Databricks-DE-Assoc Governance and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CREATE VIEW sales.raw.transactions_masked AS SELECT *, CASE WHEN is_member('auditors') THEN credit_card_number ELSE CONCAT('************', RIGHT(credit_card_number, 4)) END AS credit_card_number FROM sales.raw.transactions;

  Why it's wrong here

  Creating a view with conditional logic is a valid alternative for masking, but it does not meet the requirement as directly as a column mask. The view would need to be used instead of the base table, and users would need to be granted access to the view, not the table. The question specifies using a column mask, and this option does not use the column mask feature. Additionally, the view approach requires managing permissions on the view and ensuring users do not access the base table.

• ✓

  CREATE FUNCTION mask_ccn(ccn STRING) RETURNS STRING RETURN CASE WHEN is_member('auditors') THEN ccn ELSE CONCAT('************', RIGHT(ccn, 4)) END; ALTER TABLE sales.raw.transactions ALTER COLUMN credit_card_number SET MASK mask_ccn;

  Why this is correct

  This approach creates a user-defined function that checks group membership using is_member and applies the mask conditionally. Then, the ALTER TABLE statement sets the mask on the column. This is the correct way to implement column-level masking in Unity Catalog, as it allows dynamic masking based on the user's group membership. The function must be created in a schema that the users have access to, and the mask is applied at query time.

• ✗

  GRANT SELECT ON TABLE sales.raw.transactions TO auditors; DENY SELECT ON TABLE sales.raw.transactions TO users;

  Why it's wrong here

  Unity Catalog does not support DENY statements. Privileges are additive, and access is determined by GRANTs. While you can grant SELECT to auditors, you cannot deny SELECT to other users. To restrict access, you would need to revoke privileges from other groups, but that would remove their ability to query the table entirely, not just mask the column. This approach does not achieve column-level masking.

• ✗

  ALTER TABLE sales.raw.transactions ALTER COLUMN credit_card_number SET MASK CONCAT('************', RIGHT(credit_card_number, 4));

  Why it's wrong here

  The SET MASK clause expects a function name, not an inline expression. You cannot directly specify an expression like CONCAT in the ALTER TABLE statement. A user-defined function must be created first and then referenced by name. This option would result in a syntax error or fail to apply the mask correctly. The correct approach involves creating a function and then setting the mask to that function.