Microsoft DP-750: Secure and govern Unity Catalog objects Practice Questions

Row filter functions in Unity Catalog allow you to define a SQL function that is automatically applied as a WHERE clause whenever the table is queried, without modifying the table itself. The function can reference current_user() or is_member() to enforce per-user or per-group filtering, exactly meeting the requirement. A column mask applies a transformation to a column's value (e.g., masking PII) but does not filter rows; it cannot hide entire rows from a user. A dynamic view with current_user() works for row-level security but requires creating and maintaining a separate view object and does not meet the 'without modifying the base table' intent as cleanly as a row filter, and users must be directed to the view rather than the table. There is no built-in row_filter table property in Unity Catalog; row filters are registered as catalog functions and then assigned via ALTER TABLE ... SET ROW FILTER.

Using COMMENT ON TABLE ... IS '...' sets the human-readable description on the table that appears in Catalog Explorer and is returned by DESCRIBE TABLE, making the table discoverable. Using ALTER TABLE ... ALTER COLUMN ... SET TAGS attaches a key-value tag to the column, which supports attribute-based discovery and governance policies—this is the correct Unity Catalog mechanism for labeling columns. Creating a separate documentation table is not a Unity Catalog feature and does not integrate with Catalog Explorer or metadata search. While SET TBLPROPERTIES can store arbitrary key-value pairs, the official description field recognized by Unity Catalog's discovery features is set via COMMENT ON TABLE, not via a description table property. The BROWSE privilege allows users to view metadata without accessing data but is a privilege grant, not an action that enables tagging; the data steward needs appropriate ownership or APPLY TAG privilege to set tags, not BROWSE.

In Unity Catalog, querying a table requires a chain of privileges: USE CATALOG on the parent catalog, USE SCHEMA on the parent schema, and SELECT on the table (or a higher privilege). Granting only USE SCHEMA on the schema is insufficient because the analysts also need USE CATALOG on catalog1 to navigate into the catalog and SELECT on the specific tables they want to query. USE DATABASE is a legacy Hive metastore alias and while Unity Catalog accepts it as a synonym for USE SCHEMA, the original command is syntactically valid—the problem is missing privileges, not syntax. Grants in Unity Catalog are applied at the object level (catalog, schema, table, etc.); there is no requirement to target the metastore for schema-level grants. USE SCHEMA is fully supported in Unity Catalog; it is not limited to the Hive metastore.

Catalog Explorer's Lineage tab provides a visual graph of upstream sources (tables, notebooks, jobs that produced the table) and downstream consumers (tables, dashboards, notebooks that read from it), directly answering the compliance officer's questions. Unity Catalog automatically captures lineage when queries run on Unity Catalog-enabled clusters (clusters using the Unity Catalog access mode), so using such clusters is a prerequisite for lineage to be populated. The Downstream section of the lineage graph shows which assets consume gold.event_summary, including notebooks and Databricks SQL dashboards. DESCRIBE HISTORY returns the Delta transaction log history (versions, timestamps, operations like WRITE or MERGE) for a table, but it does not show cross-table data lineage. There is no SET LINEAGE SQL command in Unity Catalog; lineage is captured automatically and cannot be manually registered via SQL. Enabling Change Data Feed on bronze.raw_events tracks row-level changes for incremental processing but has no relationship to lineage tracking between tables.

SELECT grants the ability to query (read) data from a table without allowing schema or data modifications, which is exactly what is needed. READ FILES is a privilege used for accessing files in external locations, not for querying tables. MODIFY allows INSERT, UPDATE, and DELETE operations on a table, which would exceed the required read-only access. USE CATALOG is required on the parent catalog to allow navigation but alone does not grant read access to tables; the analysts also need USE SCHEMA on the parent schema, but among these options SELECT is the direct and correct privilege for read-only table access.