Databricks-DE-Pro Data Sharing and Federation — Timed 15 Questions

Question 1

Refer to the exhibit. A Data Engineer wants to share only the North American data from the 'revenue' table with 'partner_corp'. The user observes that the recipient is still seeing all regional data. What is the cause of this behavior?

15 minute time limit — choose an answer to begin.

Accepted Answer

The partition filter must be applied using an 'ALTER SHARE' command.. In Unity Catalog, partition filters are applied using the 'ALTER SHARE ... ADD TABLE ... PARTITION (...)' command, not a generic 'ALTER SHARE' command. Furthermore, the exhibit (implied) likely shows a misconfiguration where the filter was not applied correctly during the ADD TABLE phase or the ALTER SHARE command was never executed. Option A is misleading because 'ALTER SHARE' alone does not apply a filter; the filter is part of the table addition/modification syntax.

Answer

The partition filter is ignored because the column is not a clustered column.

Answer

The partner organization does not support Delta Sharing partition filters.

Answer

The table must be converted to a Liquid-clustered table first.

Question 2

Refer to the exhibit. A user is attempting to access a Delta Sharing share but receives this error. What is the most likely cause?

Accepted Answer

The recipient's token has expired.. Delta Sharing tokens have an expiration period. When a token expires, the recipient can no longer authenticate with the provider's Delta Sharing server, resulting in a 401 Unauthorized error. The Data Engineer must rotate the token and provide a new credential file to the recipient. This security measure prevents long-term unauthorized access and ensures that recipients must periodically renew their access permissions to continue querying the shared datasets.

Answer

The shared table has been moved to a different metastore.

Answer

The recipient is using an outdated Delta Sharing client library.

Answer

The provider has revoked the recipient's access to the share.

Question 3

A Data Engineer is configuring a new Delta Share. Which THREE requirements must be satisfied for the recipient to access the data successfully?

Accepted Answer

The recipient must have a valid Delta Sharing credential file.. The three requirements for Delta Sharing are: 1) The provider must create a share and add tables to it (D), 2) The provider must create a recipient object and grant them access to the share (B), and 3) The recipient must use the activation link/credential file provided by the provider to authenticate (A). Option C is incorrect because Delta Sharing is an open protocol and does not require the recipient to have a Databricks account.

Answer

The recipient must be using a Databricks account.

Answer

The recipient must have the provider's private encryption keys.

Question 4

Refer to the exhibit. A Data Engineer applied these permissions, but the users in the 'data_analysts' group still cannot query the tables. What is the missing step?

Accepted Answer

GRANT USAGE ON CATALOG postgres_sales TO `data_analysts`;. In Unity Catalog, to access a table, a user needs USAGE on the Catalog, USAGE on the Schema, and SELECT on the Table. The explanation incorrectly states that USAGE on the connection is required for catalog access (connections are for Lakehouse Federation, not standard catalog access) and incorrectly claims the exhibit grants SELECT on the catalog (which is not a valid privilege for a catalog).

Answer

GRANT READ ON CONNECTION postgres_conn TO `data_analysts`;

Answer

GRANT SELECT ON SCHEMA postgres_sales TO `data_analysts`;

Answer

GRANT MODIFY ON FOREIGN CATALOG postgres_sales TO `data_analysts`;

Question 5

A Data Engineer is configuring a Databricks-to-Databricks Delta Share for a partner who uses a Unity Catalog-enabled workspace in a different Databricks account. The engineer has created the share, added the table, and granted the recipient access. The partner reports that they can see the share but cannot query the table. The engineer verifies that the recipient has been granted SELECT on the share. What is the most likely cause?

Accepted Answer

The recipient has not been granted USE on the share and SELECT on the table.. For a Databricks-to-Databricks share, the recipient must be granted USE on the share and SELECT on the table. Without USE on the share, the recipient cannot access the share at all. Without SELECT on the table, they cannot query the table. The scenario indicates the recipient can see the share but cannot query the table, pointing to missing SELECT on the table or missing USE on the share. The correct answer identifies the required privileges.

Answer

The share does not include the table's history or the recipient has not been granted SELECT on the table.

Answer

The recipient's metastore is not in the same region as the share.

Answer

The provider has not granted the recipient's Unity Catalog metastore permission to access the share.

