Databricks-GenAI-Assoc Governance Practice Test 2 — 15 Questions

Question 1

A data engineer needs to ensure that sensitive PII columns are masked for specific groups while remaining visible to analysts. Which Unity Catalog feature should be used to implement this requirement?

Accepted Answer

Dynamic data masking. Unity Catalog dynamic data masking allows administrators to apply functions to columns that redact or obfuscate data based on the user's role or group membership. By using SQL functions like mask_email or custom UDFs within a masking policy, the data remains consistent at the physical layer while presenting transformed values at query time. This ensures compliance with privacy regulations without creating multiple copies of datasets.

Answer

Row-level security filters

Answer

Credential passthrough

Answer

Attribute-based access control (ABAC)

Question 2

Refer to the exhibit. The user is a member of the 'finance_team'. Why might the user encounter an access error when executing this join query?

Accepted Answer

The user lacks the USAGE privilege on the 'sales' schema.. In Unity Catalog, users require the USAGE privilege on all parent objects—the catalog and the schema—to access a table. While the user has USAGE on the catalog and SELECT on the tables, they lack the USAGE privilege on the 'sales' schema. Without explicit USAGE permission on the schema, the user cannot traverse the hierarchy to reference the tables, causing a permission denied error.

Answer

The user lacks the SELECT privilege on the schema object.

Answer

The user requires the MODIFY privilege to perform joins.

Answer

The user needs to be an owner of the tables to perform joins.

Question 3

Which Unity Catalog object is used to link a specific cloud storage path to a catalog, schema, or table, allowing users to create tables without managing individual storage credentials?

Accepted Answer

External Location. An External Location in Unity Catalog acts as a secure bridge between Databricks and a specific path in cloud storage (e.g., S3 or ADLS). By using a Storage Credential, the external location allows data engineers to manage storage access at a high level. This simplifies data governance by abstracting cloud-specific permissions into Databricks-native access controls.

Answer

Storage Credential

Answer

Managed Table

Answer

Unity Catalog Volume

Question 4

Which THREE conditions must be met for a user to successfully create a new table in a Unity Catalog schema?

Accepted Answer

The user must have the USAGE privilege on the catalog.. Creating a table in Unity Catalog involves a specific permission chain. The user must have USAGE on the catalog, USAGE on the schema, and the CREATE TABLE privilege on the schema. These requirements ensure that governance is maintained at every level of the hierarchy, preventing unauthorized data creation in sensitive or restricted namespaces within the organization's data architecture.

Answer

The user must have the MODIFY privilege on the catalog.

Answer

The user must have the OWNER role for the entire metastore.

Question 5

Which action must an administrator perform to allow a user to use Databricks SQL to query a table that is stored in an external storage location?

Accepted Answer

Grant the user the READ FILES privilege on the external location.. To query an external table, the user needs access to the storage location, the catalog, the schema, and the table. The administrator must grant the USAGE privilege on the catalog and schema, the SELECT privilege on the table, and the READ FILES privilege on the external location. This multi-layered approach ensures that data access is both logically and physically controlled.

Answer

Grant the user the OWNER role for the storage credential.

Answer

Grant the user the ALL PRIVILEGES privilege on the metastore.

Answer

Add the user to the workspace-level admin group.

Question 6

Refer to the exhibit. Why did the analyst group lose access after the table was recreated?

Accepted Answer

The new table is a different object, so the GRANT statement must be repeated.. In Unity Catalog, privileges are bound to the specific object ID. When a table is dropped and re-created, it becomes a new object with a new unique identifier. The previous GRANT statements, which were associated with the original object ID, do not automatically apply to the new table. This mechanism protects against security drift by ensuring that every new object must have its permissions explicitly managed.

Answer

The catalog owner needs to refresh the table metadata.

Answer

The analyst group needs to be re-added to the schema permissions.

Answer

The user who recreated the table is not the catalog owner.

Question 7

Which Unity Catalog feature is best suited for sharing data assets with users outside of your Databricks account?

Accepted Answer

Delta Sharing. Delta Sharing is an open-protocol standard that allows organizations to share data with users regardless of whether they have a Databricks account. It enables secure, read-only data sharing across different platforms and cloud environments. This is essential for organizations that need to collaborate with partners, vendors, or external clients while maintaining centralized control and auditability within Unity Catalog.

Answer

Unity Catalog cross-account roles

Answer

External locations

Answer

Workspace federation

Question 8

Which TWO of the following are primary components of the Unity Catalog identity model?

Accepted Answer

Account-level users. The Unity Catalog identity model is unified at the account level, meaning that identities are managed consistently across all workspaces. The core components are Users and Groups. By centralizing these identities in the account console, Databricks ensures that permissions are applied uniformly, regardless of which workspace a user is accessing, which is critical for large-scale enterprise governance and audit compliance.

