Configure Access Controls Using the UI and SQL by Applying GRANT, REVOKE, and DENY Privileges to Principals (users, Groups, and Service Principals) at Appropriate Levels of the Security Hierarchy. DATA-ENGINEER-ASSOCIATE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a valid principal type in Databricks?

   • ATable
   • BUser
   • CWarehouse
   • DSchema
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   A data engineer needs to remove a previously granted SELECT privilege on the table sales.orders from the group analysts, but the engineer wants to keep any other privileges that the group may hold on the table. Which SQL statement accomplishes this?

   • AGRANT SELECT ON TABLE sales.orders TO analysts;
   • BDENY SELECT ON TABLE sales.orders TO analysts;
   • CREVOKE SELECT ON TABLE sales.orders FROM analysts;
   • DREVOKE ALL PRIVILEGES ON TABLE sales.orders FROM analysts;
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has a group `external_auditors` that needs read access to the `finance` catalog. However, one member of that group, `bob@example.com`, should not have access to the `finance.transactions` table due to a conflict of interest. The admin has already granted SELECT on the `finance` catalog to `external_auditors`. What is the most efficient way to enforce this restriction?

   • ADENY SELECT ON CATALOG finance TO bob@example.com;
   • BREVOKE SELECT ON CATALOG finance FROM external_auditors;
   • CCreate a new group `auditors_no_transactions`, add all auditors except Bob to it, grant SELECT on the catalog to the new group, and remove the original grant.
   • DDENY SELECT ON TABLE finance.transactions TO bob@example.com;
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following correctly lists the Databricks security hierarchy from the highest level to the lowest level?

   • ACatalog → Schema → Table → Workspace → Account
   • BAccount → Workspace → Catalog → Schema → Table
   • CAccount → Catalog → Workspace → Schema → Table
   • DWorkspace → Account → Catalog → Table → Schema
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the effect of a DENY privilege on a securable object?

   • AIt denies the privilege only if the principal does not have a grant.
   • BIt denies all privileges on the object, not just the specified one.
   • CIt removes any previously granted privileges on the object.
   • DIt explicitly denies the specified privilege to the principal, overriding any grants.
   Reveal Solution Discussion Select an answer first