Databricks-GenAI-Assoc Governance Practice Test 3 — 15 Questions

Question 1

A GenAI engineer is building a RAG application on Databricks. They have registered a foundation model endpoint in Unity Catalog as a model. The application needs to query the endpoint, and the engineer wants to ensure that only members of the group 'genai_team' can invoke it. Which Unity Catalog privilege must be granted on the model object to allow invocation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

EXECUTE. To invoke a model registered in Unity Catalog, a user must have the EXECUTE privilege on that model. Granting EXECUTE to the genai_team group ensures that only its members can call the model endpoint, aligning with the requirement to restrict access. Other privileges like SELECT, USE, or CREATE do not authorize model invocation.

Answer

USE

Answer

SELECT

Answer

CREATE

Question 2

A data scientist is using Databricks to fine-tune a large language model. The training data is stored in a Unity Catalog table that contains sensitive customer information. The data scientist needs to read the table but should not be able to see the raw values of certain columns. Which Unity Catalog feature should be used to dynamically mask the sensitive columns based on the user's group membership?

Accepted Answer

Dynamic column masking. Dynamic column masking in Unity Catalog enables the data scientist to see masked values for sensitive columns based on their group membership. By applying a column mask that checks group membership, the raw values are hidden from unauthorized users while still allowing the data scientist to read the table for fine-tuning.

Answer

Column-level encryption

Answer

Attribute-based access control

Answer

Row-level security

Question 3

A generative AI team stores prompt/response logs in a Unity Catalog Delta table named `main.genai.interaction_logs`. Compliance requires that the raw `prompt_text` column be readable only by members of the `ai_compliance` group, while all other users querying the table must see the literal string `REDACTED`. Which Unity Catalog feature should be implemented directly on the table to satisfy this requirement without creating a separate view?

Accepted Answer

Column mask. Column masks are the Unity Catalog mechanism designed to transform individual column values based on the caller's group membership while leaving the table itself queryable by everyone. Binding a mask function to prompt_text that checks is_account_group_member('ai_compliance') gives compliance staff the raw text and returns REDACTED to all other users, meeting the requirement on the existing table.

Answer

Row filter

Answer

Dynamic view with a CASE expression

Answer

Attribute-based access control tag

Question 4

A platform team is serving a retrieval-augmented generation application. The vector index is built from a Delta table in Unity Catalog, and the team wants every similarity search executed by an end user to be automatically restricted to documents that user is allowed to see, without maintaining a separate index per department. Which approach best enforces this at query time?

Accepted Answer

Create a row filter function on the source Delta table that filters rows by the invoking user's group membership. Row filters evaluate the invoking user's identity as part of the query, so placing the filter on the source Delta table means every read, including retrieval reads that feed similarity search, is automatically scoped to allowed rows. This keeps a single governed index and avoids per-department duplication while still enforcing per-user document visibility at query time.

Answer

Apply a column mask to the embedding column so unauthorized users receive null vectors

Answer

Build one vector index per department and route queries based on the caller's group

Answer

Grant SELECT only to a service principal and have the application connect as that principal for all users

Question 5

A generative AI engineer registers a model in Unity Catalog and wants a downstream application to call it for inference without granting the application broad workspace access. The engineer is told to grant a specific Unity Catalog privilege on the registered model so the application can invoke it. Which privilege should be granted?

Accepted Answer

EXECUTE. Registered models in Unity Catalog are invoked under the EXECUTE privilege, which authorizes a principal to call the model without granting ownership or modification rights. Granting EXECUTE to the application's identity, alongside any needed USE CATALOG and USE SCHEMA to resolve the path, provides least-privilege inference access for the downstream application.

Answer

SELECT

Answer

MODIFY

Answer

USE CATALOG

Question 6

A GenAI engineer is deploying a RAG application that uses Databricks Vector Search and a Foundation Model API. The solution must comply with governance policies that require all data access and model invocations to be auditable and access-controlled at a fine-grained level. Which two Unity Catalog features should the engineer leverage to meet these requirements? (Choose two.)

Accepted Answer

Unity Catalog privileges on the Vector Search index and the source Delta table.. Unity Catalog privileges on the Vector Search index and source table provide fine-grained access control, ensuring only authorized users can retrieve data. Inference tables for the Foundation Model API automatically log requests and responses, including user identity, creating an audit trail. Together, these features meet the access-control and auditability requirements for the RAG application.

