Data Engineer Professional · 10% of the exam

Ensuring Data Security and Compliance: free practice questions

5 sample questions from our 31-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real Databricks exam.

1. An enterprise Databricks deployment uses Unity Catalog. The security team wants to ensure that a service principal used by a nightly ETL job has the minimum permissions required to: (1) read from a source table `raw.events`, (2) write to a target table `silver.events_clean`, and (3) create new tables in the `silver` schema if they don't exist. Which set of grants is the MINIMUM required?

  • A. `GRANT SELECT ON TABLE raw.events TO <sp>; GRANT MODIFY ON TABLE silver.events_clean TO <sp>; GRANT CREATE TABLE ON SCHEMA silver TO <sp>;`
  • B. `GRANT SELECT ON TABLE raw.events TO <sp>; GRANT SELECT, MODIFY ON TABLE silver.events_clean TO <sp>; GRANT CREATE TABLE ON SCHEMA silver TO <sp>; GRANT USE SCHEMA ON SCHEMA raw TO <sp>; GRANT USE SCHEMA ON SCHEMA silver TO <sp>; GRANT USE CATALOG ON CATALOG <catalog> TO <sp>;`✓ Correct
  • C. `GRANT SELECT ON TABLE raw.events TO <sp>; GRANT ALL PRIVILEGES ON SCHEMA silver TO <sp>; GRANT USE CATALOG ON CATALOG <catalog> TO <sp>;`
  • D. `GRANT DATA_READER ON CATALOG <catalog> TO <sp>; GRANT DATA_WRITER ON SCHEMA silver TO <sp>;`
Explanation

Option B is correct. Unity Catalog enforces a hierarchical privilege model: to access any object, a principal must have `USE CATALOG` on the catalog AND `USE SCHEMA` on the schema, in addition to object-level privileges. For the source table: `SELECT` on `raw.events` + `USE SCHEMA` on `raw` + `USE CATALOG`. For the target table: `SELECT` (needed to merge/upsert) and `MODIFY` on `silver.events_clean`. For creating new tables: `CREATE TABLE` on the `silver` schema. All of these plus `USE SCHEMA` on `silver` and `USE CATALOG` are required. Option A is incorrect: It omits the mandatory `USE CATALOG` and `USE SCHEMA` privileges. Without these, Unity Catalog will deny access even if object-level grants exist — the hierarchy must be satisfied. Option C is incorrect: `ALL PRIVILEGES ON SCHEMA silver` grants far more than the minimum required (it includes DROP, for example) and violates the principle of least privilege. The question asks for the minimum. Option D is incorrect: `DATA_READER` and `DATA_WRITER` are not valid Unity Catalog privilege names. Unity Catalog uses specific privileges like `SELECT`, `MODIFY`, `CREATE TABLE`, `USE SCHEMA`, and `USE CATALOG`.

2. A Databricks account admin wants to restrict workspace access so that only requests originating from the company's corporate VPN (IP range `203.0.113.0/24`) and a specific CI/CD server (`198.51.100.42`) are allowed. Which Databricks feature should be configured, and at what scope?

  • A. Configure an IP access list at the **workspace level** in Databricks, adding `203.0.113.0/24` and `198.51.100.42/32` as allowed entries of type ALLOW.✓ Correct
  • B. Configure an IP access list at the **account level** in Databricks, which automatically propagates the rules to all workspaces in the account.
  • C. Add an inbound rule to the workspace's cloud provider Security Group (AWS) or NSG (Azure) allowing only `203.0.113.0/24` and `198.51.100.42`.
  • D. Create a Databricks network policy referencing a Private Endpoint that restricts connections to the specified CIDR ranges.
Explanation

Databricks **IP access lists** are configured at the **workspace level** (via the workspace Admin Settings or the IP Access Lists API). You define ALLOW-list entries with CIDR notation; any request from an IP not on the list is denied. This is the native Databricks control for this requirement. **Option B** is incorrect because Databricks IP access lists are workspace-scoped, not account-scoped — there is no account-level IP access list that automatically propagates to all workspaces; each workspace must be configured independently. **Option C** (cloud Security Group / NSG rules) operates at the network layer and can restrict access to the workspace's VNet/subnet, but these rules are managed in the cloud provider console and apply at the infrastructure level — they are a complementary control but not the Databricks-native IP access list feature the question asks about. **Option D** is a fabricated concept — Databricks does not have a 'network policy' object that references Private Endpoints with CIDR-based filtering in the way described.

