Databricks GenAI Engineer Governance: 78 practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

Databricks GenAI Engineer Governance: 78 practice questions

Databricks GenAI Engineer 78 questions 12 shown free

12 of the 78 Governance questions in the Certsqill Databricks GenAI Engineer bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Databricks GenAI Engineer? Take the free 5-min readiness check →

1. Restrict tools to least privilege and require confirmation: Which TWO controls best meet these requirements?

Medium
An engineering knowledge agent retrieves internal pages and can call a ticketing tool. Tests show some retrieved pages contain instructions telling the agent to ignore policy and export secrets. The team requires resilience against retrieved instruction attacks and limits high-impact actions. Which TWO controls best meet these requirements? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Add a disclaimer telling users that retrieved instructions may be malicious.
    A user disclaimer does not constrain the agent’s tool permissions or processing behavior.
  2. Restrict tools to least privilege and require confirmation for high-impact actions. ✓
    Least-privilege tools and human confirmation reduce the impact of successful prompt injection.
  3. Place retrieved passages between delimiters and trust their instructions less.
    Delimiters improve organization but do not provide a reliable security boundary against prompt injection.
  4. Treat retrieved content as untrusted data and never as governing instructions. ✓
    Retrieved pages can contain hostile instructions, so the agent should separate their content from governing policy.
  5. Increase retrieval depth so trusted passages outweigh hostile passages.
    More retrieved content can increase exposure and does not distinguish authoritative instructions from hostile text.
The trap
User warnings do not control agent execution. Additional retrieval does not establish instruction authority. Formatting boundaries alone do not enforce security policy.

Treat retrieved text as untrusted and constrain high-impact tools with least privilege and confirmation.

2. Record source provenance and complete a licensing review: Which TWO actions best address the observed failure?

Easy
A sales-enablement assistant was built from publicly available vendor articles. Legal review finds that the source terms prohibit redistribution in a customer-facing product. The assistant’s answers are accurate, but deployment is blocked. Which TWO actions best address the observed failure? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Rewrite the articles into shorter summaries before serving them externally.
    Summarization changes presentation but may still redistribute restricted source-derived material.
  2. Record source provenance and complete a licensing review before redeployment. ✓
    Provenance and licensing review establish whether each source may support the intended customer-facing use.
  3. Keep the articles but add citations identifying their original publishers.
    Attribution may improve provenance, but it does not override terms that prohibit redistribution.
  4. Replace the articles with a corpus whose use and redistribution are permitted. ✓
    A permitted replacement corpus removes the identified redistribution restriction from the deployed knowledge source.
  5. Restrict the assistant to internal employees while retaining the same articles.
    Changing the audience may not satisfy the source terms and leaves the identified licensing issue unresolved.
The trap
Citations do not replace permission to redistribute. Transformation does not necessarily remove licensing obligations. Audience reduction does not automatically cure license restrictions.

Replace restricted sources and verify provenance and licensing before customer-facing deployment.

3. Delete the unauthorized source chunks from the managed: Which TWO actions are required?

Medium
A document pipeline discovers that 240 indexed chunks came from an unauthorized handbook. Those chunks are already represented in the embedding store, and retrieval tests show they still appear in answers. The team must remove the contaminated material rather than merely alter response wording. Which TWO actions are required? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Delete the unauthorized source chunks from the managed document set. ✓
    Removing the source records prevents the unauthorized content from remaining in the ingestion source.
  2. Lower the chunks’ ranking so authorized documents usually appear first.
    Lower ranking reduces visibility but does not remove the unauthorized content from the searchable index.
  3. Add a prompt instruction asking the model not to quote that handbook.
    Prompt wording does not remove contaminated chunks that remain available to retrieval.
  4. Propagate deletion through embeddings and the retrieval index, then verify results. ✓
    Existing embeddings and index entries can continue retrieving deleted content unless removal is propagated and tested.
  5. Keep the chunks but attach an unauthorized-source warning to each one.
    Warnings preserve the contaminated content and do not resolve its unauthorized presence in retrieval.
The trap
Metadata warnings do not remove prohibited material. Ranking changes leave prohibited content retrievable. Prompt instructions cannot purge retained indexed content.

Delete unauthorized chunks and propagate deletion through embeddings and indexes, followed by retrieval verification.

4. Redact unnecessary identifiers before external: What is the next required control?

Medium
Before sending research-assistant prompts to an external model, the team has inventoried sensitive fields, reviewed access, configured retention, and tested answer quality. Some prompts still contain unnecessary customer identifiers. What is the next required control?
  1. Increase retrieval depth before sending the existing prompt externally.
    Additional retrieval does not address unnecessary identifiers already present in the outbound prompt.
  2. Redact unnecessary identifiers before external transmission. ✓
    Removing unnecessary identifiers before the external call reduces exposure while preserving needed prompt content.
  3. Replace the external model with a larger model to reduce exposure.
    Model size does not remove sensitive fields from the outbound prompt or satisfy data minimization.
  4. Disable provenance records for prompts sent to the external model.
    Disabling records does not remove sensitive data from transmission and may weaken governance.
The trap
Model capacity is unrelated to redaction. More context does not reduce transmitted sensitivity. Less logging does not change outbound prompt content.

