Databricks-DE-Pro Data Governance Practice Question
A data engineer needs to restrict access to personally identifiable information (PII) columns in a Unity Catalog table for a group of analysts. Which Unity Catalog feature should be used to enforce this policy while ensuring data remains queryable?
⚠ Common exam trap
Candidates often suggest creating separate views for each user role. This leads to 'view explosion,' which is difficult to maintain and audit compared to centralized column masking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a column mask using SQL functions to redact data for the analyst group.
Dynamic views or Row-level security (RLS) and Column-level security (CLS) are essential for compliance. By utilizing SQL functions like current_user() within a defined mask, you ensure that PII is obscured based on user identity. This approach centralizes security within the data platform, preventing the need to duplicate datasets for different access levels, which significantly reduces the administrative burden and minimizes the risk of unauthorized data exposure in production environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a static mask using a custom UDF during data ingestion.
Why it's wrong here
Static masking during ingestion permanently alters the data, which is detrimental for downstream users who may require the raw values for legitimate business analysis. This approach lacks the flexibility required for role-based access control and makes it impossible to revert the changes for authorized users without re-processing the entire dataset.
- ✗
Grant the analyst group SELECT access on the table and instruct them to cast PII columns to null.
Why it's wrong here
Relying on end-users to manually mask their own queries is fundamentally insecure and prone to human error or malicious intent. Data governance requires programmatic enforcement of policies that operate independently of user behavior to maintain regulatory compliance and prevent accidental data leakage across the organization's analytical workflows.
- ✓
Define a column mask using SQL functions to redact data for the analyst group.
Why this is correct
Unity Catalog column masking allows engineers to apply granular security policies directly to table columns. By defining a mask, the platform automatically redacts data based on the user's role at query time, ensuring compliance without modifying the underlying storage. This provides a clean separation between data storage and security enforcement.
- ✗
Create separate physical tables for analysts containing only non-sensitive columns.
Why it's wrong here
Creating physical copies for different groups leads to significant data proliferation, increased storage costs, and difficult lineage tracking. Synchronizing these tables whenever the source data updates creates a maintenance nightmare and increases the risk of data inconsistency, making this an unsuitable solution for modern, enterprise-grade data governance strategies.
About these practice questions
Courseiva writes every Databricks-DE-Pro question from scratch — 267 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-DE-Pro practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-DE-Pro exam.