CCNA Securing Data Questions

Unity Catalog supports fine-grained governance through column-level access controls and dynamic masking functions. Administrators can restrict column visibility directly by revoking SELECT privileges on specific columns or by applying SQL-based masking functions that evaluate user attributes at query time. These native capabilities ensure sensitive information remains protected across all notebooks, dashboards, and SQL queries without duplicating physical data assets.

To allow a service principal to read from an external location, the analyst must grant the service principal `READ FILES` on that external location. The external location is the Unity Catalog securable that combines the cloud storage path with the storage credential, and it is the object against which privileges are granted. The storage credential itself is not granted to users.

The IAM policy only grants 's3:GetObject' and 's3:ListBucket', which are read-only permissions. The 'DROP TABLE' command in Databricks requires 's3:DeleteObject' permission on the underlying data to remove the files from S3. Because the policy lacks delete permissions, the operation is blocked by the cloud provider, even if the user has the 'DROP' privilege in Databricks.

To investigate unauthorized access attempts, the analyst should filter audit logs for `permissionDenied` events. These events are generated when a user lacks the required privileges for an action, such as querying a table. Other event types like `tableAccess` or `sqlQuery` focus on successful operations or query details, not permission failures. `login` events are about authentication, not table access.

Column masks in Unity Catalog allow conditional redaction of sensitive column values based on the querying user's identity or group memberships. By applying a mask function to the `ssn` column, the analyst can ensure that only members of `hr_admins` see the real values, while others see a masked placeholder. This satisfies the requirement without changing how users query the table.

In Unity Catalog, the user must have the USAGE privilege on every schema involved in a query, even if they have SELECT access on the tables within those schemas. If the 'default' schema lacks the USAGE grant for the group, the query engine cannot validate the path to the data, causing the join to fail at the permission check level despite table-level SELECT access.

The 'Unity Catalog' audit log category records all actions performed within the metastore, including access attempts. By monitoring this log, security analysts can identify unauthorized 'SELECT' or 'DESCRIBE' attempts that failed due to permission denials. This is critical for detecting potential internal threats or misconfigured access policies that could lead to unauthorized data exposure.

Securing an external location in Unity Catalog involves creating a Storage Credential, linking that credential to an External Location, and granting specific permissions on that location. This layered approach ensures that access is controlled at both the cloud identity level and the Databricks governance level, allowing administrators to audit all access to external storage paths through Unity Catalog logs.

A Storage Credential is an object in Unity Catalog that encapsulates long-term cloud provider credentials (like an AWS IAM role or Azure Service Principal). It allows Databricks to access data in cloud storage without requiring users to configure individual cloud credentials on every cluster. This centralizes security by keeping sensitive cloud keys away from end users and developers.

Delta Sharing is an open protocol that enables the secure exchange of data across different organizations without requiring them to have accounts in the same Databricks workspace. The Unity Catalog metastore acts as the central control point for these shares. By creating a 'Share' object, an administrator defines exactly which tables are shared, and the recipient uses a token to access that data securely.

To grant read access to a specific table in Unity Catalog, the SELECT privilege must be granted on that table. This allows the user to query the table's data while leaving other tables inaccessible. Schema- or catalog-level grants are broader and would inadvertently expose additional data, so they are not suitable for this scenario.

Unity Catalog provides robust security primitives including standard SQL GRANT/REVOKE commands and dynamic masking. By using these features, administrators can define who sees what data without altering the underlying data files. These two methods are the standard, best-practice approaches for ensuring that sensitive data is protected while maintaining a clean, performant analytics environment for end users.

Unity Catalog audit logs capture data access events, including user, timestamp, and action, for tables governed by Unity Catalog. The 'unityCatalog' service is the correct source for investigating access to 'main.finance.payroll'.

To share a table with an external partner, the analyst must create a share in Unity Catalog, add the table to the share, and then grant the recipient access to the share. The recipient can then use the Delta Sharing protocol to read the data. A share is the container for shared data, while a recipient identifies the external party.

Row-level and column-level filtering in Unity Catalog allow administrators and data owners to secure fine-grained access to tables using SQL functions. By applying a dynamic view with conditional logic, users see only permitted rows and columns. This ensures regulatory compliance and data minimization principles are met without duplicating physical storage assets across different business units.

Column masks in Unity Catalog allow you to apply a masking function to a column that evaluates the user's identity and returns a masked value for specific groups. This directly satisfies the requirement to hide 'customer_ssn' for contractors while showing it to others.

Customer-managed keys (CMK) for managed storage in Unity Catalog are configured at the storage credential or metastore level when establishing the root storage location. This ensures that all managed tables and volumes created within that storage root automatically leverage the specified encryption key, enforcing enterprise compliance policies transparently across all downstream data assets and analytics workloads.

In Unity Catalog, views execute with the permissions of the view owner, not the querying user. If the view owner lacks SELECT on the underlying table, the view cannot access the data, resulting in a permission error for any user. The analyst's privileges on the view are sufficient, but the owner must have the necessary privileges on the base table.

The `BROWSE` privilege in Unity Catalog is specifically designed to allow users to discover and view metadata of objects without accessing the data. Granting `BROWSE` on the table or its parent objects satisfies the requirement. Other privileges like `SELECT`, `USAGE`, or `MODIFY` either grant data access or are insufficient for metadata visibility.

The Account Admin role is the highest level of privilege in Databricks, providing control over the entire account including metastore creation, user provisioning, and billing. This role is responsible for the foundational security configuration of the environment. Because of its power, this role should be restricted to a very small number of individuals to prevent unauthorized changes to security or governance policies.

Unity Catalog requires that all users and groups are managed at the account level rather than individual workspace levels. By using an Account-level metastore, Databricks ensures a single source of truth for identities and permissions. This centralized model simplifies auditing, security, and data sharing, as permissions propagate consistently across all workspaces linked to that specific metastore.

Granting granular access in Unity Catalog is performed using standard SQL GRANT syntax. To allow a user to read data from a specific table, the SELECT privilege must be granted directly on that table securable object while ensuring parent container traversal permissions are present.

To enforce least privilege, the analyst should not have direct file access when table-level access suffices. `READ FILES` on the external location allows bypassing Unity Catalog table permissions, so it must be removed. `SELECT` on the table remains to allow querying, while `USAGE` on the schema and `BROWSE` on the catalog are unrelated to file-level reads.