Databricks-GenAI-Assoc Governance — 15 Questions

Question 1

Which TWO of the following statements correctly describe the capabilities of a Databricks metastore in Unity Catalog?

Accepted Answer

It supports a three-level namespace (catalog.schema.table) for data assets.. The Unity Catalog metastore serves as the top-level container for data governance, centralizing metadata and access control across all workspaces in an account. It enables unified data discovery and governance by providing a single source of truth for tables, schemas, and volumes. Understanding this hierarchy is crucial for cross-workspace data sharing and maintaining consistent security policies throughout the entire Databricks environment.

Answer

It can be managed independently for each workspace without account-level synchronization.

Answer

It enforces access control policies exclusively at the file-system level.

Answer

It forces data storage into the root of the metastore's default storage bucket.

Question 2

A company requires that all data access in Databricks be restricted to a specific region for regulatory compliance. Which Unity Catalog feature should they use to enforce this?

Accepted Answer

Storage location-based access policies. Unity Catalog's location-based governance allows organizations to restrict the storage locations used for data. By using external locations constrained to specific cloud regions, administrators ensure that all data assets registered in the catalog comply with regional residency requirements. This prevents data sprawl into unauthorized regions and simplifies the compliance audit process for global organizations.

Answer

Workspace-level network policies

Answer

Unity Catalog metastore region pinning

Answer

Credential passthrough

Question 3

A GenAI engineer is building a Retrieval-Augmented Generation (RAG) application with Databricks Vector Search. The index is created in Unity Catalog and points to a Delta table containing confidential customer support transcripts. The engineer wants to ensure that only members of the 'genai_team' group can query the index, while other users in the workspace cannot see it. What is the correct way to enforce this access control?

Accepted Answer

Grant USE CATALOG and USE SCHEMA on the catalog and schema, and grant SELECT on the Vector Search index to the 'genai_team' group.. Vector Search indexes in Unity Catalog are independent securable objects. To allow only the 'genai_team' group to query the index, an administrator must grant the necessary privileges on the index itself: SELECT on the index, plus USE CATALOG and USE SCHEMA on its parent catalog and schema. This ensures that other users cannot access the index, meeting the confidentiality requirement.

Answer

Grant MODIFY on the Delta table that the index is built from to the 'genai_team' group, and rely on the index inheriting those permissions.

Answer

Set the index's owner to the 'genai_team' group and revoke all privileges from the metastore admin.

Answer

Attach a cluster-scoped library to the workspace and grant CAN ATTACH TO permissions on that cluster to the 'genai_team' group.

Question 4

A GenAI engineer is using Databricks Foundation Model APIs to serve a Llama 3 model. The engineer needs to log all inference requests and responses for auditing purposes, including the user identity and the model version. The logs must be stored in a Unity Catalog table with column-level encryption for the request text. Which combination of features should the engineer use?

Accepted Answer

Enable inference tables on the model serving endpoint and apply a column mask to the request column in the inference table.. Inference tables are a built-in feature of Databricks Model Serving that automatically log request and response payloads, along with metadata such as the user, timestamp, and model version. To protect sensitive request text, a column mask can be applied to the request column in the inference table. This combination fulfills the auditing and encryption requirements without custom code.

Answer

Create a custom logging handler in the model's Python code that writes to a Unity Catalog table with manually encrypted columns.

Answer

Use MLflow Model Registry to log model signatures and rely on its built-in audit logging for inference requests.

Answer

Configure a Databricks SQL alert on the serving endpoint's metrics table and export the results to an encrypted Delta table.

Question 5

A GenAI engineer has built a Retrieval-Augmented Generation (RAG) application in a Databricks notebook. The application uses the `databricks-bge-large-en` Foundation Model for embedding queries and retrieves documents from a Delta table. The security team requires that all calls to the embedding model be logged with the user identity for audit purposes, without changing any application code. Which Unity Catalog feature should the engineer implement?

Accepted Answer

Use Unity Catalog model serving with the user's identity by leveraging on-behalf-of authentication.. Unity Catalog model serving with on-behalf-of authentication passes the identity of the calling user to the serving endpoint, ensuring that model invocations, including Foundation Model API calls, are logged with the correct user in audit logs. This satisfies the requirement without altering application code, as the authentication is handled at the platform level. Other options either require code changes or do not capture identity for audit.

Answer

Enable inference tables on the serving endpoint used by the application.

Answer

Configure system tables for audit logging and query them to see model invocation events.

Answer

Add a custom header to each API request containing the user's email address.

Question 6

A GenAI engineer has built a retrieval-augmented generation (RAG) application that stores its document embeddings in a Databricks Vector Search index backed by a Delta table in Unity Catalog. The source Delta table contains confidential customer contracts. The organization wants to ensure that end users querying the vector index only retrieve embeddings for documents they are permitted to see, without duplicating the index. Which Unity Catalog capability should the engineer configure on the Vector Search index?

