Databricks-DE-Pro Data Governance Practice Test 2 — 15 Questions

Question 1

A data engineer is configuring a Unity Catalog storage credential to access an AWS S3 bucket. The engineer has created an IAM role with the necessary permissions and an instance profile, and now needs to set up the storage credential. Which two statements accurately describe the requirements for the storage credential to function correctly? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The storage credential must reference the IAM role's ARN, and the role's trust policy must allow the Databricks control plane's AWS account to assume it.. Storage credentials for AWS S3 require an IAM role ARN and a trust policy that allows the Databricks control plane to assume the role, including the external ID for security. The user creating the credential needs the CREATE STORAGE CREDENTIAL privilege on the metastore. These two elements are essential for secure, temporary credential vending.

Answer

The storage credential must be defined with a path to the S3 bucket, and that path must be registered in the metastore.

Answer

The storage credential must include the AWS secret access key and access key ID for an IAM user with permissions to the S3 bucket.

Answer

The storage credential must be associated with a specific external location, and the external location must be created before the storage credential.

Question 2

A data engineer needs to restrict access to personally identifiable information (PII) columns in a Unity Catalog table for a group of analysts. Which Unity Catalog feature should be used to enforce this policy while ensuring data remains queryable?

Accepted Answer

Define a column mask using SQL functions to redact data for the analyst group.. Dynamic views or Row-level security (RLS) and Column-level security (CLS) are essential for compliance. By utilizing SQL functions like current_user() within a defined mask, you ensure that PII is obscured based on user identity. This approach centralizes security within the data platform, preventing the need to duplicate datasets for different access levels, which significantly reduces the administrative burden and minimizes the risk of unauthorized data exposure in production environments.

Answer

Apply a static mask using a custom UDF during data ingestion.

Answer

Grant the analyst group SELECT access on the table and instruct them to cast PII columns to null.

Answer

Create separate physical tables for analysts containing only non-sensitive columns.

Question 3

Which TWO of the following are primary benefits of using Unity Catalog for managing data lineage in Databricks?

Accepted Answer

It provides automated, column-level lineage tracking for SQL and Python workloads.. Unity Catalog automatically captures lineage at the table and column level for queries executed on the platform. This metadata is crucial for impact analysis and compliance auditing. By providing a unified view of how data moves from source to destination, organizations can maintain transparency, satisfy regulatory requirements for data tracking, and easily debug complex ETL pipelines that span across multiple workspaces and various cloud storage locations.

Answer

It forces all data to be stored in a single, centrally managed S3 bucket.

Answer

It automatically encrypts all data at rest using customer-managed keys.

Answer

It allows users to manually edit the lineage graph to include external data sources.

Question 4

Which THREE actions are required to properly implement a secure data sharing strategy using Delta Sharing?

Accepted Answer

Create a SHARE object containing the tables to be shared.. Delta Sharing provides a secure way to share data without replication. Implementing it requires creating a sharing object, defining the recipients, and granting access to specific tables. This ensures that only authorized entities can access the data, maintaining strict governance. By abstracting the data access from the storage location, organizations can share data securely with external partners while retaining full control over who has access and when that access is revoked.

Answer

Grant the recipient access to the underlying S3 bucket directly.

Answer

Copy the data to a public-facing S3 bucket for easier access.

Question 5

A data engineer wants to ensure that all data in a specific catalog is encrypted at rest. Which feature should they verify is enabled within the Unity Catalog metastore configuration?

Accepted Answer

Customer-managed keys (CMK) for managed storage.. Customer-managed keys (CMK) for managed storage are the standard governance tool for ensuring that data at rest is encrypted according to organizational security policies. By configuring CMK, the organization maintains control over the encryption lifecycle, satisfying compliance requirements. This feature is critical for highly regulated industries where the entity, rather than the cloud provider, must maintain the ultimate authority over data access and encryption standards in the cloud.

Answer

Workspace-level access control lists.

Answer

Unity Catalog lineage tracking.

Answer

Table access control (TAC).

