Databricks-GenAI-Assoc Governance — 10 Questions

Question 1

Which TWO of the following statements correctly describe the capabilities of a Databricks metastore in Unity Catalog?

Accepted Answer

It supports a three-level namespace (catalog.schema.table) for data assets.. The Unity Catalog metastore serves as the top-level container for data governance, centralizing metadata and access control across all workspaces in an account. It enables unified data discovery and governance by providing a single source of truth for tables, schemas, and volumes. Understanding this hierarchy is crucial for cross-workspace data sharing and maintaining consistent security policies throughout the entire Databricks environment.

Answer

It can be managed independently for each workspace without account-level synchronization.

Answer

It enforces access control policies exclusively at the file-system level.

Answer

It forces data storage into the root of the metastore's default storage bucket.

Question 2

A company requires that all data access in Databricks be restricted to a specific region for regulatory compliance. Which Unity Catalog feature should they use to enforce this?

Accepted Answer

Storage location-based access policies. Unity Catalog's location-based governance allows organizations to restrict the storage locations used for data. By using external locations constrained to specific cloud regions, administrators ensure that all data assets registered in the catalog comply with regional residency requirements. This prevents data sprawl into unauthorized regions and simplifies the compliance audit process for global organizations.

Answer

Workspace-level network policies

Answer

Unity Catalog metastore region pinning

Answer

Credential passthrough

Question 3

A GenAI engineer is building a Retrieval-Augmented Generation (RAG) application with Databricks Vector Search. The index is created in Unity Catalog and points to a Delta table containing confidential customer support transcripts. The engineer wants to ensure that only members of the 'genai_team' group can query the index, while other users in the workspace cannot see it. What is the correct way to enforce this access control?

Accepted Answer

Grant USE CATALOG and USE SCHEMA on the catalog and schema, and grant SELECT on the Vector Search index to the 'genai_team' group.. Vector Search indexes in Unity Catalog are independent securable objects. To allow only the 'genai_team' group to query the index, an administrator must grant the necessary privileges on the index itself: SELECT on the index, plus USE CATALOG and USE SCHEMA on its parent catalog and schema. This ensures that other users cannot access the index, meeting the confidentiality requirement.

Answer

Grant MODIFY on the Delta table that the index is built from to the 'genai_team' group, and rely on the index inheriting those permissions.

Answer

Set the index's owner to the 'genai_team' group and revoke all privileges from the metastore admin.

Answer

Attach a cluster-scoped library to the workspace and grant CAN ATTACH TO permissions on that cluster to the 'genai_team' group.

Question 4

A GenAI engineer is using Databricks Foundation Model APIs to serve a Llama 3 model. The engineer needs to log all inference requests and responses for auditing purposes, including the user identity and the model version. The logs must be stored in a Unity Catalog table with column-level encryption for the request text. Which combination of features should the engineer use?

Accepted Answer

Enable inference tables on the model serving endpoint and apply a column mask to the request column in the inference table.. Inference tables are a built-in feature of Databricks Model Serving that automatically log request and response payloads, along with metadata such as the user, timestamp, and model version. To protect sensitive request text, a column mask can be applied to the request column in the inference table. This combination fulfills the auditing and encryption requirements without custom code.

Answer

Create a custom logging handler in the model's Python code that writes to a Unity Catalog table with manually encrypted columns.

Answer

Use MLflow Model Registry to log model signatures and rely on its built-in audit logging for inference requests.

Answer

Configure a Databricks SQL alert on the serving endpoint's metrics table and export the results to an encrypted Delta table.

Question 5

A GenAI engineer has built a Retrieval-Augmented Generation (RAG) application in a Databricks notebook. The application uses the `databricks-bge-large-en` Foundation Model for embedding queries and retrieves documents from a Delta table. The security team requires that all calls to the embedding model be logged with the user identity for audit purposes, without changing any application code. Which Unity Catalog feature should the engineer implement?

Accepted Answer

Use Unity Catalog model serving with the user's identity by leveraging on-behalf-of authentication.. Unity Catalog model serving with on-behalf-of authentication passes the identity of the calling user to the serving endpoint, ensuring that model invocations, including Foundation Model API calls, are logged with the correct user in audit logs. This satisfies the requirement without altering application code, as the authentication is handled at the platform level. Other options either require code changes or do not capture identity for audit.

Answer

Enable inference tables on the serving endpoint used by the application.

Answer

Configure system tables for audit logging and query them to see model invocation events.

Answer

Add a custom header to each API request containing the user's email address.

