Describe considerations for working with non-relational data on Azure →hardMultiple ChoiceObjective-mapped
DP-900 Practice Question: Describe considerations for working with non-relational data on Azure
A company uses Azure Databricks to process data stored in Azure Data Lake Storage Gen2. They need to enforce fine-grained access control on files and folders based on user identity. Which security feature should they implement?
⚠ Common exam trap
Many exam-takers confuse Azure RBAC (which controls management-plane access) with ACLs (which control data-plane access at the file/folder level), leading them to select RBAC when fine-grained data access is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access control lists (ACLs)
Access control lists (ACLs) on Azure Data Lake Storage Gen2 provide POSIX-compliant, fine-grained permissions at the file and folder level. This allows you to grant read, write, or execute permissions to specific users or groups, which is exactly what is needed for enforcing identity-based access control on individual files and folders.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storage account firewall rules
Why it's wrong here
Storage account firewall rules act at the network layer, controlling which IP ranges or virtual networks can establish connections to the storage account's endpoints. They cannot discriminate between individual files or folders, nor do they carry information about the user identity making the request. In Azure Databricks, even if a firewall rule permits a cluster's egress IP, it does not grant any permission to read or write specific data—it simply allows the TCP connection to occur. Therefore, firewall rules are irrelevant for achieving per-file or per-user authorization.
- ✗
Shared access signatures (SAS)
Why it's wrong here
A shared access signature (SAS) is a URI-based token that conveys delegated permissions (read, write, list, etc.) for a storage account, container, or blob, but it is not tied to a specific user's identity or Azure AD principal. While a SAS can be scoped to a container or even a blob, it cannot express POSIX-style permissions like read/write/execute for specific named users or groups on a directory hierarchy in Data Lake Storage Gen2. Moreover, a SAS is typically shared among many users or processes, so it offers no way to enforce individual access rights to subdirectories or files. Because Databricks needs per-user or per-group file-level control, SAS tokens are an inadequate and non-identity-based mechanism.
- ✓
Access control lists (ACLs)
Why this is correct
Access control lists (ACLs) in Azure Data Lake Storage Gen2 provide fine-grained, POSIX-compliant permissions on every file and directory, exactly what is required to control data access within Azure Databricks. Each ACL entry associates a specific user, group, or the owning principal with a combination of read, write, and execute permissions on a specific object, enabling precise authorization separate from network or token-based mechanisms. Databricks clusters can leverage the cluster's managed identity or service principal to authenticate, and then ACLs govern which identities can traverse, list, read, or modify each folder and file down to the leaf level. This makes ACLs the correct choice for enforcing user-level data permissions on data stored in Azure Storage that Databricks processes.
- ✗
Azure RBAC roles on the storage account
Why it's wrong here
Azure RBAC roles on the storage account, such as Storage Blob Data Contributor, grant broad access to all blobs and directories within the scope of the role assignment, typically the entire storage account or container. This coarse-grained model cannot differentiate between files inside the same container, nor can it grant different permissions to different users on a per-path basis. While RBAC roles are essential for controlling high-level data-plane operations and can assign ownership that modifies ACLs, they do not replace the fine-grained, per-node permissions that ACLs provide. For Databricks scenarios requiring granular access to specific files, ACLs are the necessary complement to account-scoped RBAC.
Visual reference
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Azure Databricks
Azure Databricks is a fast, easy, and collaborative Apache Spark-based analytics platform optimized for Azure that lets data teams prepare data, run machine learning models, and build data pipelines using a single workspace.
About these practice questions
Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.