Databricks Data Engineer Associate: Governance and Security Practice Questions

An external table in Unity Catalog is backed by a user-specified storage location (like an S3 path). When an external table is dropped, only the metadata is removed from the metastore; the underlying data files at the external location are left intact. This is exactly the behavior required. A managed table would cause data files to be deleted when the table is dropped, which violates the requirement. A Delta Live Tables dataset is a pipeline construct and is not the same as directly registering a pre-existing CSV location as a table. A materialized view is a computed, read-only object derived from a query — it does not directly map raw CSV files from an external path as a regular queryable table.

A Catalog is the correct level of isolation in the Unity Catalog three-level namespace (catalog.schema.table). One catalog per business unit provides a clean namespace boundary while all catalogs still reside under the single account-level metastore. A Metastore is wrong because only one metastore exists per Databricks account region and cannot be multiplied per business unit. A Schema is too granular — it lives inside a catalog and is used to group related tables within a business unit, not to isolate units from each other. A Table is a data object, not a namespace container.

A row filter applies row-level security so different principals see different rows of the same table. VACUUM/OPTIMIZE (B, C) are maintenance, and physical copies (D) defeat the single-source goal.

For a Unity Catalog managed table, Databricks manages the full lifecycle — when the table is dropped, Unity Catalog deletes both the metadata entry in the metastore AND the physical data files in the managed storage location. This is the key distinction from external tables. Option A is incorrect because it describes the behavior of an external table, not a managed one. Option D is a misconception — there is no automatic 30-day recycle bin for managed table data files (though Delta time travel can retain older versions for a configured retention window, the files are not moved to a separate recycle bin). Option C is incorrect; dropping a managed table does not auto-convert it to an external table.

Option A is correct: REVOKE immediately removes the SELECT privilege from reporting_group, so the next query attempt by a member of that group (acting through that group's privilege) will fail with an authorization error. Option B is also correct: Unity Catalog evaluates privileges using union of all group memberships — if the user belongs to another group that still has SELECT on the table, access is granted through that group's privilege. Option E is incorrect: REVOKE takes effect immediately for subsequent queries; there is no concept of 'grandfathering' existing session access. Option C is incorrect: REVOKE is a targeted operation on the specified securable object and does not cascade to other objects in the catalog or schema. Option D is incorrect: The Delta cache stores query result data for performance, but Unity Catalog privilege checks happen at query execution time on the engine regardless of cache state; a user without SELECT cannot query the table.