3. A company stores a `customers` table in Unity Catalog that includes a `ssn` (Social Security Number) column. A business rule requires that only members of the `pii_readers` group see the actual SSN; all other users must see `'***-**-****'` instead. Which Unity Catalog feature should be used?

  • A. Row filters with a predicate that excludes rows when the user is not in `pii_readers`.
  • B. Column masks defined via a masking function applied with `ALTER TABLE customers ALTER COLUMN ssn SET MASK`.✓ Correct
  • C. A Delta Lake generated column that replaces `ssn` with a hash value for non-privileged users.
  • D. Table ACLs that DENY SELECT on the `ssn` column to users outside `pii_readers`.
Explanation

Unity Catalog **column masks** are the correct feature. You create a masking function (returning either the real value or a redacted string based on `IS_ACCOUNT_GROUP_MEMBER`) and attach it to the column with `ALTER TABLE ... ALTER COLUMN ssn SET MASK <function>`. **Option A** (row filters) filters entire rows — it would hide the whole customer record, not just the SSN, which violates the requirement. **Option C** (generated columns) are computed at write time and are static; they cannot dynamically change their output based on the querying user's identity. **Option D** is incorrect because Unity Catalog does not support column-level DENY ACLs; privilege grants in Unity Catalog are additive, and there is no DENY keyword for individual columns.

4. Data at rest in the Lakehouse and in transit must be encrypted for compliance. Which is TRUE on Databricks?

  • A. Data is encrypted in transit (TLS) and at rest in cloud storage, with options for customer-managed keys✓ Correct
  • B. Encryption must be implemented manually per notebook
  • C. Only column masks provide encryption
  • D. Encryption is impossible on the Lakehouse
Explanation

Databricks encrypts data in transit (TLS) and at rest in the underlying cloud storage, and supports customer-managed keys for additional control. It's not a manual per-notebook task (B), column masks are access control not encryption (C), and encryption is fully supported (D is false).

5. A data engineering team needs to ensure that analysts in the `finance_analysts` group can only see rows in the `transactions` table where `region = 'EMEA'`. The table is registered in Unity Catalog. Which approach correctly implements this requirement?

  • A. Create a view on top of `transactions` that filters `WHERE region = 'EMEA'` and grant SELECT on the view to `finance_analysts`, revoking SELECT on the base table.
  • B. Define a row filter function using `CREATE FUNCTION` with the filter logic, then apply it to the table with `ALTER TABLE transactions SET ROW FILTER` referencing the function and the `finance_analysts` group via `IS_ACCOUNT_GROUP_MEMBER`.✓ Correct
  • C. Add a table property `delta.rowFilter = "region = 'EMEA'"` on the `transactions` table and grant SELECT to `finance_analysts`.
  • D. Use a dynamic view with `CASE WHEN is_member('finance_analysts') THEN region END` in the SELECT clause to hide non-EMEA rows.
Explanation

Unity Catalog native row-level security uses row filter functions. You create a SQL function containing the filter predicate and use `ALTER TABLE ... SET ROW FILTER <function>(<cols>)` to attach it. Inside the function you call `IS_ACCOUNT_GROUP_MEMBER('finance_analysts')` so the filter applies only to that group. **Option A** (a separate view) is a valid older pattern but is NOT Unity Catalog native row filtering — it requires revoking base-table access and managing an extra object, and the question asks about the correct Unity Catalog approach. **Option C** is wrong because `delta.rowFilter` is not a real Delta Lake or Unity Catalog table property; no such property exists. **Option D** describes a CASE-based dynamic view technique that obscures column values rather than filtering rows — it does not actually remove rows from the result set.

26 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free