Answer

Unity Catalog volumes to store the model weights and configuration files.

Answer

Cluster policies to restrict the types of clusters that can access the data.

Answer

Databricks SQL dashboards to visualize access patterns and model usage.

Question 7

A company is preparing a generative AI application for production and must demonstrate that model inputs and outputs are traceable and that access to sensitive prompt data is controlled. Which TWO Unity Catalog capabilities should the team rely on to meet these governance objectives? (Choose two.)

Accepted Answer

Fine-grained privileges on catalogs, schemas, tables, and models. Meeting the governance objectives requires both an enforcement mechanism and an evidence trail. Fine-grained privileges on the relevant catalogs, schemas, tables, and models enforce least-privilege access to sensitive prompt data, while Unity Catalog audit logs record which principals accessed those governed objects, providing the traceability that production compliance reviews demand.

Answer

Embedding caching to reduce inference latency

Answer

Vector index partitioning by document topic

Answer

Automatic hyperparameter tuning of registered models

Question 8

A GenAI engineer registers a vector search index in Unity Catalog that points to a Delta table containing customer support transcripts. The security team requires that when an end-user queries the index through a Databricks notebook, the underlying table's row filter and column mask policies are enforced. Which Unity Catalog feature should the engineer configure?

Accepted Answer

Enable row-level security and column masks directly on the Delta table, and query the vector search index with the user's identity propagated.. Row filters and column masks in Unity Catalog are applied dynamically based on the identity executing the query. When a vector search index is queried with end-user identity propagation, the source table's policies are evaluated, so sensitive transcript fields are masked and rows are filtered according to group membership. This satisfies the security team's requirement without duplicating policies on the index.

Answer

Apply tags to the Delta table columns and rely on tag-based access control to mask values at query time.

Answer

Create a separate vector search index for each user group and assign group-level permissions on those indexes.

Answer

Use a service principal with read access to the Delta table and query the index through that principal.

Question 9

A generative AI engineer trains a model on a Delta table that contains customer support transcripts. Before registering the model, security requires that the training data be classified so that policies can be applied consistently across the lakehouse. The engineer wants to attach a governed label to the transcript column indicating it contains sensitive personal data. Which Unity Catalog feature should be used?

Accepted Answer

A governed tag applied to the column. Governed tags provide a structured, searchable classification layer in Unity Catalog that can be attached to columns and referenced by policy and discovery tooling. Applying a sensitivity tag to the transcript column gives security a consistent label for the training data, enabling uniform policy enforcement and auditability rather than relying on informal comments or access mechanisms.

Answer

A storage credential scoped to the transcript path

Answer

A comment added to the column definition

Answer

A row filter that excludes rows containing personal data

Question 10

A healthcare company uses Databricks to build a RAG application over clinical notes stored in a Unity Catalog table. An auditor requires proof that only authorized personnel can view raw note text, while the RAG application must use embeddings generated from those notes. The team wants to avoid copying data outside Unity Catalog. Which approach best satisfies the auditor while preserving RAG functionality?

Accepted Answer

Create a column mask on the note text column that returns a redacted value for unauthorized users, and grant the RAG service principal access to a separate embeddings table derived from the notes.. A column mask on the sensitive note text column enforces redaction for unauthorized identities at query time, which is auditable. By having the RAG application consume a derived embeddings table instead of raw text, the application retains functionality while raw PHI remains protected. This keeps governance within Unity Catalog and satisfies the auditor's requirement.

Answer

Move the clinical notes to an external location outside Unity Catalog and grant access via cloud IAM roles.

Answer

Grant the RAG application's service principal SELECT on the table and rely on the application to redact note text in its responses.

Answer

Use a dynamic view that filters rows based on the user's group and grant the RAG service principal access to that view.

Question 11

A GenAI engineer is building a chatbot using Databricks Model Serving and needs to ensure that the endpoint can only be invoked by users who have been granted the 'genai_users' group. The endpoint is registered in Unity Catalog. Which configuration is required to enforce this access control?

Accepted Answer

Grant EXECUTE on the model serving endpoint to the 'genai_users' group.. Model serving endpoints registered in Unity Catalog are secured with the EXECUTE privilege. To allow only the 'genai_users' group to invoke the endpoint, an administrator must grant EXECUTE on the endpoint to that group. This ensures that only authorized users can call the endpoint, meeting the access-control requirement.