Answer

Workspace-local users

Answer

Cloud-provider-specific identities

Answer

Data asset aliases

Question 9

A data engineer wants to track who accessed a specific table in Unity Catalog. Which tool should they use?

Accepted Answer

Unity Catalog system tables. The System Tables (specifically the access_logs table) in Unity Catalog provide detailed audit logs of all interactions with data objects. By querying these tables using SQL, administrators can monitor data access patterns, identify unauthorized attempts to view sensitive data, and fulfill audit requirements. This centralized logging is a cornerstone of the governance transparency provided by Unity Catalog.

Answer

Databricks cluster logs

Answer

Cloud provider logs

Answer

Workspace activity console

Question 10

Refer to the exhibit. What is the current permission state for the 'analyst_group' after the execution of the REVOKE statement?

Accepted Answer

The group loses access to the table.. Unity Catalog employs a standard additive-subtractive permission model. When a user or group is explicitly denied or revoked a privilege, the revocation takes precedence. After the REVOKE command is executed, the SELECT privilege is removed from 'analyst_group'. Even if the group was previously granted access, the REVOKE command effectively clears that privilege, ensuring the group can no longer access the specified table.

Answer

The group retains access because they are still mentioned in the grant history.

Answer

The group retains access due to the order of operations in the metastore.

Answer

The group can still access the table if they are members of the manager_group.

Question 11

What is the primary function of a Storage Credential in Unity Catalog?

Accepted Answer

To authorize Databricks to access specific cloud storage.. A Storage Credential serves as a secure container for the cloud-provider credentials required to access external storage locations. By separating the credential from the data objects, Unity Catalog allows administrators to manage access to cloud storage in a centralized, governed way without exposing secrets to individual users. This is a fundamental security practice that prevents credential leakage.

Answer

To store user passwords for Databricks.

Answer

To define the schema of a table.

Answer

To cache table data for faster query performance.

Question 12

Which Unity Catalog object should be used to manage access to a folder of JSON files that are not part of a formal Delta table?

Accepted Answer

Unity Catalog Volume. Volumes in Unity Catalog are designed specifically for managing non-tabular data, such as JSON files, CSVs, or machine learning models. By creating a volume, you can govern access to these files using the same security model as tables. This allows for consistent data governance across all types of assets in your environment, not just those formatted as Delta tables.

Answer

Managed Table

Answer

External Location

Answer

Global View

Question 13

What is the purpose of the 'metastores.list' command in the Unity Catalog CLI?

Accepted Answer

To list all metastores available to the user in the account.. The 'metastores.list' command allows administrators to view all Unity Catalog metastores that the current user has permission to see within their Databricks account. This is essential for managing multiple metastores in a complex, multi-region architecture. Understanding which metastores exist and their properties is the first step in ensuring that data governance policies are consistently applied across all regional footprints.

Answer

To list all users registered in the metastore.

Answer

To list all tables within a specific metastore.

Answer

To list all storage credentials linked to the metastore.

Question 14

A data engineer wants to share a specific subset of sensitive PII data with an external department using Unity Catalog. The engineering team must ensure the data is anonymized dynamically based on the user's role without creating physical copies. Which feature is most appropriate?

Accepted Answer

Apply a masking function to the column and use row filters in Unity Catalog.. Unity Catalog row-level security and column-level masking allow for dynamic data governance. By applying a masking function using 'current_user_role()' or 'is_account_group_member()', administrators can ensure that users see redacted data without duplicating the underlying storage. This approach centralizes governance policies, simplifies auditing, and ensures that sensitive data exposure is strictly controlled at the query execution time across all compute resources within the Unity Catalog metastore environment.

Answer

Create a temporary view that filters rows using a WHERE clause and grants SELECT access.

Answer

Export the data to a new table with masked columns and grant access to the department.

Answer

Configure access control lists (ACLs) on the underlying S3 bucket or ADLS container.

Question 15

A GenAI engineer has built a RAG application that queries a Delta table named `prod_ai.knowledge_base.documents` through a Databricks SQL warehouse. The application uses a service principal `sp-rag-prod` to authenticate. The table contains confidential internal documents. The security team wants to ensure that the service principal can only read the table and cannot modify or delete it. Which Unity Catalog privilege should be granted to `sp-rag-prod` on the table?

Accepted Answer

SELECT. The service principal needs only to read the table for the RAG application. Granting SELECT provides exactly that capability without allowing data modification. Other privileges either grant excessive rights (MODIFY, ALL PRIVILEGES) or do not permit reading table data (USE SCHEMA). SELECT is the correct least-privilege grant for a read-only consumer in Unity Catalog.

Answer

ALL PRIVILEGES

Answer

USE SCHEMA

Answer

MODIFY