Governance and Security — Databricks Data Engineer Associate Practice Quiz

Question 1

A data engineer at a healthcare company needs to determine which downstream tables and dashboards would be affected if a source table containing patient records is modified. The company uses Unity Catalog to govern all data assets. Which Unity Catalog capability should the engineer use to identify these downstream dependencies?

Accepted Answer

Data lineage, which automatically captures upstream and downstream relationships across tables, columns, notebooks, and dashboards

Answer

The GRANT statement, which lists all principals who currently have SELECT on the table

Answer

DESCRIBE HISTORY, which returns the transaction log of operations performed on the table

Answer

Dynamic view functions, which mask sensitive columns based on the querying user's group

Question 2

A retail analytics company needs to share a curated Delta table from their Unity Catalog metastore with an external partner organization that does NOT use Databricks. The partner will consume the data using their own tools (e.g., pandas, Apache Spark, Power BI). Which Unity Catalog feature should the data engineer use to securely share this data without copying it to the partner's environment?

Accepted Answer

Delta Sharing, by creating a share and adding the partner as a recipient using an open-protocol activation link

Answer

Grant the partner's users SELECT privileges directly on the table in the shared metastore

Answer

Export the table to CSV files in cloud storage and grant the partner access to the storage bucket

Answer

Create a dynamic view with row filters and add the partner group to the workspace

Question 3

A healthcare analytics team stores a patient table in Unity Catalog that includes a sensitive 'ssn' column. Analysts need to run reports against the table, but only members of the 'compliance_team' group should see the full SSN values; everyone else should see the values masked. The data engineer must implement this without duplicating the table or removing the column. What is the most appropriate approach?

Accepted Answer

Create a dynamic view over the table that uses the is_account_group_member() function in a CASE expression to mask the 'ssn' column, then grant analysts SELECT on the view instead of the base table.

Answer

Grant analysts SELECT on the base table and rely on Unity Catalog to automatically mask sensitive columns based on their name.

Answer

Create a separate copy of the table with the 'ssn' column removed and grant analysts SELECT on that copy.

Answer

Revoke SELECT from analysts on the base table and instead grant them MODIFY so they can query but not read the SSN column.

Question 4

A data engineering team needs to allow Unity Catalog to read and write files in a specific ADLS Gen2 container so they can create external tables backed by that path. They have already created a storage credential that references a managed identity with access to the storage account. What must they create next so Unity Catalog can govern access to that specific storage path?

Accepted Answer

An external location that associates the cloud storage path with the storage credential

Answer

A managed catalog that points directly to the ADLS container URL

Answer

A second storage credential scoped to the container rather than the account

Answer

A mount point using dbutils.fs.mount referencing the storage credential

Question 5

A data engineer is designing a new schema in Unity Catalog for a temporary analytics project. The team wants Unity Catalog to fully manage the table lifecycle so that dropping a table also automatically removes the underlying data files, minimizing manual cleanup once the project ends. Which type of table should the engineer create to achieve this behavior?

Accepted Answer

A managed table, where Unity Catalog controls both metadata and the underlying storage location

Answer

An external table pointing to an external location with a storage credential

Answer

A view defined over raw files in cloud object storage

Answer

An external table registered against a pre-existing S3 path

Question 6

A data engineering team lead wants to allow a group of ETL developers to create new tables within an existing schema named 'sales.reporting' in Unity Catalog. The developers already have USE CATALOG on the 'sales' catalog. Which additional privileges must be granted so the developers can successfully create tables in that schema?

Accepted Answer

USE SCHEMA and CREATE TABLE on the 'sales.reporting' schema

Answer

ALL PRIVILEGES on the 'sales' catalog only

Answer

CREATE SCHEMA on the 'sales' catalog

Answer

MODIFY and SELECT on the 'sales.reporting' schema

Question 7

A data engineer runs GRANT SELECT ON TABLE sales.transactions.orders TO `analyst_team`. When members of analyst_team try to query the table, they receive a permission error stating they lack access. The team confirms they have SELECT on the orders table. What is the most likely cause of the error?

Accepted Answer

The group lacks USE CATALOG on `sales` and/or USE SCHEMA on `sales.transactions`, which are required to access the table.

Answer

SELECT privileges must be granted at the metastore level before they can apply to individual tables.

