Home / Data Analyst practice test / Securing Data

Free · 5 questions with explanations

Securing Data: Databricks Data Analyst Associate Practice Questions

Exam-style questions on Securing Data. Pick your answer, then open the explanation to see why it's right — and why the other options are wrong.

Take a full timed test free → All Data Analyst topics
1 Securing Data

A data governance administrator needs to delegate the ability to grant and revoke privileges on a Unity Catalog schema to a senior analyst. Which principals are authorized to perform this action?

  1. AAny workspace user who has been granted the MODIFY privilege on the parent schema containing the object
  2. BOnly the account-level admin who originally provisioned the Unity Catalog metastore for the region
  3. COnly workspace admins, since they exclusively control all privilege assignments within the attached metastore
  4. DMetastore admin, object owner, or user with MANAGE privilege
  5. EAny user holding the USE CATALOG privilege on the parent catalog, regardless of their role on the object itself
Show answer & explanation

Correct answer: D

WHY D: In Unity Catalog, privileges on a securable object can be granted or revoked by the metastore admin, the owner of that object, a user with the MANAGE privilege on the object, or the owner of the catalog or schema that contains the object. This is explicitly documented in the Unity Catalog privilege model. WHY NOT A: MODIFY is a write-access privilege on data content; it does not confer the ability to manage access control grants on an object. WHY NOT B: Account admins have broad capabilities, but the privilege-granting authority is also held by object owners and MANAGE-privilege holders — it is not exclusive to the account admin who created the metastore. WHY NOT C: Workspace admins have administrative rights within their workspace, but privilege management in Unity Catalog is also granted to object owners and users holding the MANAGE privilege, not restricted to workspace admins alone. WHY NOT E: USE CATALOG grants the ability to navigate into a catalog and access objects within it; it does not authorize a user to modify access-control grants on objects inside that catalog.

2 Securing Data

A security team requires that all users outside the hr_analysts group see NULL instead of the actual Social Security Number values in the employees table. Which Unity Catalog approach correctly implements this column-level PII protection?

  1. AA dynamic view that applies a CASE expression to mask the SSN column, returning NULL for users whose current_user() is not in the approved group
  2. BA cluster-level access policy configured on the SQL warehouse that automatically redacts designated sensitive column values based on workspace-level user attribute tags
  3. CA Delta Lake table property set at write time to enforce column-level encryption, restricting decryption to users whose cluster has the matching decryption key configured
  4. DA cloud storage IAM policy applied on the external location that restricts file-level access to the storage path containing the sensitive Parquet column data files
  5. EA row filter function registered in Unity Catalog that applies a WHERE clause to remove all rows containing non-null Social Security Number values for unauthorized users
Show answer & explanation

Correct answer: A

WHY A: Dynamic views are the Unity Catalog mechanism for implementing column-level security, including PII masking. By wrapping a table as a view and embedding a CASE expression that checks current_user() or is_account_group_member(), authors can return NULL (or a masked placeholder) for users outside approved groups, while approved users see the real values. This is the documented Databricks best practice for column-level PII protection. WHY NOT B: SQL warehouse cluster policies govern compute resource settings (instance types, autoscaling); they are not a mechanism for column-level data masking or user-based value redaction at query runtime. WHY NOT C: Delta Lake table properties control behaviors like schema enforcement and optimized writes; they do not provide column-level access control or encryption that would selectively mask values for specific users at query time. WHY NOT D: IAM policies on external locations restrict which Databricks users or service principals can access the storage path entirely; they operate at the file level, not the column level, and cannot selectively mask specific column values for different user groups. WHY NOT E: A row filter function removes entire rows for unauthorized users, which would block all access to any row containing a non-null SSN — this is row-level security, not column-level masking, and it would hide the full record rather than masking only the sensitive column.

3 Securing Data

A data analyst references a table in a Databricks SQL query using the fully qualified identifier sales_prod.transactions.orders. Which Unity Catalog namespace level directly contains the orders table?

