Configure Access Controls Using the UI and SQL by Applying GRANT, REVOKE, and DENY Privileges to Principals (users, Groups, and Service Principals) at Appropriate Levels of the Security Hierarchy. DATA-ENGINEER-ASSOCIATE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   If a user is granted the USAGE privilege on a catalog, what is the effect on the schemas and tables within that catalog?

   • AThe user gets SELECT on all tables in the catalog.
   • BThe user gets USAGE only on the catalog itself, not on any schemas or tables.
   • CThe user gets USAGE on schemas but not on tables.
   • DThe user automatically gets USAGE on all schemas and tables in the catalog.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the effect of executing REVOKE SELECT ON TABLE sales FROM `alice@example.com`; if alice was granted SELECT on the table directly?

   • AAlice loses all privileges on the sales table.
   • BAlice retains SELECT because REVOKE only affects inherited privileges.
   • CAlice loses SELECT on all tables in the schema.
   • DAlice loses the SELECT privilege on the sales table.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which privilege must be granted on a schema to allow a user to create a table within that schema?

   • AUSAGE
   • BSELECT
   • CMODIFY
   • DCREATE
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A workspace admin needs to grant a service principal `svc-reporting` the ability to read all tables in the `reporting` schema. The service principal is not a member of any group. Which SQL statement should the admin run?

   • AGRANT SELECT ON TABLE reporting.* TO svc-reporting;
   • BGRANT SELECT ON ALL TABLES IN SCHEMA reporting TO svc-reporting;
   • CGRANT SELECT ON CATALOG reporting TO svc-reporting;
   • DGRANT SELECT ON SCHEMA reporting TO svc-reporting;
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A user `alice@example.com` was previously granted SELECT on the `hr.employees` table. Later, the `hr_analysts` group, of which Alice is a member, was granted SELECT on the `hr` catalog. The security team now wants Alice to lose access to the `hr.employees` table specifically, but she should still be able to read other tables in the `hr` catalog. Which statement should the admin run?

   • ADENY SELECT ON CATALOG hr TO alice@example.com;
   • BREVOKE SELECT ON TABLE hr.employees FROM alice@example.com;
   • CREVOKE SELECT ON CATALOG hr FROM hr_analysts;
   • DDENY SELECT ON TABLE hr.employees TO alice@example.com;
   Reveal Solution Discussion Select an answer first