Question 6

An organization needs to share a dataset with a client who does not use Databricks. What is the most efficient and secure way to share this data using Unity Catalog?

Accepted Answer

Use Delta Sharing with an open sharing provider.. Delta Sharing is an open-standard protocol that allows sharing data with any recipient, regardless of their platform or environment. By using Unity Catalog to share data, the organization maintains centralized governance and audit trails while enabling the recipient to consume the data using familiar tools. This approach is highly efficient because it avoids the need for data duplication and ensures the recipient always accesses the most current version.

Answer

Export the data to CSV and upload it to a public FTP server.

Answer

Grant the client read-only access to a dedicated Databricks workspace.

Answer

Create a public API endpoint that queries the table for the client.

Question 7

Which TWO of the following are true regarding Unity Catalog's ability to govern external locations?

Accepted Answer

External locations require a storage credential to function.. Unity Catalog can manage access to external cloud storage locations by creating 'External Locations'. This allows administrators to grant specific permissions to users to read from or write to these storage buckets without providing them with direct cloud provider credentials. This abstraction is vital for security, as it centralizes control and auditing of data access within the platform while keeping the underlying storage infrastructure shielded from the users.

Answer

Users can directly mount external locations as DBFS paths.

Answer

External locations are automatically created for every S3 bucket in the account.

Answer

External locations are only supported for Delta-formatted data.

Question 8

When migrating to Unity Catalog, what is the best practice for managing existing data access permissions?

Accepted Answer

Implement a role-based access control (RBAC) model in Unity Catalog.. Adopting the principle of least privilege during migration is essential. By reviewing and re-granting permissions in the new Unity Catalog environment, you can eliminate legacy security debt and ensure that only necessary access is provided. This is the perfect opportunity to implement a robust, role-based access control (RBAC) model, ensuring the new environment is more secure than the legacy Hive Metastore it replaces, and facilitating long-term compliance.

Answer

Automatically import all Hive Metastore permissions during migration.

Answer

Grant every user 'ADMIN' access to simplify the migration process.

Answer

Use the metastore owner's credentials for all data access.

Question 9

A data engineer is implementing column-level masking in Unity Catalog. They need to mask the 'email' column in the table 'prod.customers' such that only members of the 'hr_group' see the full email, while all other users see a masked version. The engineer creates a masking function and applies it using ALTER TABLE. Which statement correctly applies the mask?

Accepted Answer

ALTER TABLE prod.customers ALTER COLUMN email SET MASK prod.security.mask_email;. The correct syntax to apply a column mask in Unity Catalog is ALTER TABLE table_name ALTER COLUMN column_name SET MASK function_name, where function_name is a fully qualified function that returns the masked value. This ensures that the mask is applied consistently and only authorized users see the original data.

Answer

ALTER TABLE prod.customers ALTER COLUMN email SET MASK FUNCTION prod.security.mask_email;

Answer

ALTER TABLE prod.customers ALTER COLUMN email SET MASK mask_email;

Answer

ALTER TABLE prod.customers MODIFY COLUMN email SET MASK prod.security.mask_email;

Question 10

A data engineer needs to audit which users have accessed a Unity Catalog table containing sensitive data. They want to see a record of all queries that read from the table over the past 30 days. Which Unity Catalog feature should they use?

Accepted Answer

Audit logs. Audit logs in Unity Catalog record all access and query activities, including the user, timestamp, and the tables accessed. They are essential for security auditing and compliance. Data lineage, information schema, and Delta transaction logs serve different purposes and do not provide a record of user access.

Answer

Delta transaction log

Answer

Data lineage

Answer

Information schema

Question 11

A data engineer is configuring a Unity Catalog metastore to use a customer-managed key (CMK) for encryption at rest. The engineer has created the necessary Key Vault and key in Azure. Which additional configuration is required to enable CMK for the metastore?

Accepted Answer

Assign the Key Vault Crypto Service Encryption User role to the Databricks managed identity used for the metastore.. Unity Catalog CMK for Azure requires that the Databricks managed identity for the metastore has the Key Vault Crypto Service Encryption User role on the Key Vault. This role allows Databricks to perform wrap and unwrap operations with the key. Without this role assignment, the metastore cannot use the CMK for encryption.