  1. AThe catalog, which is the top-level container that directly holds all tables, views, and data assets without requiring an intermediate level
  2. BThe metastore, since it is the root-level registry that has direct visibility into all data objects registered beneath it
  3. CThe database layer — a separate construct that sits below schemas and maps directly to Delta Lake physical storage locations
  4. DThe function namespace — a dedicated object tier positioned between schemas and tables in the Unity Catalog object hierarchy
  5. EThe schema, which is the second-level namespace that directly contains tables, views, volumes, and functions
Show answer & explanation

Correct answer: E

WHY E: In Unity Catalog's three-level namespace, the structure is catalog.schema.table. In the identifier sales_prod.transactions.orders, sales_prod is the catalog, transactions is the schema, and orders is the table. Schemas (level two) are the containers that directly hold data objects such as tables, views, volumes, models, and functions. WHY NOT A: Catalogs are the top-level container, but they do not directly hold tables — they contain schemas, which in turn contain the data objects. WHY NOT B: The metastore is the top-level metadata container for Unity Catalog, but it sits above catalogs and does not directly hold tables or other data objects. WHY NOT C: There is no separate 'database layer' between schemas and storage in Unity Catalog; schemas serve the role that databases played in the Hive metastore two-level model. WHY NOT D: Functions are objects that live within schemas — they are not a namespace tier in the hierarchy; there is no 'function namespace' tier between schemas and tables.

4 Securing Data

A workspace admin runs DROP TABLE catalog1.schema1.customer_data in Unity Catalog. The customer_data table was created as a managed table. What happens to the underlying data files after this operation?

  1. AThe data files are deleted after a recovery period (7 days by default); until then, UNDROP TABLE can restore the table
  2. BThe data files are copied to a Databricks-owned backup bucket and kept there for 90 days before being permanently deleted
  3. COnly the table metadata entry is deleted from the metastore, but all underlying Parquet data files remain preserved in cloud storage indefinitely
  4. DThe data files are deleted immediately and permanently the moment the DROP TABLE command completes, with no way to recover them
  5. EThe data files are archived to the metastore's cold storage tier and kept until a workspace admin runs a PURGE TABLE command
Show answer & explanation

Correct answer: A

WHY A: For a Unity Catalog managed table, Unity Catalog owns both the metadata and the data files. DROP TABLE removes the table, but the files are only deleted after a recovery period — 7 days by default, configurable from 0 hours to 30 days at the catalog or schema level. Until the period expires, UNDROP TABLE restores the table. WHY NOT B: Databricks does not copy dropped tables to a separate backup bucket. WHY NOT C: Keeping the data files indefinitely after DROP TABLE is the behavior of external tables, not managed tables. WHY NOT D: Deletion is not immediate by default; the recovery period lets you UNDROP the table (only a recovery period explicitly set to 0 hours disables this). WHY NOT E: There is no cold storage tier or PURGE TABLE command; files are removed automatically when the recovery period ends.

5 Securing Data

A data engineering lead wants to grant a team group read access to all tables in a schema — including tables that will be created in the future — without needing to re-issue GRANT statements each time a new table is added. What is the correct approach in Unity Catalog?

  1. AGrant SELECT on the schema; the privilege cascades automatically to all current and future tables within it
  2. BIssue a GRANT SELECT on each table individually each time a new table is created, managed through an automation script
  3. CAssign the group the data steward role on the catalog so it automatically inherits read access to all nested schema objects
  4. DGrant SELECT on the entire catalog so all schemas and tables throughout the catalog become readable by the group simultaneously
  5. EAsk a metastore admin to configure automatic privilege inheritance settings on the schema directly via the account console user interface
Show answer & explanation

Correct answer: A

WHY A: Unity Catalog uses a downward inheritance model — privileges granted on a schema automatically apply to all current and future tables, views, volumes, and functions nested within that schema. Granting SELECT on the schema is sufficient to cover all objects at the table level without re-granting. WHY NOT B: Issuing individual GRANT SELECT statements per table is valid but inefficient and defeats the purpose of the inheritance model; it also requires re-granting for every future table. WHY NOT C: There is no 'data steward' role in Unity Catalog that provides inherited read access; privileges must be granted explicitly via GRANT statements or through the ownership model. WHY NOT D: Granting SELECT on the catalog is overly permissive — it would cascade access to all schemas within the catalog, not just the target schema, violating the principle of least privilege. WHY NOT E: There is no such 'automatic privilege inheritance settings' option in the account console for schemas; inheritance is a built-in behavior of the GRANT model, not a separately configurable setting.

Take the full Data Analyst practice test →

Keep going

Other Data Analyst topics


Executing queries using Databricks SQL and Databricks SQL Warehouses 8 practice questions → Working with Dashboards and Visualizations in Databricks 8 practice questions → Analyzing Queries 8 practice questions → Developing, Sharing, and Maintaining AI/BI Genie spaces 7 practice questions → Managing Data 5 practice questions → Understanding of Databricks Data Intelligence Platform 5 practice questions → Data Modeling with Databricks SQL 4 practice questions → Importing Data 4 practice questions →