Q01 - Question
You must give Unity Catalog read and write access to an Azure Data Lake Storage account without managing secrets. You already created an access connector for Azure Databricks that has a managed identity. Which two actions should you take?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Multi-select
- A. Create a client secret for the managed identity and rotate it on a schedule.
- B. Assign the Storage Blob Data Contributor role to the managed identity on the storage account or container.
- C. Assign only the Reader role to the managed identity on the storage account.
- D. In Catalog Explorer, create a storage credential of type Azure Managed Identity by using the access connector resource ID.
B and D are correct.
Explanation: The managed identity needs a role on the storage account. Storage Blob Data Contributor provides read and write access to blob data, and you can assign it at the account level or the container level. You then create a storage credential in Unity Catalog with the Azure Managed Identity type and the access connector resource ID. This requires the CREATE STORAGE CREDENTIAL privilege on the metastore.
A is incorrect: Managed identities remove the need to create, store, and rotate secrets. Client secrets are part of the service principal approach.
C is incorrect: Reader is not the role identified for read and write access to blob data. Storage Blob Data Contributor is the role identified for that access.
Q02 - Question
A data engineering team runs production jobs on a cluster that is not Unity Catalog-enabled. The jobs read data by using file paths such as delta.`abfss://...`. When a dashboard shows incorrect revenue figures, the team finds that Catalog Explorer lineage is missing for these jobs. You need to make sure lineage is captured for the jobs. Which two actions should you take?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Multi-select
- A. Run the jobs on Unity Catalog-enabled compute.
- B. Rename the tables so that lineage is regenerated under the new names.
- C. Change the jobs to read the data through global temporary views.
- D. Reference the tables by using the three-level namespace catalog.schema.table instead of file paths.
A and D are correct.
Explanation: Unity Catalog captures lineage automatically only for queries that run on Unity Catalog-enabled compute. Queries that access tables by direct file path do not generate lineage data, and path-based access shows only the path in lineage. Use Unity Catalog-enabled compute and reference tables by using the three-level namespace catalog.schema.table.
B is incorrect: Lineage is not preserved for renamed objects, so renaming a table loses the connection to its previous name. It does not fix path-based access or non-Unity Catalog compute.
C is incorrect: Global temporary views are not captured in lineage, so this change does not improve lineage coverage.
Q03 - Question
You need to share tables with a partner that uses a non-Databricks platform and has no Unity Catalog-enabled workspace. The partner's security policy does not allow long-lived credentials. Which approach should you use?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. Open sharing with OIDC federation, which exchanges JWT tokens from the partner's identity provider for short-lived Databricks OAuth tokens.
- B. Databricks-to-Databricks sharing by using a sharing identifier for the partner.
- C. Open sharing with bearer tokens that have no expiration period.
- D. Open sharing with bearer tokens, and add an IP access list to the recipient.
A is correct.
Explanation: Open sharing is for recipients who use platforms other than Azure Databricks or lack Unity Catalog access. OIDC federation grants short-lived Databricks OAuth tokens in exchange for JWT tokens from the recipient's identity provider. This removes long-lived credentials entirely.
B is incorrect: Databricks-to-Databricks sharing requires the recipient to have a Unity Catalog-enabled Azure Databricks workspace. This partner does not.
C is incorrect: You should set an expiration period instead of allowing tokens to live indefinitely. Tokens without expiration are long-lived credentials.
D is incorrect: An IP access list restricts which addresses can connect, with up to 100 IP or CIDR values for each recipient. It does not change the bearer token into a short-lived credential.
Q04 - Question
You manage a schema named customers. A column mask policy masks columns tagged pii=ssn for all_users and excludes the compliance_team group. A member of compliance_team owns a view that selects the tagged SSN column from a table in the schema. An analyst who is not in compliance_team has SELECT on the view and no direct privileges on the table. The analyst queries the view. Which identity does Azure Databricks use to evaluate the column mask, and what does the analyst see?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. The view owner's identity. The analyst sees the actual SSN values.
- B. The session user's identity. The analyst sees the masked SSN values.
