CCNA Governance and Security Questions

Dynamic Data Masking is a primary control for PII. By masking sensitive columns, you ensure that analysts can work with the data for aggregate statistics without actually seeing raw, identifiable information, which helps satisfy data privacy requirements while maintaining the utility of the dataset for authorized users.

This is the correct sequence. A storage credential encapsulates the cloud permissions required to access the files. Then, the location maps that credential to a specific path. Finally, granting privileges allows users to interact with the data at that location, ensuring a secure and ordered governance workflow.

Data lineage captures the dependencies between tables, views, and notebooks. It shows the flow of data through transformations, which is essential for auditability. By tracking these relationships, data engineers and security officers can verify the provenance of data and fulfill regulatory requirements regarding data processing and handling.

A dynamic view calling a SQL UDF that evaluates IS_MEMBER returns masked or full column values per group, so junior engineers see non-PII only while senior engineers see everything. This enforces row-and-column-level control centrally in Unity Catalog without duplicating tables.

Workspace binding enforces security isolation by mapping specific workspaces to a Unity Catalog metastore. This administrative configuration ensures that data assets governed by the metastore are only accessible through authorized workspaces, requiring proper metastore administration.

Unity Catalog enforces a strict hierarchy consisting of catalog, schema, and table or view. This structure provides a unified way to manage permissions and lineage across different workspaces. Every managed or external object must adhere to this naming convention to be correctly registered within the Unity Catalog metadata store.

Diagnostic logs are the official channel for exporting audit data from Databricks. By streaming these to a workspace-external destination, administrators can aggregate audit data from multiple workspaces into one place, enabling a unified view of all user activity, configuration changes, and data access events for audit and security analysis.

Unity Catalog requires the fully qualified name (catalog.schema.table). Providing only the table name causes the operation to fail because the metastore cannot resolve the resource context. This forces explicit identification of the data, which is a security best practice to prevent unauthorized or unintended access to tables.

Unity Catalog requires USAGE on the catalog and schema to navigate to the table. If these permissions were missing, the user would not be able to traverse the path to the table in Catalog Explorer, even if they had SELECT permissions on the table itself. This is a common security configuration error.

Delta Sharing provides a secure and governed way to share data with third parties. It does not require the recipient to be a user in the provider's environment, thereby keeping the internal workspace secure while allowing controlled access to specific datasets through signed URLs and the Delta protocol.

Unity Catalog audit logs are delivered via a system table or to a cloud storage location configured at the account level. The account console allows setting up audit log delivery to an S3 bucket with an IAM role that grants write access. This centralizes logs for security analysis.

USAGE on the schema is required for any user to access objects within that schema. Without USAGE, even if SELECT is granted on the table, the auditors cannot resolve the table's fully qualified name. This is a necessary prerequisite for table access in Unity Catalog.

SELECT on the table grants read access to its data. WRITE VOLUME on the volume grants the ability to write files to that volume. Together, these privileges meet the requirement for the service principal to read from the table and write to the volume. This combination is precise and follows the principle of least privilege.

The SELECT privilege allows users to read data from the table, which includes querying it and viewing its metadata in Catalog Explorer. It does not grant the ability to modify data or table structure. This is the minimum privilege required for read-only access, aligning with the requirement.

Unity Catalog supports account-level groups as principals. Granting privileges to groups means that when users are added or removed from the group, their effective permissions change without re-issuing grants. This simplifies administration and aligns with least privilege by managing access at the group level rather than per user.

Delta Sharing is specifically designed for secure data exchange across different platforms and accounts. It utilizes an open-source protocol that allows the recipient to query data directly from your storage without needing to copy the data, ensuring the provider maintains full control over access policies and auditing throughout the process.

This is the correct syntax to apply a column mask function in Unity Catalog. The ALTER TABLE ... ALTER COLUMN ... SET MASK command associates the masking UDF with the column. When users without UNMASK privilege query the table, the function is applied to the column value, returning the masked result. Users with UNMASK privilege see the original data.

This approach creates a user-defined function that checks group membership using is_member and applies the mask conditionally. Then, the ALTER TABLE statement sets the mask on the column. This is the correct way to implement column-level masking in Unity Catalog, as it allows dynamic masking based on the user's group membership. The function must be created in a schema that the users have access to, and the mask is applied at query time.

Assigning a dedicated identity allows for granular control over what the automated job can access. By applying the principle of least privilege, you limit the blast radius if the service principal's credentials are ever leaked, ensuring that the automation can only access the specific resources required for its task.

Publishing tables to a sharing object and defining a Delta Sharing recipient is the native architectural pattern. This permits secure, token-based data consumption by external entities directly from cloud storage without exposing internal metastores or workspace credentials.

Column masks in Unity Catalog evaluate the current user's group membership at query time and return a transformed value per row. Applying a mask function to `customer_email` lets `pii_admin_group` see the raw value while others receive the masked domain-only output, satisfying the policy without duplicating the table.

To allow Databricks to assume the IAM role, the role's trust policy must include a principal for the Databricks AWS account (or the specific Databricks IAM role) and grant sts:AssumeRole. This establishes the trust relationship. Without this, Databricks cannot assume the role even if the role has the correct permissions to access S3.

Dropping a Unity Catalog managed table removes both the metadata and the underlying data files from the managed storage location. This is a key distinction from external tables, where only metadata is removed. The deletion is part of the managed lifecycle and happens automatically, so the data is no longer accessible via the table or directly in storage.

