Databricks-DE-Pro Data Governance — 15 Questions

Question 1

A data engineer needs to grant a production transformation service principal the ability to read PII data stored in a Unity Catalog managed table, but wants to mask specific columns containing email addresses dynamically for this principal. Which combination of Unity Catalog features should the engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a SQL user-defined function leveraging conditional logic on user identity and apply it as a column mask to the email column.. In Unity Catalog, dynamic column-level security is implemented by creating a SQL user-defined function (UDF) that evaluates identity functions like current_user() or is_account_group_member(), and then applying that UDF directly to the target column using an ALTER TABLE ... ALTER COLUMN ... SET MASK statement. This masks data dynamically at query runtime without requiring physical table duplication or traditional dynamic views.

Answer

Grant SELECT on the table, create a row filter using SQL user-defined functions, and assign it via the catalog explorer UI.

Answer

Create a cloned copy of the table using shallow clone, apply static data masking via Python notebooks, and grant read access exclusively to the clone.

Answer

Configure access control lists at the storage container level using cloud provider IAM policies to block the principal from viewing column paths.

Question 2

Refer to the exhibit. An analyst in 'finance_group' reports they cannot see the table 'main.finance.transactions_sensitive'. Based on the provided GRANT statements, why is the access denied?

Accepted Answer

The USAGE privilege is missing for the schema.. In Unity Catalog, to access any object within a schema, a principal must first have the USAGE privilege on the catalog and the schema. Furthermore, schema-level privileges grant access to objects within that schema. If access is denied, it is typically because the foundational USAGE privilege is missing on the parent catalog or schema, preventing traversal.

Answer

The REVOKE statement invalidates the entire chain of permissions for the schema.

Answer

Unity Catalog requires an explicit GRANT to the individual table regardless of schema-level access.

Answer

The analyst lacks the required SELECT privilege on the specific table.

Question 3

An organization is migrating from Hive Metastore to Unity Catalog. Which requirement is mandatory for existing tables to be managed by Unity Catalog?

Accepted Answer

The data must be moved into the Unity Catalog managed storage location.. While Unity Catalog uses a three-level namespace, existing tables in Hive Metastore are not 'registered' into this namespace automatically or manually in a way that makes them 'managed' by Unity Catalog without migration. To be managed by Unity Catalog, tables must be upgraded or migrated. Specifically, for tables to be 'Managed' tables in Unity Catalog, the data must reside in the managed storage location defined by the catalog/schema. Option C describes the naming convention, not the requirement for the table to be managed by Unity Catalog.

Answer

Tables must be converted to the Delta format.

Answer

Tables must be registered using the three-level namespace (catalog.schema.table).

Answer

All tables must be granted the OWNER privilege to the account admin.

Question 4

Refer to the exhibit. A data engineer is setting up a Storage Credential in Unity Catalog to access an S3 bucket. Why is this policy insufficient for full external table management?

Accepted Answer

The policy lacks s3:DeleteObject for external table lifecycle management.. Option A and Option B are functionally identical, making the question invalid. Furthermore, Unity Catalog external table management requires specific S3 permissions (s3:DeleteObject) to perform operations like 'DROP TABLE' or 'VACUUM', which are essential for lifecycle management. The explanation is correct, but the options provided are flawed.

Answer

The policy is missing s3:DeleteObject, which is required for dropping managed tables.

Answer

The resource ARN format is incorrect for an S3 bucket integration.

Answer

The policy contains unnecessary permissions, violating security best practices.

Question 5

Which entity in Unity Catalog acts as the primary container for managing permissions and grouping related data assets?

Accepted Answer

The Catalog.. The Catalog is the first level of the Unity Catalog three-level namespace (catalog.schema.table). It serves as the primary container for organizing schemas and tables, enabling a clean separation of environments (e.g., dev, prod) and a centralized security model. While the Metastore is the top-level container for the entire Unity Catalog account/region, the Catalog is the primary unit for grouping related data assets and managing permissions at scale.

Answer

The Schema.

Answer

The Table.

Answer

The Metastore.

Question 6

Refer to the exhibit. A user in 'data_science_group' attempts to query 'main.raw.sensitive_data'. What is the outcome?

Accepted Answer

The user is denied access to the table.. Unity Catalog follows an 'explicit deny' or 'no access' logic. Although the user has SELECT on the entire catalog, the explicit REVOKE on the specific table overrides the broader grant. This granular control is a powerful governance feature that allows administrators to provide wide access to a catalog while strictly locking down specific, sensitive datasets, ensuring that security can be tailored to meet strict regulatory and compliance requirements.

Answer

The user can access the table because of the CATALOG-level SELECT grant.

Answer

The user is prompted for credentials to override the REVOKE.