- C. The identity of the schema owner. The analyst sees the actual SSN values.
- D. No identity is evaluated because the analyst has no direct privileges on the table. The analyst sees the actual SSN values.
B is correct.
Explanation: When a user queries a view that accesses an ABAC-protected table, Azure Databricks evaluates row filters and column masks by using the session user's identity. The analyst is not in the compliance_team, so the mask applies. Users still do not need direct privileges on the underlying table, but you must design the policy for the caller's identity.
A is incorrect: The view owner's identity is not used. Designing the policy on the assumption that the owner's exception applies would expose SSN data in your plan but not in practice.
C is incorrect: The schema owner's identity is not used to evaluate the policy. The identity of the person running the query is used.
D is incorrect: Not needing direct privileges on the underlying table does not bypass the policy. The row filter or column mask still applies to the session user.
Q05 - Question
One customer table must serve support staff, analysts, and compliance reviewers. Each audience can see different rows and a different set of masked columns. The solution does not need to combine data from multiple tables or hide the table structure from consumers. The team wants to avoid duplicated tables and a growing number of audience-specific views. Which approach should you use?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. Create a masking function for each sensitive column and a row filter function, and attach them to the table.
- B. Create a separate physical copy of the table for each audience.
- C. Create one dynamic view for each audience and grant access only to the views.
- D. Put the business transformation logic for each audience inside the masking functions.
A is correct.
Explanation: Row and Column Security keeps one authoritative table. You associate a masking function with each sensitive column and a row filter function with the table. Queries then enforce the logic at the table level, and you manage fewer objects. Dynamic views are not needed because there is no multi-table composition or abstraction requirement.
B is incorrect: Duplicating tables creates synchronization problems, complicates governance, and can cause security drift.
C is incorrect: Dynamic views are valid when you need multi-table composition or strict abstraction. Creating one for each audience adds objects to grant, audit, and maintain.
D is incorrect: Complex transformations in masking functions blur responsibilities. These rules belong in upstream transformation pipelines, not in security enforcement.
Q06 - Question
A compliance team must retain Azure Databricks audit logs for several years. The logs are accessed rarely and only for periodic compliance reviews. The team wants a low-cost destination. The system.access.audit table retains audit logs for up to one year. Which destination should a platform administrator configure for log delivery through Azure diagnostic settings?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. Azure Log Analytics, because it provides near-real-time ingestion and KQL queries.
- B. Azure Event Hubs, because it streams events to downstream consumers.
- C. Only the system.access.audit table, because it retains logs for as long as the account exists.
- D. Azure Storage accounts, because they provide low-cost, long-term archival and batch analysis.
D is correct.
Explanation: Azure Storage accounts offer low-cost, long-term archival and batch analysis. They suit compliance scenarios where logs are accessed infrequently but must be retained for extended periods. Platform administrators configure log delivery at the account level through the Azure portal.
A is incorrect: Azure Log Analytics suits fast analysis, interactive investigations, and dashboards. It is not the destination described for low-cost, long-term archival.
B is incorrect: Azure Event Hubs suits real-time streaming to downstream consumers and SIEM platforms. It is not an archival destination.
C is incorrect: Azure Databricks retains audit logs for up to one year. You need a separate retention strategy for logs beyond that period.
Q07 - Question
A team stores table data in an Azure Data Lake Storage Gen2 account that has firewall and virtual network restrictions. Unity Catalog uses a managed identity through an access connector to reach the storage. The compute nodes are allowed through the firewall. Users have all required Unity Catalog privileges, but queries fail because storage rejects the temporary access token. What should you do?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. Grant SELECT on every table to the users again at the catalog level.
- B. Allow the Azure Databricks access connector and managed identity through the storage account firewall rules.
- C. Replace the managed identity with a service principal so that network rules no longer apply.
- D. Add a row filter function to each table to reduce the rows that storage returns.
B is correct.
Explanation: When a storage account has firewall or virtual network restrictions, you must explicitly allow the access connector and managed identity to reach the storage, in addition to allowing the compute nodes. If the identity is not allowed through the firewall rules, storage can reject a valid token.