Question 6

A GenAI engineer has built a retrieval-augmented generation (RAG) application that stores its document embeddings in a Databricks Vector Search index backed by a Delta table in Unity Catalog. The source Delta table contains confidential customer contracts. The organization wants to ensure that end users querying the vector index only retrieve embeddings for documents they are permitted to see, without duplicating the index. Which Unity Catalog capability should the engineer configure on the Vector Search index?

Accepted Answer

Fine-grained access control using the Vector Search index's built-in row filtering with user attributes. Vector Search indexes can enforce fine-grained access control by integrating with Unity Catalog permissions and user attributes. When enabled, the index filters results so that a user only retrieves embeddings from documents they are authorized to access. This is the only option that provides per-user row-level security directly within the vector index without duplicating data or breaking the embedding structure.

Answer

Column masking policies applied to the embedding column

Answer

Delta Sharing with a recipient defined per end user

Answer

Row-level filtering using user-defined functions on the underlying Delta table

Question 7

A data scientist wants to use Databricks Assistant to generate SQL queries on a table that contains sensitive financial data. The organization requires that the Assistant must not see the actual data values, only the schema and metadata. Which Unity Catalog feature should be enabled to meet this requirement?

Accepted Answer

Enable Databricks Assistant's privacy mode in the workspace settings.. Databricks Assistant privacy mode is a workspace setting that restricts the Assistant from accessing actual data values. When enabled, the Assistant relies solely on schema and metadata to generate SQL, ensuring sensitive data is not exposed. This directly satisfies the requirement without impacting the data scientist's ability to query the table.

Answer

Create a view that excludes sensitive columns and grant access to the view only.

Answer

Apply a column mask to all sensitive columns in the table.

Answer

Revoke SELECT permission on the table from the data scientist.

Question 8

A company has deployed a RAG chatbot that uses a Vector Search index in Databricks. The index is built from a Delta table containing confidential customer support tickets. The security team wants to ensure that users can only retrieve documents from the index that they are authorized to see, based on row-level filters defined in Unity Catalog. Which approach should the GenAI engineer take?

Accepted Answer

Use Unity Catalog functions to define a filter and apply it during Vector Search queries via the `filters` parameter.. Vector Search supports passing filters during queries, and Unity Catalog functions can encapsulate row-level security logic. By defining a function that generates a filter expression based on the user's identity or group memberships, the engineer can enforce dynamic row-level security at query time. This ensures that the chatbot only retrieves documents the user is authorized to see, without rebuilding the index or creating separate indexes per group.

Answer

Apply row-level security policies to the source Delta table and rebuild the Vector Search index.

Answer

Enable attribute-based access control on the Vector Search index itself.

Answer

Create a separate Vector Search index for each user group and route queries accordingly.

Question 9

A Databricks workspace uses Unity Catalog, and a GenAI engineer has built a Retrieval-Augmented Generation (RAG) application backed by a Databricks Vector Search index. The source Delta table contains customer support transcripts, some of which include internal-only escalation notes. Compliance requires that users querying the RAG endpoint never receive internal-only notes in retrieved chunks, while data scientists must still be able to read the full table for model evaluation. Which Unity Catalog feature should the engineer use to enforce this at query time?

Accepted Answer

Row filters and column masks defined on the source Delta table. Row filters and column masks are the Unity Catalog mechanisms that change query results per principal. Because they are evaluated by the query engine for every reader, the Vector Search index build and any downstream retrieval inherit the restricted view for non-privileged users, while data scientists granted the unmasked path can still read everything. This satisfies both the compliance restriction and the evaluation requirement without duplicating data.

Answer

A storage credential scoped to the index's cloud storage location

Answer

A Unity Catalog volume mounted at the index storage path

Answer

A Delta table constraint that enforces NOT NULL on the transcript column

Question 10

A GenAI team is deploying a model serving endpoint that calls a foundation model API. The security team requires that all prompts and completions be logged for audit and that access to the endpoint be restricted to a specific group. Which two Unity Catalog features should the team use to meet these requirements? (Choose two.)

Accepted Answer

Grant the specific group EXECUTE on the model serving endpoint using Unity Catalog privileges.. Inference tables capture the full request and response payloads of a model serving endpoint and store them in a governed Delta table, providing the required audit trail. Granting EXECUTE on the endpoint to a specific group ensures only that group can invoke the model. Together, these features satisfy both the logging and access restriction requirements using Unity Catalog governance.

Answer

Configure the AI Gateway to enforce rate limits and log usage metrics.

Answer

Create a personal access token for each user and share it only with the group.

Answer

Use Unity Catalog audit logs to capture inference requests and responses.