Databricks Data Engineer Associate Governance and Security: 123 practice questions

12 of the 123 Governance and Security questions in the Certsqill Databricks Data Engineer Associate bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Databricks Data Engineer Associate? Take the free 5-min readiness check →

1. Use `is_account_group_member` with a mapped region filter: Which implementation satisfies the requirement?

1. Mask the region column for users outside the assigned group.

   A column mask changes values but does not remove rows from the result.
2. Tag the table and rely on the tag to filter rows automatically.

   A tag alone supplies metadata and does not enforce row filtering.
3. Use workspace-group membership without a region predicate.

   This uses the wrong identity scope and does not map group membership to a region.
4. Use `is_account_group_member` with a mapped region filter. ✓

   The account-level membership function and region predicate together restrict returned rows to the user's assigned region.

Use account membership with a mapped region filter.

2. The governed tag has metadata: What is the concrete failure?

1. The tag should be replaced with a row filter because row filters automatically transform sensitive column values.

   Row filters restrict rows, whereas column masks transform values; neither is created automatically by replacing a tag alone.
2. The governed tag has metadata, but no matching ABAC policy is attached at the applicable scope to mask the column. ✓

   Governed tags drive matching ABAC policies; without an applicable policy, tagging alone does not transform the sensitive value.
3. The table must be external because ABAC policies cannot match governed tags on managed Unity Catalog tables.

   ABAC policy matching is not limited to external tables, and managed-table status does not explain the missing masking behavior.
4. The analyst needs SELECT privilege because masking begins automatically once a user can read the unmasked column.

   SELECT permits reading the table but does not create a masking policy or cause a tag to enforce transformation automatically.

A governed tag needs an applicable ABAC policy; tagging alone does not mask values.

3. Managed data is scheduled for cleanup subject to retention: What lifecycle behavior should the administrator e

1. Managed data remains permanently, while external files are scheduled for cleanup.

   Managed-table data is not guaranteed to remain permanently, and Unity Catalog does not schedule deletion of files managed externally.
2. Both drops immediately delete cloud data because Unity Catalog owns every path.

   External files remain after metadata removal, and managed cleanup is subject to retention rather than guaranteed immediate deletion.
3. Managed data is scheduled for cleanup subject to retention; external files remain. ✓

   Dropping a managed table schedules cleanup of its Databricks-managed data subject to retention and recovery behavior. Dropping an external table removes catalog metadata but preserves its externally managed files.
4. Both drops remove metadata only, leaving all underlying data untouched.

   An external drop preserves files, but managed-table data is subject to Databricks-managed cleanup after the drop.

Managed data follows retention cleanup; external files remain.

4. `SELECT` on `main.app_logs`: Which missing privilege is required to read existing table rows?

1. `MANAGE` on `main.app_logs`

   `MANAGE` controls administration and grants, but it is not the normal prerequisite for selecting table rows.
2. `SELECT` on `main.app_logs` ✓

   `USE CATALOG` and `USE SCHEMA` permit namespace resolution; `SELECT` permits reading rows from the existing table.
3. `CREATE TABLE` on the `app` schema

   `CREATE TABLE` permits creating tables but does not authorize reading rows from an existing application-log table.
4. `MODIFY` on `main.app_logs`

   `MODIFY` supports changing table data but is not the privilege that authorizes ordinary query reads.

Reading requires `USE CATALOG`, `USE SCHEMA`, and `SELECT` on the table.

5. A compatible column mask: Which control meets this requirement?

1. A governed tag without an attached policy

   A tag identifies governed data but does not itself transform returned values or enforce masking.
2. Physical anonymization during ingestion

   Physical anonymization changes stored data globally and does not provide identity-dependent query-time results.
3. A compatible column mask ✓

   A column mask transforms returned values according to identity or group, and its result must be compatible with the masked column’s data type.
4. A row filter on `serial_number`

   A row filter determines which rows qualify; it does not transform values returned in a column.

A compatible column mask transforms returned values by identity.

6. ABAC can target matching governed tags within catalog: Select TWO statements that correctly describe this desi

Select two. More than one option is correct — every correct one is ticked below.

1. A table-level filter applies automatically to every future table in the catalog.

   A table-level filter attaches to a particular table and does not automatically become a catalog-wide policy for future tables.
2. ABAC can target matching governed tags within catalog or schema scope. ✓

   ABAC can centrally target objects whose governed tags match the policy within the policy’s catalog or schema scope.
3. Adding the governed tag automatically creates a masking rule for each matching column.

   A tag identifies objects for governance targeting, but a matching applicable policy must define and enforce the masking behavior.
4. The policy operates alongside the privileges required to access the table. ✓

   An applicable policy does not grant base table access; users still need effective Unity Catalog privileges such as the required namespace and table permissions.
5. Additional `SELECT` privileges automatically bypass an applicable masking policy.

   Additional read privileges do not automatically bypass an active applicable mask affecting query results.

ABAC targets governed tags centrally, while base privileges remain separately required.