A is incorrect: Unity Catalog permission checks already succeeded. More SELECT grants do not change the storage firewall behavior.
C is incorrect: A service principal cannot be used to access storage accounts that are protected by network rules. A managed identity with an access connector can.
D is incorrect: Row filters are enforced on the compute resource after data is returned from storage. They do not affect whether storage accepts the token.
Q08 - Question
You created an Azure Key Vault by using the Azure CLI without setting the permission model. When you try to create an Azure Key Vault-backed secret scope in Azure Databricks, the operation fails with a 403 authorization error. What should you do first?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. Run databricks secrets put-acl to grant the data-engineers group READ on the scope.
- B. Disable the setting that lets trusted Microsoft services bypass the Key Vault firewall.
- C. Change the Key Vault permission model to Vault access policy, and then create the scope.
- D. Grant WRITE on the scope so that Azure Databricks can add secrets to the Key Vault.
C is correct.
Explanation: Azure Databricks does not support the Azure RBAC permission model for Key Vault-backed secret scopes. A Key Vault created without an explicit permission model can default to Azure RBAC, which causes a 403 error during scope creation. In the Azure portal, go to Settings, then Access configuration, and verify that Permission model is set to Vault access policy.
A is incorrect: Scope ACLs control who can read secrets from an existing scope. They cannot fix a failure that occurs while you create the scope.
B is incorrect: You must allow trusted Microsoft services to bypass the firewall, even if you restrict access to specific virtual networks. Disabling it does not address the permission model.
D is incorrect: WRITE is not applicable to Key Vault-backed scopes. You manage secrets directly in Azure Key Vault.
Q09 - Question
The analysts group must query all current and future tables in the finance schema of the corpdata catalog. The group must not be able to query tables in any other schema in that catalog. Which grant approach meets the requirement with the least administrative effort?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. Grant SELECT on each existing table in the finance schema, and repeat the grant for each new table.
- B. Grant USE CATALOG and ALL PRIVILEGES on the corpdata catalog.
- C. Grant SELECT on the finance schema only.
- D. Grant USE CATALOG on the corpdata catalog, and grant USE SCHEMA and SELECT on the finance schema.
D is correct.
Explanation: A user must have USE CATALOG on the catalog and USE SCHEMA on the schema to query a table. A SELECT grant on the schema is inherited by all current and future tables and views in that schema. Access stays limited to that schema.
A is incorrect: Explicit table grants limit access precisely, but they do not cover future tables and require ongoing effort when a schema contains many tables.
B is incorrect: Inheriting from the catalog opens access to every schema and object in the catalog. This exceeds the requirement.
C is incorrect: A SELECT grant on the schema is not enough by itself. If USE CATALOG or USE SCHEMA is missing, the users cannot query the table.
Q10 - Question
A privacy team asks you to permanently remove a customer's records from a Delta table in the bronze layer. The table has deletion vectors enabled. You run a DELETE statement for the customer. You must make sure the underlying data is permanently removed from storage. What should you do next?
Domain: Secure and govern Unity Catalog objects (15–20%) Type: Single choice
- A. Run VACUUM only. VACUUM removes data that deletion vectors marked for deletion.
- B. Run OPTIMIZE only. OPTIMIZE permanently removes deleted rows from the history.
- C. Run REORG TABLE with APPLY (PURGE), and then run VACUUM.
- D. Set delta.logRetentionDuration to 30 days, and wait for the retention period to pass.
C is correct.
Explanation: For tables with deletion vectors enabled, you must run REORG TABLE ... APPLY (PURGE) after deleting records to permanently remove the underlying data. After the deletion operations, run VACUUM to remove the data files from storage. VACUUM permanently deletes files older than the retention threshold, so run it carefully.
A is incorrect: VACUUM by itself does not remove data that deletion vectors have marked for deletion.
B is incorrect: OPTIMIZE improves file layout and query performance. The evidence does not show that it permanently removes deleted records.
D is incorrect: The delta.logRetentionDuration property controls how long transaction log history is kept. Increasing it preserves history longer and does not purge deleted data.