Answer

The user can query the table, but the sensitive columns are masked.

Question 7

Which role is specifically required to create a new Catalog in a Unity Catalog-enabled Databricks workspace?

Accepted Answer

Metastore Admin.. While the Metastore Admin has the privilege by default, any user granted the 'CREATE CATALOG' privilege on the metastore can create a catalog. The explanation should clarify that the Metastore Admin is the default holder of this privilege, but it is not the *only* way to achieve the task.

Answer

Workspace Admin.

Answer

Account Admin.

Answer

Owner of the current schema.

Question 8

A data engineer is implementing column-level masking in Unity Catalog. The requirement is to show the full value of the 'email' column to members of the 'hr_group' and a partially masked value to all other users. The engineer creates a mask function and applies it using ALTER TABLE ... SET MASK. Which additional step is required to ensure that only 'hr_group' sees unmasked data?

Accepted Answer

Use the mask function to check if the current user is a member of 'hr_group' and return the unmasked value; otherwise return a masked value.. In Unity Catalog, column masks are applied to all users who query the column unless they have been granted the ability to see unmasked data through the function's logic. The mask function must use group membership checks to return the original value for authorized groups and a masked value for others. This ensures that only 'hr_group' sees the full email while others see a masked version.

Answer

Grant the UNMASK privilege on the table to 'hr_group'.

Answer

Create a row filter that allows 'hr_group' to see all rows and apply it to the table.

Answer

Grant EXECUTE on the mask function to 'hr_group' only.

Question 9

A data engineer is configuring a Unity Catalog metastore to use customer-managed keys (CMK) for encryption at rest. They need to ensure that all data in the metastore is encrypted with the CMK, including managed tables and the metastore's internal data. Which two actions must the engineer take? (Choose two.)

Accepted Answer

Set the metastore's encryption key to the CMK key in the Unity Catalog metastore settings.. To ensure all data in the metastore is encrypted with CMK, the engineer must enable CMK on the cloud storage account hosting the metastore's root storage and set the metastore's encryption key to the CMK. These two actions cover both the internal metadata and the managed table data, providing end-to-end encryption with customer-managed keys.

Answer

Configure the storage credential with the CMK key vault URI.

Answer

Enable CMK on each external location's underlying storage.

Answer

Apply a cluster policy that enforces CMK encryption for all clusters.

Question 10

A data engineer is configuring attribute-based access control in Unity Catalog. The company's security policy states that analysts may only query rows from the `sales` table where the `region` column matches their assigned region, stored in the user attribute `region`. The engineer has already created a user-defined function `main.governance.region_filter(region STRING)` that returns TRUE if the region matches the user's attribute. Which SQL statement should the engineer use to enforce this policy?

Accepted Answer

ALTER TABLE main.sales.sales SET ROW FILTER main.governance.region_filter ON (region);. Row filters in Unity Catalog are implemented using user-defined functions that return a boolean. The ALTER TABLE ... SET ROW FILTER syntax attaches such a function to a table, and the function is evaluated for each row at query time. This provides dynamic, attribute-based row-level security without duplicating data or creating separate views.

Answer

GRANT SELECT ON TABLE main.sales.sales TO analysts WHERE region = current_user();

Answer

ALTER TABLE main.sales.sales ADD CONSTRAINT region_check CHECK (region = current_user());

Answer

CREATE VIEW main.sales.sales_filtered AS SELECT * FROM main.sales.sales WHERE region = current_user();

Question 11

A data engineer is setting up a Unity Catalog external location for an AWS S3 bucket. The storage credential uses an IAM role. The engineer must ensure that the external location can be used to create external tables and that access is restricted to the specified S3 path. Which two actions are required? (Choose two.)

Accepted Answer

Grant the IAM role s3:GetObject, s3:PutObject, s3:DeleteObject, and s3:ListBucket on the S3 bucket.. To set up a Unity Catalog external location for an S3 bucket, you must create an IAM role that Databricks can assume via a trust policy and configure a storage credential with that role's ARN. Additionally, the IAM role must have the necessary S3 permissions (GetObject, PutObject, DeleteObject, ListBucket) to allow reading, writing, and managing objects. These two actions are essential for the external location to function correctly.

Answer

Enable versioning on the S3 bucket to support time travel.

Answer

Attach a bucket policy to the S3 bucket that allows the IAM role to access the bucket.

Answer

Grant the IAM role kms:Decrypt on the KMS key if the S3 bucket is encrypted with SSE-KMS.

Question 12

A data engineer at a healthcare company manages a Unity Catalog managed table `main.clinical.patient_records` that contains protected health information. The security team requires that analysts in the `analytics_group` be able to see only aggregated statistics from this table, never individual rows. The data engineer must implement a solution that dynamically filters out sensitive rows for that group while allowing other groups to see all rows. Which Unity Catalog feature should be used to meet these requirements?