Redact unnecessary identifiers before external transmission.

5. Choose output review: Which implementation should be selected?

Medium
A retail catalog agent receives tool output containing product descriptions and occasional instructions to reveal hidden prompts. The selected control must address untrusted tool output generally, achieve attack success below 10%, and add less than 800 milliseconds of latency. An evaluation produced this exhibit. Which implementation should be selected? Select one.

Approach | Attack success | Added latency
Delimiter only | 18% | 40 ms
Output review | 7% | 620 ms
Human approval always | 0% | 1,400 ms
Schema validation plus confirmation for purchases | 5% | 760 ms
  1. Use delimiter-only handling because it has the lowest latency.
    Delimiter-only handling records 18% attack success, exceeding the required limit despite its low latency.
  2. Require human approval for every response because it eliminates measured attacks.
    Universal human approval records zero attack success but adds 1,400 milliseconds, exceeding the latency limit.
  3. Use schema validation and purchase confirmation for its sub-10% attack rate.
    This approach meets the measured thresholds but is limited to purchase actions, so it does not address hostile output generally.
  4. Choose output review: it meets both measured thresholds for general output. ✓
    Output review addresses tool output generally and records 7% attack success with 620 milliseconds of added latency.
The trap
Optimizes latency while ignoring the security threshold. A stronger security result still violates the latency requirement. A narrow action control cannot satisfy a general output requirement.

Select output review because it covers general tool output and meets both measured thresholds.

6. Replace it with a commercially permitted model: Which change resolves the specific governance defect?

Medium
A customer-onboarding workflow uses a model whose model card permits research use but restricts commercial deployment. The workflow serves paying customers, and engineering confirms that prompts, retrieval, and evaluations are otherwise acceptable. Which change resolves the specific governance defect? Select one.
  1. Move the same model behind a private serving endpoint.
    Private hosting changes deployment exposure but does not remove the model's commercial-use restriction.
  2. Add more customer examples to the evaluation set.
    Additional evaluation examples may improve coverage but do not change the model's commercial-use restriction.
  3. Replace it with a commercially permitted model. ✓
    A commercially permitted model resolves the restriction blocking this customer-facing workflow.
  4. Add citations to every generated onboarding answer.
    Citations improve traceability but do not authorize commercial use of the restricted model.
The trap
Hosting location does not change usage rights. Evaluation breadth does not grant commercial permission. Attribution does not override model-card terms.

Replace the restricted model with one permitted for commercial deployment.

7. Substitute permitted documentation and reevaluate answer: Which TWO changes are appropriate before release?

Medium
A support assistant's corpus includes a third-party manual whose license does not permit the planned customer-facing redistribution. The team has verified that the manual improves answer quality, but cannot obtain permission in time. Which TWO changes are appropriate before release? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Substitute permitted documentation and reevaluate answer quality. ✓
    Permitted documentation supports release, while reevaluation confirms that the replacement still meets quality needs.
  2. Keep the manual but limit customer responses to short excerpts.
    Short excerpts may still constitute restricted redistribution and do not resolve the missing permission.
  3. Retain the manual internally and filter direct quotations externally.
    Quote filtering may still expose derived content and leaves the restricted source in the deployment pipeline.
  4. Use the manual temporarily and add a source-attribution banner.
    Temporary use and attribution do not substitute for permission required by the source license.
  5. Remove the manual and its retrieval derivatives from the deployment. ✓
    Removing the manual and derived embeddings or index entries prevents restricted material from continuing to influence released responses.
The trap
Attribution and timing do not establish usage rights. Filtering quotations does not remove corpus licensing risk. Smaller excerpts do not guarantee permitted redistribution.

Remove the restricted source and derivatives, then substitute permitted documentation and reevaluate quality.

8. Test whether stable tokens enable re-identification under: What should engineers validate next?

Medium
An engineering search system replaces employee names with stable tokens before indexing. A secured table maps each token back to a person, and access to that table is logged. The team wants to call the indexed data anonymous. What should engineers validate next?
  1. Add citations to search results and document the token format.
    Citations and token documentation do not test whether a person can be linked back through the mapping table.
  2. Test whether stable tokens enable re-identification under realistic access conditions. ✓
    Stable tokens and a mapping table preserve a possible identity link, so realistic re-identification and linkability must be assessed before claiming anonymity.
  3. Measure retrieval quality after tokenization.
    Retrieval quality does not determine whether the records remain linkable to individuals.
  4. Increase embedding dimensions to compensate for tokenized names.
    Embedding dimensions neither remove the mapping pathway nor establish that the data is anonymous.
The trap
Confuses search quality with identity risk. Treats vector configuration as a privacy control. Confuses provenance with anonymization.

