Configure Access Controls Using the UI and SQL by Applying GRANT, REVOKE, and DENY Privileges to Principals (users, Groups, and Service Principals) at Appropriate Levels of the Security Hierarchy. DATA-ENGINEER-ASSOCIATE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A user `dave` is a member of the `analysts` group, which has SELECT on the `sales` catalog. The admin runs `DENY SELECT ON CATALOG sales TO dave;`. Later, the admin runs `GRANT SELECT ON TABLE sales.quarterly TO dave;`. What is Dave's effective access to `sales.quarterly`?

   • ADave has SELECT access because the table-level grant is more specific than the catalog-level DENY.
   • BDave's access is indeterminate until the admin runs REVOKE on the DENY.
   • CDave has SELECT access because the explicit table-level grant overrides the catalog-level DENY.
   • DDave does not have SELECT access because the catalog-level DENY overrides the table-level grant.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following correctly describes the precedence of privileges in Databricks?

   • AREVOKE takes precedence over DENY, and GRANT is used to remove REVOKE.
   • BDENY takes precedence over GRANT, and REVOKE removes explicit grants.
   • CDENY and GRANT have equal precedence, and REVOKE is used to remove DENY.
   • DGRANT takes precedence over DENY, and REVOKE removes all privileges.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A user `grace` has an explicit GRANT SELECT ON TABLE `sales.quarterly` and is a member of the `sales_team` group, which has GRANT SELECT ON CATALOG `sales`. The admin runs `REVOKE SELECT ON CATALOG sales FROM sales_team;`. What is Grace's effective access to `sales.quarterly`?

   • AGrace loses SELECT access because the catalog-level grant was the primary source of her access.
   • BGrace loses SELECT access because REVOKE cascades to all dependent grants.
   • CGrace's access is now determined solely by her group membership, which is unchanged.
   • DGrace still has SELECT access because her explicit table-level grant remains in effect.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the Databricks UI, where would you go to view and modify privileges for a specific table?

   • AThe account console, under the Users tab
   • BThe SQL Warehouse page, under the Query History tab
   • CThe workspace Settings page, under the Access Control tab
   • DThe table's Catalog Explorer page, under the Permissions tab
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A user is a member of the 'analysts' group, which has SELECT on the 'sales' table. You execute DENY SELECT ON TABLE sales TO `alice@example.com`;. What is the result?

   • AAlice can SELECT only if she is also granted SELECT directly.
   • BAlice can still SELECT because the group grant is stronger.
   • CAlice cannot SELECT on the sales table.
   • DAlice loses her membership in the analysts group.
   Reveal Solution Discussion Select an answer first