity Catalog-enabled workspace in a different Databricks account. The engineer has created the share, added the table, and granted the recipient access. The partner reports that they can see the share but cannot query the table. The engineer verifies that the recipient has been granted SELECT on the share. What is the most likely cause?

Accepted Answer

The recipient has not been granted USE on the share and SELECT on the table.. For a Databricks-to-Databricks share, the recipient must be granted USE on the share and SELECT on the table. Without USE on the share, the recipient cannot access the share at all. Without SELECT on the table, they cannot query the table. The scenario indicates the recipient can see the share but cannot query the table, pointing to missing SELECT on the table or missing USE on the share. The correct answer identifies the required privileges.

Answer

The share does not include the table's history or the recipient has not been granted SELECT on the table.

Answer

The recipient's metastore is not in the same region as the share.

Answer

The provider has not granted the recipient's Unity Catalog metastore permission to access the share.

Question 6

A data engineer at a healthcare analytics company needs to share a Delta table containing patient readmission metrics with an external research partner that uses Apache Spark on AWS. The partner does not have a Databricks account. The engineer creates a share, adds the table with a partition filter to include only records from 2023, and generates a bearer token for the recipient. After the recipient activates the token, they report they can list the shared table but cannot read any data. The engineer verifies the share is active and the recipient has been granted SELECT on the share. What is the most likely cause of the read failure?

Accepted Answer

The recipient's Spark client must be configured with the Delta Sharing protocol and the correct token to read the shared table.. Delta Sharing allows sharing with non-Databricks clients through an open protocol. The recipient must use a compatible client, such as the Delta Sharing connector for Spark, configured with the token and activation URL. Listing tables may succeed via the sharing server's REST API, but reading data requires the client to implement the Delta Sharing read protocol. Without that, reads fail despite correct share permissions.

Answer

The recipient must be granted USE SCHEMA on the schema containing the shared table.

Answer

The shared table's data files are stored in a location that the recipient cannot access.

Answer

The partition filter was applied incorrectly, excluding all rows from the shared table.

Question 7

A data engineer is configuring Lakehouse Federation to query an external MySQL database from Databricks. The engineer creates a connection and a foreign catalog. Which two statements accurately describe the behavior or requirements of this federation setup? (Choose two.)

Accepted Answer

The foreign catalog stores metadata about the external MySQL tables but does not copy the data into Databricks.. Lakehouse Federation allows querying external databases without moving data. A foreign catalog points to the external MySQL database, storing metadata but not data. Credentials are stored securely in a Unity Catalog connection object. Queries are pushed down to MySQL when possible. Write operations are not supported for MySQL federation, and performance depends on the external system.

Answer

Users must have SELECT privileges on the foreign catalog and the underlying MySQL tables to query the data.

Answer

The foreign catalog can be used to write data back to the MySQL database using INSERT, UPDATE, and DELETE statements.

Answer

Query performance is always identical to querying a native Delta table because all data is cached in Databricks.

Question 8

A Data Engineer is setting up a Delta Share to share a table with an external recipient who will use the open-source Delta Sharing client. The engineer wants to ensure the recipient can access the data securely and that the share can be revoked if needed. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Generate a bearer token for the recipient and share it securely.. To share data with an external recipient using the open-source Delta Sharing client, the provider must create a recipient object and grant SELECT on the share. The recipient also needs a bearer token to authenticate. These two actions enable access and allow revocation by removing the grant or deleting the token. Configuring a metastore or private network is not required, and audit logging is optional.

Answer

Enable audit logging on the shared table to track recipient access.

Answer

Set up a private network connection between the provider and recipient.

Answer

Configure a Unity Catalog metastore in the recipient's environment.

Question 9

A data engineer is configuring a Delta Share to include a table that contains sensitive customer data. The table has a column named 'email' that must be masked for all recipients. The engineer wants to ensure that recipients cannot see the original email values even if they query the shared table directly. Which approach should the engineer take?

Accepted Answer

Create a new table with the 'email' column hashed or redacted, and share that table instead.. Delta Sharing operates at the table level and does not apply Unity Catalog row filters or column masks. To protect sensitive columns, the data engineer must materialize a new table with the sensitive data masked or removed, and share that table. This is the only method that guarantees recipients cannot access the original values. Sharing views or relying on column masks will not work because those features are not enforced over the Delta Sharing protocol.

Answer

Use Delta Sharing's built-in column-level encryption to encrypt the 'email' column.

Answer

Create a view that masks the 'email' column and share the view instead of the table.

Answer

Apply a column mask function to the 'email' column using Unity Catalog and then share the table.

Question 10

A data engineer is configuring a Delta Sharing recipient using a bearer token. The recipient reports that they can list the shared tables but cannot read the data, receiving a '403 Forbidden' error. The engineer has verified that the recipient's token is active and the share contains the tables. What is the most likely cause of the error?

Accepted Answer

The recipient is using an expired credential file or an incorrect token in their configuration.. A 403 Forbidden on data read while metadata listing works points to an authentication problem with the recipient's token or credential file. Delta Sharing uses bearer tokens for authentication; if the token is expired or misconfigured, data access is denied. The recipient should regenerate the token and ensure the credential file is correctly updated. Other causes like IP restrictions or missing privileges are not applicable in this context.

Answer

The recipient's IP address is not included in the allowed IP ranges for the share.

Answer

The shared tables are partitioned, and the recipient is querying a partition that is not included in the share.

Answer

The recipient has not been granted the SELECT privilege on the shared tables.