Question 6

A data engineer at a healthcare analytics company needs to share a Delta table containing patient readmission metrics with an external research partner that uses Apache Spark on AWS. The partner does not have a Databricks account. The engineer creates a share, adds the table with a partition filter to include only records from 2023, and generates a bearer token for the recipient. After the recipient activates the token, they report they can list the shared table but cannot read any data. The engineer verifies the share is active and the recipient has been granted SELECT on the share. What is the most likely cause of the read failure?

Accepted Answer

The recipient's Spark client must be configured with the Delta Sharing protocol and the correct token to read the shared table.. Delta Sharing allows sharing with non-Databricks clients through an open protocol. The recipient must use a compatible client, such as the Delta Sharing connector for Spark, configured with the token and activation URL. Listing tables may succeed via the sharing server's REST API, but reading data requires the client to implement the Delta Sharing read protocol. Without that, reads fail despite correct share permissions.

Answer

The recipient must be granted USE SCHEMA on the schema containing the shared table.

Answer

The shared table's data files are stored in a location that the recipient cannot access.

Answer

The partition filter was applied incorrectly, excluding all rows from the shared table.

Question 7

A data engineer is configuring Lakehouse Federation to query an external MySQL database from Databricks. The engineer creates a connection and a foreign catalog. Which two statements accurately describe the behavior or requirements of this federation setup? (Choose two.)

Accepted Answer

The foreign catalog stores metadata about the external MySQL tables but does not copy the data into Databricks.. Lakehouse Federation allows querying external databases without moving data. A foreign catalog points to the external MySQL database, storing metadata but not data. Credentials are stored securely in a Unity Catalog connection object. Queries are pushed down to MySQL when possible. Write operations are not supported for MySQL federation, and performance depends on the external system.

Answer

Users must have SELECT privileges on the foreign catalog and the underlying MySQL tables to query the data.

Answer

The foreign catalog can be used to write data back to the MySQL database using INSERT, UPDATE, and DELETE statements.

Answer

Query performance is always identical to querying a native Delta table because all data is cached in Databricks.

Question 8

A Data Engineer is setting up a Delta Share to share a table with an external recipient who will use the open-source Delta Sharing client. The engineer wants to ensure the recipient can access the data securely and that the share can be revoked if needed. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Generate a bearer token for the recipient and share it securely.. To share data with an external recipient using the open-source Delta Sharing client, the provider must create a recipient object and grant SELECT on the share. The recipient also needs a bearer token to authenticate. These two actions enable access and allow revocation by removing the grant or deleting the token. Configuring a metastore or private network is not required, and audit logging is optional.

Answer

Enable audit logging on the shared table to track recipient access.

Answer

Set up a private network connection between the provider and recipient.

Answer

Configure a Unity Catalog metastore in the recipient's environment.

Question 9

A data engineer is configuring a Delta Share to include a table that contains sensitive customer data. The table has a column named 'email' that must be masked for all recipients. The engineer wants to ensure that recipients cannot see the original email values even if they query the shared table directly. Which approach should the engineer take?

Accepted Answer

Create a new table with the 'email' column hashed or redacted, and share that table instead.. Delta Sharing operates at the table level and does not apply Unity Catalog row filters or column masks. To protect sensitive columns, the data engineer must materialize a new table with the sensitive data masked or removed, and share that table. This is the only method that guarantees recipients cannot access the original values. Sharing views or relying on column masks will not work because those features are not enforced over the Delta Sharing protocol.

Answer

Use Delta Sharing's built-in column-level encryption to encrypt the 'email' column.

Answer

Create a view that masks the 'email' column and share the view instead of the table.

Answer

Apply a column mask function to the 'email' column using Unity Catalog and then share the table.

Question 10

A data engineer is configuring a Delta Sharing recipient using a bearer token. The recipient reports that they can list the shared tables but cannot read the data, receiving a '403 Forbidden' error. The engineer has verified that the recipient's token is active and the share contains the tables. What is the most likely cause of the error?

Accepted Answer

The recipient is using an expired credential file or an incorrect token in their configuration.. A 403 Forbidden on data read while metadata listing works points to an authentication problem with the recipient's token or credential file. Delta Sharing uses bearer tokens for authentication; if the token is expired or misconfigured, data access is denied. The recipient should regenerate the token and ensure the credential file is correctly updated. Other causes like IP restrictions or missing privileges are not applicable in this context.