Accepted Answer

Fine-grained access control using the Vector Search index's built-in row filtering with user attributes. Vector Search indexes can enforce fine-grained access control by integrating with Unity Catalog permissions and user attributes. When enabled, the index filters results so that a user only retrieves embeddings from documents they are authorized to access. This is the only option that provides per-user row-level security directly within the vector index without duplicating data or breaking the embedding structure.

Answer

Column masking policies applied to the embedding column

Answer

Delta Sharing with a recipient defined per end user

Answer

Row-level filtering using user-defined functions on the underlying Delta table

Question 7

A data scientist wants to use Databricks Assistant to generate SQL queries on a table that contains sensitive financial data. The organization requires that the Assistant must not see the actual data values, only the schema and metadata. Which Unity Catalog feature should be enabled to meet this requirement?

Accepted Answer

Enable Databricks Assistant's privacy mode in the workspace settings.. Databricks Assistant privacy mode is a workspace setting that restricts the Assistant from accessing actual data values. When enabled, the Assistant relies solely on schema and metadata to generate SQL, ensuring sensitive data is not exposed. This directly satisfies the requirement without impacting the data scientist's ability to query the table.

Answer

Create a view that excludes sensitive columns and grant access to the view only.

Answer

Apply a column mask to all sensitive columns in the table.

Answer

Revoke SELECT permission on the table from the data scientist.

Question 8

A company has deployed a RAG chatbot that uses a Vector Search index in Databricks. The index is built from a Delta table containing confidential customer support tickets. The security team wants to ensure that users can only retrieve documents from the index that they are authorized to see, based on row-level filters defined in Unity Catalog. Which approach should the GenAI engineer take?

Accepted Answer

Use Unity Catalog functions to define a filter and apply it during Vector Search queries via the `filters` parameter.. Vector Search supports passing filters during queries, and Unity Catalog functions can encapsulate row-level security logic. By defining a function that generates a filter expression based on the user's identity or group memberships, the engineer can enforce dynamic row-level security at query time. This ensures that the chatbot only retrieves documents the user is authorized to see, without rebuilding the index or creating separate indexes per group.

Answer

Apply row-level security policies to the source Delta table and rebuild the Vector Search index.

Answer

Enable attribute-based access control on the Vector Search index itself.

Answer

Create a separate Vector Search index for each user group and route queries accordingly.

Question 9

A Databricks workspace uses Unity Catalog, and a GenAI engineer has built a Retrieval-Augmented Generation (RAG) application backed by a Databricks Vector Search index. The source Delta table contains customer support transcripts, some of which include internal-only escalation notes. Compliance requires that users querying the RAG endpoint never receive internal-only notes in retrieved chunks, while data scientists must still be able to read the full table for model evaluation. Which Unity Catalog feature should the engineer use to enforce this at query time?

Accepted Answer

Row filters and column masks defined on the source Delta table. Row filters and column masks are the Unity Catalog mechanisms that change query results per principal. Because they are evaluated by the query engine for every reader, the Vector Search index build and any downstream retrieval inherit the restricted view for non-privileged users, while data scientists granted the unmasked path can still read everything. This satisfies both the compliance restriction and the evaluation requirement without duplicating data.

Answer

A storage credential scoped to the index's cloud storage location

Answer

A Unity Catalog volume mounted at the index storage path

Answer

A Delta table constraint that enforces NOT NULL on the transcript column

Question 10

A GenAI team is deploying a model serving endpoint that calls a foundation model API. The security team requires that all prompts and completions be logged for audit and that access to the endpoint be restricted to a specific group. Which two Unity Catalog features should the team use to meet these requirements? (Choose two.)

Accepted Answer

Grant the specific group EXECUTE on the model serving endpoint using Unity Catalog privileges.. Inference tables capture the full request and response payloads of a model serving endpoint and store them in a governed Delta table, providing the required audit trail. Granting EXECUTE on the endpoint to a specific group ensures only that group can invoke the model. Together, these features satisfy both the logging and access restriction requirements using Unity Catalog governance.

Answer

Configure the AI Gateway to enforce rate limits and log usage metrics.

Answer

Create a personal access token for each user and share it only with the group.

Answer

Use Unity Catalog audit logs to capture inference requests and responses.

Question 11

A GenAI engineer is building a RAG pipeline that uses a Foundation Model API to generate answers. The model is hosted in a Databricks workspace and accessed via a serving endpoint. The security team requires that all data sent to the model is governed by Unity Catalog, and that the engineer can track which users or groups have permission to query the endpoint. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Store the RAG pipeline's source documents in a Unity Catalog table and grant `SELECT` privileges to the same users and groups.. To govern data and track permissions, the engineer should register the Foundation Model as a Unity Catalog model and grant `EXECUTE` privileges, and store source documents in a Unity Catalog table with appropriate `SELECT` privileges. These actions ensure that both the model and the data are securable objects within Unity Catalog, enabling centralized access control and auditing.

