Databricks-DE-Pro Data Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use row-level filters to exclude rows where the user is not in hr_group, effectively hiding sensitive data.

  Why it's wrong here

  Row-level filters restrict which rows are visible, not which column values are shown. Applying a row filter would hide entire rows for non-hr users, potentially removing all employee records, which is not the goal. The requirement is to mask the ssn column value, not to filter rows. Therefore, row-level filters are inappropriate for column masking.

• ✗

  Create a view that selects all columns except ssn, and a separate view that includes ssn for hr_group, then grant appropriate privileges on each view.

  Why it's wrong here

  Using separate views can provide different column sets, but it does not dynamically mask the ssn column for non-hr users while still showing a masked value. The requirement is to show a masked ssn to all users, not to omit it. Moreover, managing multiple views increases complexity and does not leverage Unity Catalog's native masking capabilities. A column mask function is the intended solution.

• ✓

  Create a function that returns the masked value based on IS_MEMBER('hr_group'), then use ALTER TABLE ... ALTER COLUMN ssn SET MASK function_name.

  Why this is correct

  Unity Catalog supports column masks via a user-defined function that dynamically returns a value based on the invoking user's group membership. The function can use IS_MEMBER to check if the user belongs to hr_group and return the full SSN or a masked version accordingly. The mask is applied using ALTER TABLE ... ALTER COLUMN ... SET MASK, which attaches the function to the column. This approach enforces the masking at query time for all users except those in the specified group.

• ✗

  Grant SELECT on the ssn column only to hr_group, and revoke it from all other users.

  Why it's wrong here

  Column-level grants can restrict access to the entire column, but they do not allow partial masking; users either see the full column or none of it. The requirement is for other users to see a masked version, not to be denied access entirely. Therefore, column-level grants alone cannot satisfy the need for masked values. A column mask function is necessary to return transformed data based on group membership.