Answer

The recipient's IP address is not included in the allowed IP ranges for the share.

Answer

The shared tables are partitioned, and the recipient is querying a partition that is not included in the share.

Answer

The recipient has not been granted the SELECT privilege on the shared tables.

Question 11

A data engineer needs to share a Delta table with a partner organization using Delta Sharing. The partner does not use Databricks and requires read access to the data. The engineer wants to ensure that the partner can only see a subset of columns and rows. Which feature should the engineer use to achieve this?

Accepted Answer

Create a view on the table that filters columns and rows, and add the view to the share.. To share a subset of columns and rows, the engineer should create a view that selects the desired columns and applies row filters, then add that view to the Delta Share. Delta Sharing supports views, allowing fine-grained access control without duplicating data. The recipient sees only the data exposed by the view, and updates to the underlying table are reflected in the view.

Answer

Use column-level and row-level filters directly on the shared table in the share definition.

Answer

Grant the recipient SELECT privileges only on specific columns of the table.

Answer

Create a separate Delta table containing only the subset of data and add it to the share.

Question 12

A Data Engineer is managing a Delta Share that includes a table with sensitive data. The engineer wants to ensure that the recipient can only query data from the last 30 days and cannot see historical data beyond that. The table is updated daily with new data. What is the most appropriate approach?

Accepted Answer

Use partition filtering in the share to include only partitions for the last 30 days.. Delta Sharing supports partition filtering, which allows the provider to share only specific partitions of a table. If the table is partitioned by date, the engineer can configure the share to include only partitions from the last 30 days. This enforces the restriction on the provider side, ensuring the recipient cannot access older data. Creating a separate table or relying on the recipient to filter is not secure or efficient.

Answer

Share the table and instruct the recipient to filter the data themselves.

Answer

Create a view on the table that filters for the last 30 days and add the view to the share.

Answer

Create a separate table containing only the last 30 days of data and share that table.

Question 13

A data engineer is setting up Lakehouse Federation to query an external MySQL database from Databricks. The engineer needs to ensure that queries against the foreign catalog are optimized and secure. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Enable predicate pushdown by ensuring the foreign catalog is configured with the appropriate pushdown settings.. For Lakehouse Federation, security is enhanced by storing credentials in secret scopes, and performance is improved by enabling predicate pushdown. These two actions directly address the requirements. Other options like materializing data or broad access grants are not recommended for a federated query setup. The engineer should focus on secure credential handling and query optimization.

Answer

Create a materialized view of the external MySQL tables in Unity Catalog to improve query performance.

Answer

Grant the USAGE privilege on the foreign catalog to all users in the workspace.

Answer

Configure the foreign catalog to use a dedicated SQL warehouse for all queries to ensure consistent performance.

Question 14

A data engineer is configuring a Delta Share to share a table with a partner who uses Databricks in a different Unity Catalog metastore. The partner needs to query the shared table using their own Databricks workspace. The engineer creates a share, adds the table, and creates a recipient of type 'Databricks'. The partner provides their Databricks organization ID and a sharing identifier. After the recipient is created, the partner reports they cannot see the shared table. What is the most likely cause?

Accepted Answer

The share must be explicitly granted to the recipient after creation.. For Databricks-to-Databricks sharing, after creating a recipient, the provider must grant the recipient SELECT on the share. This explicit grant is required for the recipient to access the shared data. Without it, the recipient cannot see the share or its tables, even if the recipient object exists.

Answer

The shared table must be in a Unity Catalog metastore that is accessible to the partner.

Answer

The partner must create a foreign catalog pointing to the share.

Answer

The recipient must activate the share using a bearer token before accessing the data.

Question 15

A Data Engineer needs to share a Delta table with a partner organization using Delta Sharing. The partner does not use Databricks. Which component must the Data Engineer generate to facilitate this secure connection?

Accepted Answer

A sharing credential file. Delta Sharing uses a credential file to authenticate external recipients. The provider generates a sharing token encapsulated in a JSON file, which the recipient imports into their Delta Sharing client. This ensures that the data provider maintains full control over access permissions while the recipient can query the data using standard tools without needing a Databricks account, maintaining a secure and decoupled architecture.

Answer

A shared Unity Catalog metastore link

Answer

A personal access token with REST API permissions

Answer

A cross-account IAM role in the recipient's cloud