Answer

Enable inference tables on the serving endpoint to log all requests and responses.

Answer

Configure the serving endpoint to use Unity Catalog for authentication and authorization.

Answer

Use a personal access token (PAT) for each user to authenticate to the serving endpoint.

Question 12

A GenAI engineer is using Databricks to fine-tune a large language model on a dataset that contains personally identifiable information (PII). The engineer must ensure that the fine-tuning process complies with governance policies. The policies require that PII is not stored in plaintext in the training data used by the fine-tuning job, and that access to the fine-tuned model is restricted to a specific group. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Grant the EXECUTE privilege on the fine-tuned model version to the specific group. To prevent PII from being stored in plaintext during fine-tuning, apply column masking policies to the source table so the training job only sees masked values. To restrict access to the resulting model, grant EXECUTE on the model version to the designated group. These two actions together satisfy the governance requirements for data minimization and model access control.

Answer

Enable inference tables on the fine-tuning cluster to log all training data

Answer

Use Databricks secrets to encrypt the model weights at rest

Answer

Store the training data in a Unity Catalog volume with public read access

Question 13

A GenAI engineer is building a RAG pipeline that uses a Delta table as the source for a Vector Search index. The table contains confidential documents, and the engineer must ensure that the vector index respects Unity Catalog permissions so that only authorized users can query the index. Which two actions must the engineer take? (Choose two.)

Accepted Answer

Grant SELECT privilege on the source Delta table to the users who should be able to query the index.. Databricks Vector Search indexes built on Unity Catalog tables enforce Unity Catalog permissions at query time. To allow a user to query the index, they must have SELECT privilege on the source table, and the workspace must be Unity Catalog-enabled with the table registered in Unity Catalog. These two conditions ensure that the user's access to the underlying data is checked, and that the index is part of the Unity Catalog governance model. Without both, the index will not respect Unity Catalog permissions.

Answer

Create the Vector Search index in a Unity Catalog-enabled workspace and specify the index's owner as a group with access to the source table.

Answer

Grant USE SCHEMA and SELECT privileges on the index to the appropriate users or groups.

Answer

Configure the Vector Search endpoint to use a service principal with access to the source table.

Question 14

A GenAI engineer is building an agent that must call an external HTTP API to retrieve inventory levels. The API requires a secret key. The engineer wants the notebook and the deployed Databricks Model Serving endpoint to read the key without ever storing it in code or in the notebook output, and the security team wants the key to be manageable from Unity Catalog. Which approach should the engineer use?

Accepted Answer

Create a Unity Catalog connection with the HTTP API's host and store the key as a secret in the connection's options. Unity Catalog connections are designed to hold credentials for external systems, including HTTP endpoints. The base path and the secret key live in the connection's options, and code references the connection by name, so the key never appears in notebooks, model artifacts, or request payloads. Because the connection is a Unity Catalog securable, administrators can grant, audit, and rotate access centrally, meeting both the engineering and security requirements.

Answer

Hardcode the key in the model's environment variables inside the MLflow model signature

Answer

Store the key in a Databricks secret scope and reference it with dbutils.secrets.get in the notebook, then pass the literal value to the serving endpoint

Answer

Write the key into a Delta table in Unity Catalog and have the agent SELECT it at runtime

Question 15

A GenAI engineer builds a RAG application whose vector index is served through a Databricks Model Serving endpoint. Security requires that every retrieval and every chat completion be attributable to the individual end user, and that the same users who can query the underlying Delta source table can query the endpoint. Which Unity Catalog mechanism should the engineer configure to satisfy both requirements?

Accepted Answer

Grant EXECUTE on the serving endpoint to the `users` group and rely on the endpoint's automatic passthrough of the caller's identity to Unity Catalog.. The requirement pairs two things: per-end-user attribution and parity between direct table access and endpoint access. Databricks Model Serving endpoints that read Unity Catalog data can authenticate on behalf of the calling user, so the caller's identity propagates to the data layer and row/column-level filters apply individually. Granting EXECUTE on the endpoint to the group controls who may call it without flattening everyone into a shared identity.

Answer

Create a Unity Catalog function that wraps the endpoint, grant EXECUTE on the function to `users`, and have the function run with a definer's rights security context.

Answer

Grant SELECT on the source Delta table to the `users` group and leave the serving endpoint unrestricted so any workspace user can invoke it.

Answer

Grant EXECUTE on the serving endpoint to the `users` group and attach a personal access token of a service principal to the notebook that calls it.