Answer

The analyst_team group must be assigned as the owner of the orders table to run SELECT queries.

Answer

SELECT on a table automatically expires unless MODIFY is also granted on the same table.

Question 8

A data engineer needs to allow the 'etl_writers' group to insert, update, and delete rows in the table `sales.transactions.orders`, but the group should not be able to alter the table's schema or drop the table. The group already has USAGE on the catalog and schema and SELECT on the table. Which single privilege should be granted on the table to enable the required write operations?

Accepted Answer

GRANT MODIFY ON TABLE sales.transactions.orders TO `etl_writers`

Answer

GRANT ALL PRIVILEGES ON TABLE sales.transactions.orders TO `etl_writers`

Answer

GRANT MANAGE ON TABLE sales.transactions.orders TO `etl_writers`

Answer

GRANT CREATE TABLE ON SCHEMA sales.transactions TO `etl_writers`

Question 9

A data engineering team of 12 people needs SELECT access to all current and future tables in the schema `sales.transactions`. New engineers join the team every few months. The lead wants to minimize ongoing administrative overhead when granting access. What is the best approach in Unity Catalog?

Accepted Answer

Create a group, add all engineers to it, and grant SELECT on the schema to the group

Answer

Grant SELECT on the schema individually to each of the 12 engineers by their user email

Answer

Grant SELECT on each existing table to a group, repeating the grant whenever a new table is created

Answer

Grant the MANAGE privilege on the schema to each engineer so they can read all tables

Question 10

A data engineer needs to give the analytics team read access to every current and future table across all schemas within the catalog named 'sales_prod'. They want to configure this with a single grant that automatically applies to objects created later, without granting access to other catalogs in the metastore. Which action should they take?

Accepted Answer

GRANT SELECT ON CATALOG sales_prod TO `analytics_team`

Answer

GRANT SELECT ON METASTORE TO `analytics_team`

Answer

Run GRANT SELECT ON TABLE for each existing table in every schema of sales_prod

Answer

GRANT USAGE ON CATALOG sales_prod TO `analytics_team`

Question 11

A data engineer manages a Unity Catalog schema named sales.reporting that currently contains 12 tables, with more tables added weekly by an automated pipeline. The analytics team needs read access to all current and future tables in this schema without requiring the engineer to run a new grant each time a table is created. Which single GRANT statement accomplishes this most efficiently?

Accepted Answer

GRANT SELECT ON SCHEMA sales.reporting TO `analytics_team`

Answer

Run GRANT SELECT ON TABLE for each of the 12 existing tables individually

Answer

GRANT SELECT ON CATALOG sales TO `analytics_team`

Answer

GRANT ALL PRIVILEGES ON SCHEMA sales.reporting TO `analytics_team`

Question 12

A data engineer creates a SQL user-defined function (UDF) called finance.reporting.mask_ssn in Unity Catalog that analysts will call inside their queries. The analysts already have USE CATALOG on finance and USE SCHEMA on finance.reporting. When the analysts try to invoke the function, they receive a permission error. Which single grant will allow the analysts to run the function?

Accepted Answer

GRANT EXECUTE ON FUNCTION finance.reporting.mask_ssn TO `analysts`

Answer

GRANT SELECT ON FUNCTION finance.reporting.mask_ssn TO `analysts`

Answer

GRANT MODIFY ON FUNCTION finance.reporting.mask_ssn TO `analysts`

Answer

GRANT ALL PRIVILEGES ON SCHEMA finance.reporting TO `analysts`

Question 13

A data analyst has been granted SELECT on the table `sales_prod.reporting.daily_orders` in Unity Catalog. However, when the analyst runs `SELECT * FROM sales_prod.reporting.daily_orders`, they receive a permission error and cannot access the data. The table owner confirms the SELECT grant was applied correctly to the table. What is the most likely cause and required fix?

Accepted Answer

The analyst also needs USE CATALOG on `sales_prod` and USE SCHEMA on `sales_prod.reporting`, because SELECT on a table alone does not grant traversal of the parent catalog and schema.

Answer

The analyst must be granted MODIFY on the table in addition to SELECT before any read query will succeed.

Answer

SELECT grants only work if the analyst is also the owner of the table, so ownership must be transferred to the analyst.

Answer

The table must be recreated as an external table, since SELECT grants cannot be enforced on managed tables.