7. Drop the external table from Unity Catalog: Which action satisfies both requirements?

1. Run CONVERT TO DELTA before dropping it.

   CONVERT TO DELTA changes file-format metadata and does not define whether external files are deleted.
2. Use SET MANAGED before dropping the table.

   SET MANAGED transfers eligible data to managed storage, contrary to retaining the original externally managed files.
3. Drop the external table from Unity Catalog, leaving its externally managed files in place. ✓

   Dropping an external table removes its Unity Catalog metadata while leaving the underlying externally managed files intact.
4. Drop it and recreate the data as a managed table.

   Recreating the data as managed changes storage ownership and is unnecessary for metadata-only removal.

Drop the external table; its referenced files remain.

8. Priya keeps access through the group’s schema grant: What should a permission check predict?

1. The revoke converts the inherited grant into a deny.

   `REVOKE` removes a specified grant; it does not create a universal deny against other effective grants.
2. Priya keeps access through the group’s schema grant. ✓

   The group membership supplies an inherited schema-level `SELECT` grant that continues applying to the table.
3. Priya loses access because direct grants override inherited grants.

   Direct grants do not override effective grants inherited through groups or ancestor securables.
4. Priya loses access unless she owns the table.

   Ownership is unnecessary when an effective inherited group grant already authorizes the required table access.

Revoking one direct grant does not remove an effective group or ancestor grant.

9. `USE CATALOG` on `main`: Which grant set meets the requirement?

1. `MODIFY` on `main.inventory.stock`

   `MODIFY` permits changes but does not provide the required catalog, schema, and read privileges.
2. `USE CATALOG` on `main`, `USE SCHEMA` on `main.inventory`, and `SELECT` on `main.inventory.stock` ✓

   These grants provide namespace resolution and table read access without creation or modification privileges.
3. `MANAGE` on `main` and `USE SCHEMA` on `main.inventory`

   `MANAGE` is broader than required and does not replace the explicit table `SELECT` grant for this least-privilege requirement.
4. `USE CATALOG` on `main` and `CREATE TABLE` on `main.inventory`

   These privileges permit namespace use and table creation but do not grant `SELECT` on the existing table.

Read access requires catalog use, schema use, and table `SELECT`.

10. The tag identifies data: What explains the observed behavior?

1. The tag identifies data, but an applicable masking policy must enforce transformation. ✓

   Tags provide governance metadata; masking occurs only when an applicable policy uses that metadata to transform query results.
2. The tag becomes enforceable only after the table is converted to managed storage.

   Managed versus external storage does not make a tag enforce masking. An applicable policy is still required.
3. The tag requests a row filter, so values remain unchanged by design.

   A tag alone requests neither a row filter nor a masking rule; without an applicable policy, it does not enforce either behavior.
4. The tag grants analysts read access but leaves masking to workspace administrators.

   Tags neither grant table access nor delegate masking automatically; they identify objects for governance configuration.

A tag alone is metadata; masking requires a matching applicable policy.

11. Use an external location backed by a storage credential: Which design is appropriate?

1. Grant `SELECT` on the table without configuring cloud-path authorization

   Table privileges govern Unity Catalog access but do not replace authorization for the referenced external cloud storage path.
2. Use an external location backed by a storage credential ✓

   An external location binds a cloud path to a reusable storage credential and Unity Catalog authorization controls.
3. Put the cloud access key directly in the external table definition

   Embedding long-lived cloud keys in table metadata exposes credentials and bypasses the intended reusable credential abstraction.
4. Convert the supplier files to a managed table before authorization

   Managed conversion changes storage ownership and is unnecessary when the requirement is governed access to an external cloud path.

External locations pair cloud paths with storage credentials for governed external access.

12. Lina can still receive `SELECT` through the `dispatch`: Select TWO statements that remain true.

Select two. More than one option is correct — every correct one is ticked below.

1. Lina can still receive `SELECT` through the `dispatch` group. ✓

   Her membership in `dispatch` remains, so the group’s inherited schema privilege can continue providing access.
2. The revoke creates a deny that overrides Lina’s group membership.

   A revoke removes a grant; it does not create a universal deny overriding other effective privileges.
3. Revoking the direct grant disables inherited schema privileges for Lina.

   Revoking one grant does not disable a separate privilege inherited through Lina’s group membership.
4. Lina must own `ops.shipments` before she can query it again.

   Ownership is not required because the group’s inherited `SELECT` privilege remains effective.
5. The revoke removes Lina’s direct grant but leaves the group grant unchanged. ✓

   The revoke targets Lina’s specified direct grant and does not remove the group’s independent schema grant.

The direct grant is removed, but the group’s inherited grant remains.

Other Databricks Data Engineer Associate domains

• Data Transformation and Modeling — 180 questions →
• Data Ingestion and Loading — 172 questions →
• Working with Lakeflow Jobs — 129 questions →
• Implementing CI/CD — 82 questions →
• Troubleshooting, Monitoring, and Optimization — 82 questions →
• All 817 Databricks Data Engineer Associate questions →
• Databricks Data Engineer Associate certification: requirements, cost and exam format →