Configure Access Controls Using the UI and SQL by Applying GRANT, REVOKE, and DENY Privileges to Principals (users, Groups, and Service Principals) at Appropriate Levels of the Security Hierarchy. DATA-ENGINEER-ASSOCIATE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A user `erin` has the following privileges: an explicit GRANT SELECT ON TABLE `hr.salaries` and membership in the `hr_team` group, which has GRANT SELECT ON SCHEMA `hr`. The admin runs `REVOKE SELECT ON SCHEMA hr FROM hr_team;`. What is Erin's effective access to `hr.salaries`?

   • AErin loses SELECT access because REVOKE cascades to all dependent grants.
   • BErin loses SELECT access because the schema-level grant was the primary source of her access.
   • CErin still has SELECT access because her explicit table-level grant remains in effect.
   • DErin's access is now determined solely by her group membership, which is unchanged.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a Unity Catalog metastore with the `sales` catalog containing schemas `us` and `eu`. The `us_analysts` group needs SELECT on all tables in the `us` schema, and the `eu_analysts` group needs SELECT on all tables in the `eu` schema. The admin wants to minimize the number of GRANT statements. Which approach should the admin take?

   • AGRANT SELECT ON TABLE sales.us.* TO us_analysts; GRANT SELECT ON TABLE sales.eu.* TO eu_analysts;
   • BGRANT SELECT ON SCHEMA sales.us TO us_analysts; GRANT SELECT ON SCHEMA sales.eu TO eu_analysts;
   • CGRANT SELECT ON CATALOG sales TO us_analysts; GRANT SELECT ON CATALOG sales TO eu_analysts;
   • DGRANT SELECT ON ALL TABLES IN SCHEMA sales.us TO us_analysts; GRANT SELECT ON ALL TABLES IN SCHEMA sales.eu TO eu_analysts;
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which privilege allows a user to read data from a table?

   • AMODIFY
   • BUSAGE
   • CSELECT
   • DCREATE
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A user `frank` has the following privileges: an explicit GRANT SELECT ON TABLE `hr.salaries`, membership in the `hr_team` group which has GRANT SELECT ON SCHEMA `hr`, and an explicit DENY SELECT ON TABLE `hr.salaries`. What is Frank's effective access to `hr.salaries`?

   • AFrank does not have SELECT access because the DENY overrides all grants.
   • BFrank's access is determined by the most recent statement issued.
   • CFrank has SELECT access because the explicit grant is more specific than the DENY.
   • DFrank has SELECT access because the explicit grant and the group grant both provide access.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   If a user has SELECT on a table through a group membership, and you execute REVOKE SELECT ON TABLE sales FROM the user directly, what happens?

   • AThe user loses SELECT on the table because the direct revoke overrides the group grant.
   • BThe user still has SELECT on the table through the group membership.
   • CThe user loses SELECT on all tables in the schema.
   • DThe user loses SELECT on the table and also loses membership in the group.
   Reveal Solution Discussion Select an answer first