Databricks-DA-Assoc Securing Data Practice Question
A data analyst at a multinational bank needs to ensure that queries against a Unity Catalog table 'main.risk.transactions' automatically hide the 'customer_ssn' column for users in the 'contractors' group, while all other users see the full data. The analyst wants to implement this without creating separate views for each user group. Which Unity Catalog feature should the analyst use?
⚠ Common exam trap
Many exam-takers confuse row-level security with column-level masking; row filters hide rows, not columns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Column mask with a masking function
Column masks in Unity Catalog allow you to apply a masking function to a column that evaluates the user's identity and returns a masked value for specific groups. This directly satisfies the requirement to hide 'customer_ssn' for contractors while showing it to others.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Row-level security with a filter function
Why it's wrong here
Row-level security filters rows based on a condition, not columns. It would hide entire rows for contractors, but the requirement is to hide a specific column while still showing other columns for those rows. Therefore, row filters do not meet the need.
- ✓
Column mask with a masking function
Why this is correct
Column masks allow you to apply a function to a column that returns a masked value based on the user's group membership. The analyst can create a mask that returns NULL or a redacted value for the 'contractors' group and the original value for others. This meets the requirement without separate views.
- ✗
Attribute-based access control (ABAC) with tags
Why it's wrong here
ABAC with tags is a feature for governing access based on tags, but it does not directly provide column masking. It can be used to enforce policies, but the specific requirement of hiding a column for a group is achieved through column masks, not ABAC alone.
- ✗
Dynamic view with a CASE statement
Why it's wrong here
A dynamic view can conditionally show data based on the user, but it requires creating a view and granting access to it instead of the base table. The requirement is to apply security directly to the table without separate views. While dynamic views work, they are not the native feature for column masking.
About these practice questions
Courseiva writes every Databricks-DA-Assoc question from scratch — 291 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-DA-Assoc practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-DA-Assoc exam.