Question 14

A data engineer creates a view named finance.reporting.summary_v that selects aggregated results from the base table finance.raw.transactions. Analysts in the 'reporting_team' group need to query summary_v but must NOT be able to query the underlying transactions table directly. The engineer owns both objects. What is the minimum set of grants that satisfies this requirement?

Accepted Answer

Grant USAGE on the finance catalog and reporting schema, and SELECT on summary_v, to reporting_team — but do not grant any privileges on the raw schema or transactions table.

Answer

Grant SELECT on both summary_v and transactions to reporting_team, since a view requires the reader to also have access to its source table.

Answer

Grant USAGE on the catalog and both schemas, plus SELECT on summary_v only, to reporting_team.

Answer

Grant MODIFY on summary_v to reporting_team so they can read the aggregated results without touching the base table.

Question 15

A data governance officer needs to programmatically audit which principals currently hold the SELECT privilege on tables within the 'finance' catalog. They want to run a SQL query rather than clicking through the Catalog Explorer UI for each object. Which approach lets them retrieve this grant information using standard SQL?

Accepted Answer

Query the views under finance.information_schema (such as table_privileges) to list granted privileges

Answer

Run DESCRIBE HISTORY on each table to view the list of grants applied over time

Answer

Query the hive_metastore.default.grants system table exported by the workspace

Answer

Use SHOW TABLES IN finance to display each table along with its assigned privileges

Question 16

A data engineer is creating a new table in Unity Catalog to store cleansed customer data. The team wants Unity Catalog to fully manage the table's underlying data files in the metastore's default managed storage location, so that dropping the table also removes the data files automatically. Which type of table should the engineer create?

Accepted Answer

A managed table, created without specifying a LOCATION clause

Answer

An external table pointing to a path in an external location

Answer

A managed table that specifies an explicit LOCATION in cloud storage

Answer

A foreign table registered through Lakehouse Federation

Question 17

A data engineering team is setting up Unity Catalog for their Databricks account. They plan to attach several workspaces located in the same cloud region to a shared governance layer so that catalogs, schemas, and tables can be centrally managed and shared. What is the correct relationship between a Unity Catalog metastore and workspaces in a given region?

Accepted Answer

A single metastore can be created per region and attached to multiple workspaces in that region to enable shared governance.

Answer

Each workspace must have its own dedicated metastore, and metastores cannot be shared.

Answer

A metastore spans all regions in the account and is automatically shared with every workspace globally.

Answer

Metastores are created at the catalog level, so each catalog requires a separate metastore.

Question 18

A data engineer created a table named `sales.transactions.orders` in Unity Catalog and is currently its owner. The engineer is moving to a different team and wants a shared group called `analytics_admins` to be able to grant and revoke privileges on the table, alter it, and eventually drop it if needed, without the original engineer remaining involved. What is the most appropriate action?

Accepted Answer

Transfer ownership of the table to the `analytics_admins` group using ALTER TABLE ... OWNER TO

Answer

Grant SELECT and MODIFY on the table to the `analytics_admins` group

Answer

Grant ALL PRIVILEGES on the table to the `analytics_admins` group

Answer

Add each member of `analytics_admins` as a metastore admin

Question 19

A data engineer previously granted the 'analysts' group the SELECT privilege on the table sales.public.transactions. Compliance now requires that the 'analysts' group no longer be able to query this table. The engineer confirms the group has no other privileges that would grant access. Which SQL statement should the engineer run in Unity Catalog to remove this access?

Accepted Answer

REVOKE SELECT ON TABLE sales.public.transactions FROM `analysts`

Answer

DENY SELECT ON TABLE sales.public.transactions TO `analysts`

Answer

DROP SELECT ON TABLE sales.public.transactions FROM `analysts`

Answer

ALTER TABLE sales.public.transactions REMOVE GRANT SELECT FOR `analysts`

Question 20

A data engineer is working in a notebook whose default catalog is set to 'dev' and default schema is set to 'analytics'. They need to query a table named 'orders' that lives in the schema 'sales' within the catalog 'prod'. Which statement correctly references this table using the Unity Catalog three-level namespace?

Accepted Answer

SELECT * FROM prod.sales.orders

Answer

SELECT * FROM sales.orders

Answer

SELECT * FROM prod.orders

Answer

SELECT * FROM dev.sales.orders

More Databricks Data Engineer Associate practice