Databricks-DE-Pro Data Governance Practice Question
A data engineer is configuring a Unity Catalog external location to allow a service principal to write to an ADLS Gen2 container. The storage credential uses a managed identity. The engineer grants the service principal `WRITE FILES` on the external location. However, when the service principal attempts to write, it fails with a permissions error. The engineer verifies that the managed identity has the Storage Blob Data Contributor role on the container. What is the most likely cause of the failure?
⚠ Common exam trap
The trap here is focusing on cloud IAM roles and file-level privileges while overlooking the mandatory `USE EXTERNAL LOCATION` privilege that gates access to the external location itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service principal does not have the `USE EXTERNAL LOCATION` privilege on the external location.
Unity Catalog requires both `USE EXTERNAL LOCATION` and the appropriate file-level privileges (`READ FILES`, `WRITE FILES`) to access data in an external location. The `USE EXTERNAL LOCATION` privilege grants the ability to reference the external location in queries and commands, while `WRITE FILES` allows writing data. Without `USE EXTERNAL LOCATION`, the service principal cannot utilize the external location, resulting in a permissions error despite having `WRITE FILES` and cloud storage permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The service principal does not have the `USE EXTERNAL LOCATION` privilege on the external location.
Why this is correct
In Unity Catalog, to use an external location, a principal must have the `USE EXTERNAL LOCATION` privilege in addition to any file-level privileges like `WRITE FILES`. Without `USE EXTERNAL LOCATION`, the principal cannot access the external location at all, even if it has `WRITE FILES`. The managed identity's cloud permissions are separate and do not grant Unity Catalog access.
- ✗
The service principal lacks the `CREATE EXTERNAL TABLE` privilege on the external location.
Why it's wrong here
`CREATE EXTERNAL TABLE` is required to create tables that reference data in the external location, but the scenario is about writing files directly, not creating tables. The error is a permissions error during a write operation, which is governed by `WRITE FILES`. Granting `CREATE EXTERNAL TABLE` would not resolve a write failure.
- ✗
The external location is missing the `READ FILES` privilege for the service principal.
Why it's wrong here
`READ FILES` is necessary for reading data, but the operation described is a write. While some write operations may require read access to verify paths, the primary privilege for writing is `WRITE FILES`. The error specifically occurs during write, and the service principal already has `WRITE FILES`, so missing `READ FILES` is not the direct cause.
- ✗
The managed identity lacks the Storage Blob Data Reader role on the container.
Why it's wrong here
The scenario states the managed identity has the Storage Blob Data Contributor role, which includes both read and write permissions. The failure is not due to cloud IAM roles but rather Unity Catalog privileges. Adding a reader role would not address the missing Unity Catalog privilege that controls access to the external location.
About these practice questions
One of 267 original Databricks-DE-Pro practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-DE-Pro practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-DE-Pro exam.