Test whether stable tokens enable re-identification under realistic access conditions.

9. Expose only a read-only approved-contract search: Which implementation satisfies both boundaries?

Hard
A procurement document agent must search approved contracts but must never submit orders. The current procurement integration can both read contracts and submit orders, and the team requires confirmation before any high-impact action. Which implementation satisfies both boundaries?
  1. Disable the integration and route all contract questions to a human reviewer.
    This prevents automated submissions but also removes the required contract-search capability.
  2. Keep the combined integration and instruct the model not to submit orders.
    Instructions do not remove the integration's order-submission capability or enforce the prohibition.
  3. Give every agent the combined integration and audit order activity afterward.
    The integration still permits prohibited order submission, and retrospective auditing does not prevent it.
  4. Expose only a read-only approved-contract search capability to the agent, remove order submission from its available tools, and require separate human confirmation for any high-impact action outside that agent. ✓
    Read-only search preserves the required function, removing the write tool enforces the prohibition, and separate confirmation protects any high-impact action handled elsewhere.
The trap
Uses monitoring instead of preventive authorization. Treats model behavior as authorization. Avoids risk by failing the required search function.

Expose read-only search, remove order submission, and gate any separate high-impact action with confirmation.

10. The index is stale and cannot establish document: What most likely explains the failure?

Hard
An analytics assistant cites policy version 12, but the current source repository is version 14. Logs show ingestion succeeded before version 14 was published, and the index has no source-version field. Users report answers that are plausible but outdated. What most likely explains the failure?
  1. The source repository is inaccessible because ingestion completed successfully.
    Successful earlier ingestion does not prove current synchronization, but it does not establish repository inaccessibility.
  2. The retriever is too broad because citations appear in the answers.
    Citations are not evidence of excessive retrieval breadth; the version mismatch points to stale source synchronization.
  3. The model needs fine-tuning because plausible answers indicate weak generation.
    The logs directly show stale ingestion and missing version tracking, which better explain outdated citations.
  4. The index is stale and cannot establish document provenance for current answers. ✓
    Pre-publication ingestion plus absent version metadata supports stale retrieval and inadequate provenance tracking.
The trap
Historical ingestion success cannot explain current provenance alone. Citation presence does not diagnose retrieval breadth. Plausible wording does not outweigh clear provenance evidence.

Stale ingestion and missing version metadata explain outdated citations and prevent reliable provenance verification.

11. Mask SSNs and email addresses: Which change best meets this requirement?

Medium
An incident-triage agent sends descriptions to an external model. Remove Social Security numbers and email addresses while retaining incident category, timestamp, and troubleshooting context. Which change best meets this requirement? Select one.
  1. Mask SSNs and email addresses, retaining operational incident context. ✓
    Targeted masking removes the specified sensitive fields while preserving the required incident information.
  2. Redact the entire description before the external call.
    Complete redaction also removes the category, timestamp, and troubleshooting context that must be retained.
  3. Replace sensitive spans with reversible tokens and store the mapping separately.
    Reversible tokens preserve identity linkage and create an unnecessary sensitive mapping for the external call.
  4. Hash each description before sending it to the external model.
    Hashing prevents the model from receiving the natural-language context needed for triage and troubleshooting.
The trap
Over-redaction destroys required operational information. A hash is not a useful replacement for the required context. Pseudonymized values can remain linkable sensitive data.

Mask only SSNs and email addresses so required incident context remains available.

12. Assess both error rates against business tolerance: What should happen next before production?

Easy
A retail catalog assistant redacts customer details before model calls. Representative tests show utility of 94%, false positives of 2%, and false negatives of 7%. The business has approved the redaction categories and retention policy. What should happen next before production?
  1. Deploy because utility exceeds 90%.
    Utility alone does not establish acceptable privacy performance or production readiness.
  2. Assess both error rates against business tolerance. ✓
    False positives and false negatives must be evaluated on representative cases against approved business tolerance before production.
  3. Increase masking until false negatives reach zero, regardless of utility loss.
    Driving false negatives to zero may create unacceptable false positives and destroy useful catalog context.
  4. Remove all customer fields from every prompt.
    Removing all customer fields unnecessarily reduces usefulness and ignores the approved targeted categories.
The trap
A single utility metric is insufficient. Broad deletion is not targeted redaction. Zero misses is not automatically the correct threshold.

Assess both redaction error rates against business tolerance before production.

66 more Governance questions

The remaining 66 questions in this domain are part of the full Databricks GenAI Engineer bank — 967 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your Databricks GenAI Engineer readiness — free

Other Databricks GenAI Engineer domains

Part of the Certsqill Databricks GenAI Engineer question bank · Governance · Every answer, right and wrong, comes with its own explanation.