Data Engineer Associate · 15% of the exam

Governance and Security: free practice questions

5 sample questions from our 30-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real Databricks exam.

1. A data engineer creates the following view in Unity Catalog: CREATE VIEW finance.reporting.employee_salaries AS SELECT employee_id, department, CASE WHEN is_account_admin() OR current_user() = manager_email THEN salary ELSE NULL END AS salary FROM finance.hr.salaries; What is the PRIMARY security pattern this view implements?

  • A. Row-level security — hiding specific rows from unauthorized users
  • B. Column-level security — masking a sensitive column based on the identity of the querying user✓ Correct
  • C. Schema-level security — preventing users from seeing the schema of the underlying table
  • D. Table-level security — blocking direct access to the underlying table entirely
Explanation

The view returns all rows but replaces the salary column value with NULL for users who are neither account admins nor the relevant manager. This is column-level security (also called column masking) — the column is present in the result but its value is hidden/masked based on user identity. It is not row-level security (option A) because no rows are filtered out with a WHERE clause; all rows are returned, just with masked values for unauthorized users. Schema-level security (option C) would mean preventing users from viewing the schema definition, which this view does not do. Table-level security (option D) would mean blocking access to the base table entirely through REVOKE or permission denial, not through a view that still returns all rows.

2. A column contains sensitive values that should be obscured for most users but visible to a privileged group. Which feature fits?

  • A. A column mask✓ Correct
  • B. Dropping the column entirely
  • C. A cluster policy
  • D. Delta time travel
Explanation

A column mask dynamically transforms/obscures a column's values based on the querying principal. Dropping the column (B) removes it for everyone, and cluster policies (C) and time travel (D) don't mask data.

3. A data engineer is building a Delta pipeline that writes processed records to a Unity Catalog managed table. They notice that after running the pipeline, they can see the table's full data lineage — including upstream source tables — in the Databricks Data Explorer without writing any additional code. What Unity Catalog feature is responsible for capturing this information automatically?

  • A. Unity Catalog system tables
  • B. Delta Lake transaction log
  • C. Automated lineage tracking✓ Correct
  • D. Data quality rules defined with CONSTRAINT clauses
Explanation

Unity Catalog automatically captures column-level and table-level data lineage for queries run on Databricks clusters and SQL warehouses that use Unity Catalog. No extra configuration or code is needed — lineage is tracked passively whenever data is read or written. Option A (system tables) is where lineage and audit data is stored and queryable, but system tables are the storage mechanism, not the feature that captures lineage. Option B (Delta Lake transaction log) records operations on a specific Delta table but does not track cross-table lineage. Option D (CONSTRAINT clauses) is a data quality feature and has no relationship to lineage tracking.

4. A company stores raw CSV files in an AWS S3 bucket that is managed by their data platform team. A data engineer wants to register this S3 location as a table in Unity Catalog so that if the table is dropped, the CSV files are NOT deleted. Which table type should the engineer create?

  • A. A managed table pointing to the S3 path
  • B. An external table pointing to the S3 path✓ Correct
  • C. A Delta Live Tables dataset backed by the S3 path
  • D. A materialized view over the S3 path
Explanation

An external table in Unity Catalog is backed by a user-specified storage location (like an S3 path). When an external table is dropped, only the metadata is removed from the metastore; the underlying data files at the external location are left intact. This is exactly the behavior required. A managed table would cause data files to be deleted when the table is dropped, which violates the requirement. A Delta Live Tables dataset is a pipeline construct and is not the same as directly registering a pre-existing CSV location as a table. A materialized view is a computed, read-only object derived from a query — it does not directly map raw CSV files from an external path as a regular queryable table.

5. A data engineer needs to grant a group called `bi_team` the ability to query tables within the schema `analytics.reporting`, but does NOT want them to be able to create, modify, or drop any objects. Which combination of privileges is the minimum required?

  • A. GRANT USE CATALOG ON CATALOG analytics, GRANT USE SCHEMA ON SCHEMA analytics.reporting, GRANT SELECT ON SCHEMA analytics.reporting✓ Correct
  • B. GRANT SELECT ON SCHEMA analytics.reporting
  • C. GRANT USE CATALOG ON CATALOG analytics, GRANT SELECT ON SCHEMA analytics.reporting
  • D. GRANT USE CATALOG ON CATALOG analytics, GRANT USE SCHEMA ON SCHEMA analytics.reporting, GRANT SELECT ON TABLE for each individual table
Explanation

In Unity Catalog, privileges are not implicitly inherited down the hierarchy — a principal must have USE CATALOG on the parent catalog, USE SCHEMA on the parent schema, and SELECT on the tables (or on the schema to cover all tables). Option A correctly grants all three necessary privilege levels, and granting SELECT ON SCHEMA covers all current and future tables without needing per-table grants. Option B fails because USE CATALOG and USE SCHEMA are required to traverse the namespace — SELECT alone is insufficient. Option C is missing USE SCHEMA, so the bi_team cannot enter the schema. Option D is unnecessarily granular (per-table grants) and still covers the required hierarchy, but granting SELECT on the schema (as in A) is simpler and equally valid; the real issue with D is that it omits USE SCHEMA, making it incomplete as written.

25 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free
Governance and Security — Free Data Engineer Associate Practice Questions | DataCertPrep — Certification Prep