Answer

Grant USE CATALOG and USE SCHEMA on the catalog and schema containing the endpoint to the 'genai_users' group.

Answer

Attach the endpoint to a cluster that has been granted CAN ATTACH TO for the 'genai_users' group.

Answer

Set the endpoint's owner to the 'genai_users' group and rely on ownership for access.

Question 12

A company is deploying a GenAI chatbot that uses a Databricks Model Serving endpoint hosting a fine-tuned Llama 2 model. The endpoint is registered in Unity Catalog. The security team wants to restrict which groups can invoke the endpoint and also log all inference requests for auditing. Which combination of Unity Catalog and Databricks features should the engineer use to meet these requirements?

Accepted Answer

Grant EXECUTE on the model version to the allowed groups and enable inference tables on the serving endpoint. To control who can invoke a model served by Databricks, you grant the EXECUTE privilege on the model version in Unity Catalog. Inference tables are a built-in feature of Model Serving that automatically log request and response data to a Delta table for auditing and monitoring. This combination directly addresses the security team's requirements for access restriction and request logging.

Answer

Grant USE CATALOG and USE SCHEMA on the model's parent schema and enable verbose logging on the endpoint

Answer

Grant SELECT on the model version to the allowed groups and enable audit logs in the workspace admin console

Answer

Use a personal access token (PAT) with scoped permissions and configure a Delta table as a sink for endpoint logs

Question 13

A GenAI engineer has built a Retrieval Augmented Generation (RAG) application using Databricks Vector Search. The index is created on a Delta table that contains sensitive customer support transcripts. Company policy requires that end users can only retrieve chunks from documents they are authorized to view. The engineer wants to enforce this at query time without duplicating the index. Which approach should the engineer use?

Accepted Answer

Use Databricks Vector Search with the 'filter' parameter in the query, based on user attributes passed from the application.. Databricks Vector Search enables document-level security by allowing metadata filtering at query time. The engineer can include authorization attributes (such as group memberships) as metadata fields when creating the index, then pass a filter expression in the query that matches the user's attributes. This enforces access control without duplicating the index, aligning with the requirement to keep a single index while restricting retrieval to authorized documents.

Answer

Create a separate Vector Search index for each user group and route queries based on the user's group membership.

Answer

Apply Unity Catalog column masks on the embedding column of the source Delta table to redact sensitive text before vectorization.

Answer

Enable Attribute-Based Access Control (ABAC) on the source Delta table using row filter and column mask functions.

Question 14

A data scientist is building a GenAI application that uses the OpenAI API through Databricks external model endpoints. The application must use credentials stored securely in Databricks and must not expose the API key in code or logs. Which Databricks feature should the data scientist use to store and reference the OpenAI API key?

Accepted Answer

Databricks secrets with a secret scope. Databricks secrets provide a secure, encrypted store for sensitive credentials such as API keys. They can be referenced in code and in external model endpoint configurations without revealing the secret value. This meets the requirement to keep the OpenAI API key secure and out of code and logs.

Answer

Unity Catalog volumes with restricted permissions

Answer

Hardcoding the API key in a notebook and then deleting the cell

Answer

Environment variables set in the cluster's Spark configuration

Question 15

A GenAI engineer registers a fine-tuned model in Unity Catalog and wants a downstream application to call it through the Databricks Model Serving endpoint without embedding a long-lived personal access token in the application. The application runs on Azure Databricks and must authenticate as its own identity, and the security team requires that credentials be short-lived and automatically rotated. Which authentication approach should the engineer implement?

Accepted Answer

Use OAuth machine-to-machine authentication with the service principal's client ID and client secret to obtain a short-lived token. OAuth machine-to-machine authentication lets an application present a service principal's client ID and secret to the Databricks OAuth token endpoint and receive an access token with a limited lifetime. The application has its own Unity Catalog identity, permissions can be granted to that principal on the registered model and serving endpoint, and token refresh happens automatically. This is the supported pattern for non-interactive workloads that must avoid long-lived secrets.

Answer

Create a Databricks service principal, generate a personal access token for it, and store that token in the application's environment variables

Answer

Configure the application to use the workspace user's username and password for basic authentication

Answer

Embed a Microsoft Entra ID managed identity token directly in the application source code