Databricks Data Engineer Professional: Ensuring Data Security and Compliance Practice Questions

Options B and E are correct. To ensure cluster nodes never communicate over the public internet, two complementary controls are required: (1) A customer-managed VPC (BYOVPC) with private subnets ensures cluster nodes are deployed in private network segments with no direct public internet routing. (2) Secure Cluster Connectivity (SCC / No Public IP) ensures that cluster nodes have no public IP addresses and all control plane communication flows through a Databricks-managed secure relay (using an outbound-only channel), eliminating inbound public access requirements.

Option A is incorrect in this context: Databricks Private Link (on AWS) primarily secures the user/application-to-control-plane traffic (i.e., API calls, notebook access) and the control-plane-to-data-plane traffic over PrivateLink. While valuable, Private Link alone without BYOVPC and SCC does not fully address cluster node public IP exposure.

Option C is incorrect: IP Access Lists restrict which IPs can access the Databricks web UI and API — they are a user-facing access control, not a data plane network isolation control. They do not affect how cluster nodes communicate.

Option D is incorrect: A NAT Gateway enables outbound internet access from private subnets. While it hides private IPs behind a single public IP, it still routes traffic over the public internet. This does not achieve the goal of keeping all traffic on private AWS infrastructure.

Option D is correct. The token lifetime policy is configured in the workspace Admin Console under Settings > Access Tokens (or the equivalent 'Token Management' section). When an admin sets a maximum token lifetime, Databricks immediately revokes all existing tokens whose remaining lifetime exceeds the new maximum. This is a deliberate security enforcement behavior — it ensures the policy takes effect immediately rather than allowing non-compliant tokens to remain valid.

Option C is incorrect: Existing tokens ARE affected when the policy is applied. Tokens that would exceed the new maximum lifetime are revoked immediately, not grandfathered in. This is a common misconception that could cause operational disruption if admins assume existing tokens are safe.

Option B is incorrect: Token expiration policy is a workspace-level setting, not an account-level setting. Each workspace manages its own PAT policies independently through its own Admin Console.

Option A is incorrect: Databricks does provide a configurable maximum token lifetime policy. This is a built-in security feature of the platform, not dependent on manual processes.

In Databricks audit logging, SQL query execution events are captured under action_name = 'commandSubmit' (or runCommand for Jobs), and the SQL text (including the queried table) is embedded in request_params. Filtering on commandSubmit and then inspecting request_params for the table name is the correct approach for finding SELECT activity. Option A is wrong because action_name = 'select' is not a valid Unity Catalog audit event name — Unity Catalog data-access events for credential generation use different action names. Option D describes the generateTemporaryTableCredential action, which is fired when short-lived credentials are vended for cloud storage access — it reflects credential issuance, not every SELECT query, and joining on table_id is complex and incomplete. Option C (parsing raw workspace storage logs) is outdated — SYSTEM.ACCESS.AUDIT is the governed, SQL-queryable surface for audit data and is preferred over raw JSON log parsing.

Option C is correct: the front-end Private Link endpoint exposes the workspace UI and REST API on a private IP within the customer VNet, so traffic never traverses the public internet. Option D is correct: Databricks also supports a back-end Private Link endpoint that routes control-plane-to-data-plane (and data-plane-to-control-plane) traffic privately, which is important for environments requiring full network isolation. Option E is wrong: Private Link is a network-layer feature; data-at-rest encryption with CMK is a separate, independent capability configured through key vault integration. Option A is wrong: NSG rules are still required to control intra-VNet traffic and to restrict outbound access from cluster nodes — Private Link does not replace NSG policy. Option B is partially misleading: while Premium tier is required for many security features, Private Link does use a dedicated subnet for its endpoints, but framing it as a single combined requirement in this way conflates distinct configuration steps.

Option C is correct. Unity Catalog column masks are enforced at the query layer for all supported access paths. The mask function uses IS_ACCOUNT_GROUP_MEMBER to return the real value for hr_managers and NULL for everyone else — exactly the intended behavior.

Option A is incorrect: The mask function itself controls visibility via the IS_ACCOUNT_GROUP_MEMBER check, not via EXECUTE grants on the function for the group. Members of hr_managers see real values because the function returns salary when the condition is true.

Option D is incorrect: Unity Catalog column masks are enforced server-side for all governed access paths including the Delta reader protocol when accessed through Unity Catalog. Bypassing through dbutils.fs at the raw storage level is a separate concern unrelated to how the mask behaves for governed table queries.

Option B is incorrect: ALTER TABLE ... ALTER COLUMN ... SET MASK is the correct and supported DDL syntax to apply a column mask to an existing table in Unity Catalog. Masks do not need to be defined at creation time.