Answer

Create a private endpoint for the Key Vault.

Answer

Grant the Databricks access connector the Key Vault Crypto Service Encryption User role.

Answer

Enable soft delete on the Key Vault.

Question 12

A data engineer has a Unity Catalog managed table `sales.raw.transactions` that contains a column `customer_email` with PII. Analysts in the `marketing_analysts` group need to query the table for aggregate reporting but must never see individual email addresses. The engineer wants to enforce this dynamically without creating a separate view or copy of the data. Which Unity Catalog feature should the engineer use?

Accepted Answer

Apply a column mask to `customer_email` using a user-defined function that returns NULL for members of `marketing_analysts`.. A column mask in Unity Catalog applies a user-defined function at query time to transform or redact column values based on the invoking user's identity or group memberships. This allows the same table to return different values for different users without duplicating data or creating separate views. It is the native mechanism for dynamic column-level security and satisfies the requirement to hide email addresses from marketing analysts while still permitting aggregate queries.

Answer

Create a row filter on `sales.raw.transactions` that excludes rows where `customer_email` is not null.

Answer

Enable attribute-based access control (ABAC) at the catalog level to automatically mask all PII columns for all non-admin users.

Answer

Revoke SELECT on the table from `marketing_analysts` and grant SELECT only on a view that omits `customer_email`.

Question 13

A data engineer is configuring a Unity Catalog storage credential to access an AWS S3 bucket. The engineer has created an IAM role with the necessary permissions and an instance profile, and now needs to set up the storage credential. Which two statements accurately describe the requirements for the storage credential to function correctly? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service principal does not have the `USE EXTERNAL LOCATION` privilege on the external location.. Unity Catalog requires both `USE EXTERNAL LOCATION` and the appropriate file-level privileges (`READ FILES`, `WRITE FILES`) to access data in an external location. The `USE EXTERNAL LOCATION` privilege grants the ability to reference the external location in queries and commands, while `WRITE FILES` allows writing data. Without `USE EXTERNAL LOCATION`, the service principal cannot utilize the external location, resulting in a permissions error despite having `WRITE FILES` and cloud storage permissions.

Answer

The service principal lacks the `CREATE EXTERNAL TABLE` privilege on the external location.

Answer

The external location is missing the `READ FILES` privilege for the service principal.

Answer

The managed identity lacks the Storage Blob Data Reader role on the container.

Question 14

A data engineer is designing a Unity Catalog governance model for a new data lakehouse. They need to ensure that data access is auditable and that sensitive data is protected. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable audit logging for the metastore to capture all access and permission changes.. Enabling audit logging captures all access and permission changes, providing the necessary audit trail. Applying tags to sensitive columns and using ABAC policies enforces fine-grained access control based on those tags, protecting sensitive data consistently. Together, these actions create a governance model that is both auditable and secure, leveraging Unity Catalog's native capabilities for centralized policy management.

Answer

Use dynamic views to mask PII columns for all users except administrators.

Answer

Create a separate metastore for each department to isolate data.

Answer

Store all data in a single catalog and grant `ALL PRIVILEGES` to the data engineering team.

Question 15

A data engineer is using Delta Sharing to share a table with an external partner. The partner needs to access the shared data using their own Databricks workspace. Which protocol does Delta Sharing use to enable this cross-platform sharing?

Accepted Answer

REST API with pre-signed URLs. Delta Sharing is an open protocol that uses a REST API to facilitate data sharing. The provider's Delta Sharing server authenticates requests and returns pre-signed URLs that allow the recipient to download data directly from cloud storage. This design enables secure, cross-platform sharing without exposing the provider's storage credentials or requiring the recipient to use Databricks.

Answer

SFTP transfer of Parquet files

Answer

JDBC/ODBC connection to the provider's SQL warehouse

Answer

Direct access to the provider's cloud storage with IAM roles