To query a view, a user needs `SELECT` on the view and `USE CATALOG` and `USE SCHEMA` on the containing catalog and schema. Unity Catalog views run with the view owner's rights for referenced tables, so no direct privileges on underlying tables are needed. This is the minimum required set.

Diagnostic log delivery streams account and workspace audit logs to cloud storage or event hubs, giving the centralised feed the SIEM requires. This directly satisfies the requirement to capture audit events across multiple workspaces into one security information and event management system.

For Databricks to use the IAM role specified in the storage credential, the role's trust policy must allow the Databricks AWS account (or the Unity Catalog service principal) to assume it. If the trust policy is missing or incorrect, Databricks cannot assume the role, leading to insufficient permissions when creating the external location. This is a common misconfiguration.

Unity Catalog row filters are applied as a SQL user-defined function returning a boolean expression. The UDF evaluates the caller's identity against their assigned territory, so regional analysts only see matching rows, satisfying the stem's dynamic row-level filtering requirement.

Audit logs in Databricks capture detailed information about user activities, including query text, user identity, and timestamps. They are designed for security and compliance auditing. Enabling audit logs and delivering them to a central location satisfies the requirement to log all queries against Unity Catalog tables. This is the correct feature to use.

An external location in Unity Catalog combines a storage path with a storage credential. By granting privileges on an external location, you control which users can create external tables that reference that path. This is the correct object to restrict table creation to specific users. The engineer should create an external location for the S3 bucket and grant CREATE EXTERNAL TABLE or other relevant privileges to the desired users.

Unity Catalog provides a single point of control for managing permissions across all tables, schemas, and catalogs. This centralization eliminates the need for managing separate security policies in multiple workspaces, thereby reducing the risk of misconfiguration and ensuring consistent compliance with organizational data access policies and security standards.

Audit logs record events such as query execution, user identity, and access to Unity Catalog objects. Enabling audit logs and delivering them to cloud storage provides the required traceability for compliance. This is the standard mechanism for capturing query activity across a workspace.

Delta Sharing is an open protocol that lets recipients read shared tables through a recipient object without workspace access or data replication. This satisfies the constraint of secure read-only external sharing while keeping a single governed copy.

The Metastore Admin manages all Unity Catalog resources. They have the authority to grant permissions, manage storage credentials, and create catalogs. This central control is fundamental for the security model, as it ensures there is always an owner with the necessary power to audit and control access.

Storage credentials are the fundamental objects in Unity Catalog that manage cloud-provider access. They hold the necessary permissions for Databricks to interact with cloud storage, allowing administrators to centralize and secure the connection without exposing sensitive cloud keys or requiring users to manage their own cloud identities.

Dynamic Views are the standard method for row-level and column-level security. By embedding the filter condition into the view definition, you ensure that any user querying the view only sees rows that satisfy the predicate, effectively masking data that does not meet the specified security criteria.

Unity Catalog tracks data movement and transformations automatically. This column-level lineage is invaluable for debugging data pipelines, ensuring regulatory compliance, and understanding the impact of changes to downstream reports and dashboards, which was not natively available in the legacy Hive Metastore architecture.

Unity Catalog supports column masks, which are functions that transform column values at query time based on the invoking user's identity. By applying a mask that checks group membership, analysts see masked data while others see full values. This satisfies the requirement without changing existing queries or table references.

Unity Catalog row filter functions are SQL UDFs that take one or more column values as input and return a boolean. The function evaluates to TRUE for rows the user is allowed to see. It can reference the current user or group via functions like is_account_group_member(), enabling dynamic filtering based on identity.

Granting access to the entire bucket via 'arn:aws:s3:::my-bucket/*' is a significant risk. If multiple datasets or environments share a bucket, any cluster using this policy could potentially read or list data it is not authorized to access. Scoping policies to specific prefixes is a mandatory security best practice.

This feature maps the identity of the user running a notebook or job to the storage access request. Instead of the cluster using a single shared service principal, each user's individual permissions are applied, ensuring that the cloud provider's access logs accurately reflect individual user actions during query execution.

Dynamic Data Masking allows you to apply a masking function to columns, ensuring that users only see redacted or transformed versions of sensitive data. This is the precise feature designed to protect PII, such as emails or IDs, while still allowing data analysis on the non-sensitive parts.

The Access Connector enables managed identity authentication, which is the most secure way to connect Databricks to ADLS. By leveraging Azure Active Directory (now Microsoft Entra ID) identities, it removes the need for managing sensitive storage keys, which are prone to leaks and difficult to rotate securely across large teams.

Unity Catalog provides a single metadata store for all workspaces in an account. This eliminates the need to synchronize metadata manually or manage disparate security configurations across different environments. It ensures a consistent view of data, which is essential for scaling data operations securely and efficiently across a large enterprise.

When a table is stored in an external location, writing to it requires WRITE FILES on that external location, in addition to MODIFY on the table. Without WRITE FILES, the service principal cannot write the data files, resulting in an access error. This privilege is often overlooked when granting table-level permissions.

Unity Catalog relies on account-level identities to manage access. This enables a single source of truth for user and group definitions, allowing administrators to apply permissions once and have them respected across all workspaces. This centralization is essential for maintaining consistent security posture and simplifying identity lifecycle management.

Column masks in Unity Catalog allow you to apply a masking function to a column so that users see either the actual value or a masked value based on their group membership. This is the precise feature for restricting access to specific columns. You can define a mask that returns the actual value for the 'finance' group and a masked value for others.