Accepted Answer

Create a dynamic view that computes aggregate metrics (e.g., counts, averages) and grant SELECT on that view to analytics_group.. The requirement is to provide aggregated statistics without exposing individual rows. A dynamic view that computes aggregates and is granted to the analytics group achieves this. Row-level filters and column-level grants still expose row-level data, and a dynamic view with row filtering returns individual rows. Only the aggregate-computing dynamic view meets the need securely and enforceably.

Answer

Use row-level filters in Unity Catalog by defining a filter function that restricts rows based on group membership, applied directly to the table.

Answer

Grant SELECT on the table to analytics_group but revoke SELECT on all columns except non-sensitive ones, and instruct analysts to use aggregate functions in their queries.

Answer

Apply a dynamic view on the table using CURRENT_USER() in the view definition and grant SELECT on the view to analytics_group.

Question 13

A data engineer needs to ensure that a Unity Catalog external table `main.finance.transactions` stored in an ADLS Gen2 container is accessible to a service principal named `etl-sp` for both reading and writing. The storage credential `adls-cred` has been created and granted to `etl-sp`. The external location `abfss://finance@datalake.dfs.core.windows.net/transactions` has been created. The engineer runs: `GRANT READ FILES, WRITE FILES ON EXTERNAL LOCATION abfss://finance@datalake.dfs.core.windows.net/transactions TO etl-sp;` but the service principal still cannot write to the table. What is the most likely reason?

Accepted Answer

The service principal needs the MODIFY privilege on the external table itself, in addition to READ FILES and WRITE FILES on the external location.. To write to an external table in Unity Catalog, a principal needs both file-level permissions on the external location and the MODIFY privilege on the table. The engineer granted READ FILES and WRITE FILES on the external location, which covers file access, but omitted the table-level MODIFY privilege. Without MODIFY, the service principal cannot perform write operations on the table, even though it can access the files. Therefore, the missing MODIFY grant is the most likely cause.

Answer

The external location path must be granted to the service principal using a storage credential, not directly via GRANT statements.

Answer

The service principal lacks the CREATE TABLE privilege on the schema containing the external table.

Answer

The service principal must also be granted USAGE on the catalog and schema, but that alone is insufficient for write access.

Question 14

A data engineer is configuring Unity Catalog to govern access to an external S3 bucket. The bucket contains multiple prefixes for different departments. The engineer wants to grant a group `dept_finance` the ability to read all files under the `s3://company-bucket/finance/` prefix and write to a sub-prefix `s3://company-bucket/finance/processed/`. Which TWO actions must the engineer take to achieve this? (Choose two.)

Accepted Answer

Create an external location for `s3://company-bucket/finance/processed/` and grant WRITE FILES on that external location to `dept_finance`.. To grant read access to the finance prefix and write access to the processed sub-prefix, the engineer must create external locations for those paths and grant the appropriate file-level privileges. READ FILES on the finance external location allows reading all files under it. WRITE FILES on the processed external location allows writing to that sub-prefix. Storage credentials are not granted to groups for file access; they are used by external locations. Table-level privileges are not relevant for direct file access.

Answer

Create a storage credential that has access to the entire S3 bucket, and grant it to the group `dept_finance`.

Answer

Create a storage credential that has read and write access to the entire bucket, and grant USAGE on it to `dept_finance`.

Answer

Grant MODIFY on all tables in the `finance` schema to `dept_finance`.

Question 15

A data engineer is using Delta Sharing to share a table `main.sales.orders` with an external partner. The partner needs to access the shared data using their own Databricks workspace. The engineer creates a share, adds the table, and creates a recipient for the partner. The partner reports that they can see the share but cannot query the table. The engineer verifies that the recipient has been granted SELECT on the share. What is the most likely cause of the issue?

Accepted Answer

The engineer did not enable the share to be accessed by the recipient's Databricks workspace, or the recipient has not accepted the share.. The most likely cause is that the share has not been properly activated for the recipient, or the recipient has not accepted the share. In Delta Sharing, after creating a share and adding tables, the provider must grant the recipient access to the share, and the recipient must accept the share in their workspace. If the recipient can see the share but cannot query, it suggests a missing step in the sharing lifecycle. Other options are less likely because Delta Sharing handles cross-region and storage access transparently.

Answer

The table is a Unity Catalog managed table, and the engineer did not grant the recipient's metastore access to the storage credential.

Answer

The partner's Databricks workspace is not in the same cloud region as the share provider, causing network latency.

Answer

The partner has not been granted USAGE on the share, in addition to SELECT on the table.