CCNA Data Security Compliance Questions

Unity Catalog lineage maps dependencies between tables, including views and downstream transformations. This is essential for compliance, as it allows engineers to see the flow of sensitive data through the ETL pipeline, making it easier to ensure that masking policies are applied to all downstream, derived datasets.

Databricks diagnostic logs include audit logs that record Unity Catalog data access and privilege changes. Delivering these logs to cloud storage such as S3, ADLS, or GCS allows the security team to retain and analyze them. This is the standard mechanism for capturing audit events for compliance, and it covers table access and GRANT/REVOKE operations.

Row filters in Unity Catalog allow for defining an expression that acts as a WHERE clause. By using the 'is_account_group_member' function, you can ensure that only members of the specified HR group see rows containing PII. This is the most efficient and manageable way to enforce granular row-level data access.

Unity Catalog requires a strict three-level namespace. During migration, existing objects must be mapped to this structure. Failure to do so will prevent the object from being accessible within the new governed environment, potentially leading to downtime or security gaps during the transition from the legacy Hive metastore.

The 'USE CATALOG' privilege is required to access any object within a catalog. By granting this to the user, you enable them to traverse the hierarchy to reach the schema and the table. This is the minimum required privilege to fix the broken path and resolve the access error.

Centralized access control is a core feature of Unity Catalog. It allows administrators to define permissions once in a single catalog and apply them consistently across all workspaces attached to that metastore. This drastically reduces the administrative burden and minimizes the risk of inconsistent security policies across environments.

SELECT is the privilege that allows reading data from a table in Unity Catalog. Granting SELECT on sales.orders to the service principal gives it the ability to query the table, which is the minimum required for read access. This follows the principle of least privilege and does not grant unnecessary capabilities such as modifying data or changing metadata.

Unity Catalog provides system tables that contain audit logs. The 'system.access.audit' table records all access events, including data access, and can be queried directly in Databricks SQL or a notebook. This table is part of the system schema and is automatically populated when audit logging is enabled. It is the correct object for querying audit logs within Unity Catalog.

IP Access Lists are the specific Databricks feature designed to restrict access based on source IP. By defining a set of allowed CIDR ranges, administrators can ensure that users can only interact with the Databricks environment from authorized network locations, satisfying critical security and compliance requirements for enterprise clients.

This is the supported pattern: the storage credential assumes a customer IAM role, and the role's trust policy permits only the Unity Catalog metastore's IAM role to assume it. Because the bucket policy or role permissions allow access only through that path, users cannot read the bucket with their own credentials, and Unity Catalog mediates all access. Granting the credential to the external location completes the wiring.

Unity Catalog provides a centralized point to manage access control. Instead of configuring permissions in every workspace, an admin can grant access in Unity Catalog, and those permissions are honored across every workspace connected to the metastore. This significantly reduces administrative overhead and ensures a uniform security policy everywhere.

Unity Catalog storage credentials for S3 use an IAM role that Databricks assumes. The credential stores the role ARN, and the trust policy must allow the Databricks AWS account principal to assume the role, optionally with an external ID for confused deputy protection. This meets the no-long-lived-keys requirement and is the standard secure configuration.

The 'SELECT' privilege specifically allows for data retrieval from the table. It does not grant 'MODIFY' or 'OWNER' privileges, meaning the group cannot change the schema, drop the table, or alter metadata. This maintains a clean separation of duties between data consumers and data owners within the environment.

PATs provide a mechanism for scripts to authenticate with Databricks without interactive logins. Because they are long-lived, if they are hardcoded in scripts or exposed in logs, they provide an attacker with persistent access to the user's workspace, creating a significant security vulnerability if not rotated regularly.

A Unity Catalog storage credential encapsulates an IAM role that Databricks assumes using AWS STS to obtain temporary credentials. This avoids storing long-lived credentials in Databricks and allows the security team to control access via the IAM role's trust policy. It is the correct way to authenticate access to an S3 bucket from Unity Catalog.

A column mask function can branch on the current user's groups using functions such as `is_account_group_member`, returning the raw value for `compliance` and a masked value for everyone else. This centralizes the logic and ensures analysts receive only the truncated SSN or hashed email while compliance sees full data. Without this conditional function, the mask cannot differentiate the two groups.

Configuring the Databricks workspace to use a Customer Managed Key for the DBFS root ensures that all data stored in the default storage location is encrypted with your specific KMS key. This fulfills the compliance requirement by centralizing the cryptographic control of data at the root storage level.

Row filters in Unity Catalog apply a SQL UDF that evaluates per row and returns a boolean, allowing you to restrict which rows are visible. This is the correct feature to filter out rows where the `region` is not in the user's allowed regions, based on the invoking user's identity or group membership.

The primary purpose of CMK is to allow the organization to manage the lifecycle of encryption keys. This includes rotation policies and the ability to immediately revoke access to the storage account, ensuring that the cloud provider cannot access the data without the customer's active cooperation.

An external location combines a storage credential with a cloud storage path. After creating the storage credential, you must create an external location that points to the S3 bucket path and uses that credential. Then, you grant privileges like CREATE EXTERNAL TABLE or READ FILES on the external location to users or groups. This is the required step to enable access.

Delta Sharing is a secure data sharing protocol that allows sharing data across organizations without copying it. The provider creates a share containing the table and grants the recipient access. The recipient reads the data using their own compute, and the data remains in the provider's storage. This minimizes operational overhead and meets the requirement of not copying data outside the provider's storage.

Using a temporary group is a best-practice method for managing project-based access. When the project ends, the user is removed from the group, effectively revoking their access immediately. This approach is clean, transparent, and easy to audit, satisfying security requirements for managing temporary data access for external or internal collaborators.

Granting permissions to groups rather than individual users simplifies access management and reduces the risk of human error. When a new user joins a team, they automatically inherit the correct permissions by being added to the relevant group, ensuring consistent security posture across the entire data platform.

Unity Catalog supports masking policies using SQL functions. By defining a function that checks for group membership and returns either the original or masked value, you apply a central policy. This is the official and most efficient method to handle dynamic masking requirements across the entire organization.

The Service Principal must originate in the cloud provider's IAM system, such as AWS IAM or Azure AD. This provides the identity that Databricks will use to authenticate requests, ensuring that the identity is managed and secured according to the organization's enterprise-wide security standards and policies.

Unity Catalog automatically records access events, including the user identity, for all queries against Unity Catalog objects. These events are written to the account-level audit log. To meet the 365-day retention requirement, the audit log must be delivered to a cloud storage location configured with the necessary lifecycle policy. No additional cluster-level setting is needed to capture the user identity.

The Metastore Admin has the authority to configure the root storage location and create catalogs, which are the containers for all other data objects. This role is responsible for the overall hierarchy and security structure of the data estate, making it the most critical role for initial setup.

Column masking in Unity Catalog allows administrators to define functions that dynamically redact or obscure data based on the user's role. This provides a unified, policy-driven approach to data security that is applied at query time, ensuring compliance without the complexity of managing numerous views or physical tables.