Databricks-DE-Pro Data Security and Compliance Practice Question
A Data Engineer needs to encrypt data at rest within a Databricks workspace that uses a customer-managed key (CMK). What is the primary purpose of this configuration?
⚠ Common exam trap
Candidates often confuse CMK with data-in-transit encryption (TLS) or think it is primarily for performance acceleration. They miss that CMK is strictly about administrative control over encryption key lifecycles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To control the lifecycle of the encryption keys used for storage.
Using a customer-managed key (CMK) provides an additional layer of security and control over data at rest in cloud storage, such as S3 or ADLS. By managing the key in the cloud provider's Key Management Service (KMS), the organization can revoke access to the data at any time by disabling the key. This is a common requirement for high-compliance industries that need verifiable control over their encrypted data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To increase the read throughput of Delta tables.
Why it's wrong here
Customer-managed keys are a security feature, not a performance optimization tool. While they provide robust encryption, they do not impact the underlying I/O performance of Delta Lake. Performance improvements are achieved through techniques like Z-Ordering, partitioning, and using efficient file formats, not through key management configurations.
- ✗
To enable transient data encryption for cluster nodes.
Why it's wrong here
Transient data encryption on cluster nodes is handled by the platform's standard disk encryption. CMK is specifically focused on the long-term encryption of data at rest within the underlying object storage layer, providing a mechanism for regulatory compliance and total data access revocation by the customer.
- ✓
To control the lifecycle of the encryption keys used for storage.
Why this is correct
The primary purpose of CMK is to allow the organization to manage the lifecycle of encryption keys. This includes rotation policies and the ability to immediately revoke access to the storage account, ensuring that the cloud provider cannot access the data without the customer's active cooperation.
- ✗
To bypass the need for Unity Catalog permissions.
Why it's wrong here
Encryption and access control are separate security domains. Even with CMK, Unity Catalog permissions are still strictly required to govern who can query the data. CMK protects the data files in storage; Unity Catalog governs the SQL-level access for users and service principals within the workspace.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This Databricks-DE-Pro question is part of Courseiva's 267-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-DE-Pro practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-DE-Pro exam.