Use Masking Techniques as Guard Rails to Meet a Performance Objective GENERATIVE-AI-ENGINEER-ASSOCIATE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm stores customer account data in Unity Catalog. The compliance team requires that account numbers be shown only to users in the 'account_manager' role. For all other users, the account number must appear as 'XXXX-XXXX-XXXX-1234', showing only the last four digits. The platform team wants to implement this using a reusable masking pattern. Which approach should they take?

   • ACreate a view that uses regexp_extract to pull the last four digits and concatenate with 'XXXX-XXXX-XXXX-' for all users.
   • BCreate a custom masking function that formats the account number to show only the last four digits, and apply it as a column mask with an exemption for the 'account_manager' role.
   • CStore the account numbers in a separate table and grant the 'account_manager' role access to that table only.
   • DUse the built-in sha256 hash function on the account number column for all users, and grant the 'account_manager' role access to the raw column.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A data team needs to provide a dataset to an external vendor for testing an application. The dataset contains customer PII. Which approach is most appropriate?

   • AEncrypt the production dataset and share the encryption key with the vendor.
   • BGrant the vendor access to the production table with dynamic masking rules applied.
   • CProvide the vendor with a sample of the production data that excludes all columns containing PII.
   • DCreate a static masked copy of the dataset and share that copy with the vendor.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of using a built-in masking function in Databricks SQL?

   • ASELECT hash(email) FROM users;
   • BSELECT encrypt(email) FROM users;
   • CSELECT mask(email) FROM users;
   • DSELECT redact(email) FROM users;
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A data platform team is designing a governance strategy for a new lakehouse. The team wants to ensure that sensitive columns such as national ID numbers are not exposed to unauthorized users, while minimizing the performance overhead on frequently accessed tables. The team also needs to support both ad-hoc analytics and production dashboards. Which combination of techniques should the team prioritize?

   • ACreate static masked copies of all tables and route all queries to the copies.
   • BEncrypt all sensitive columns and provide the decryption key to all authorized users.
   • CUse row-level security to restrict access to sensitive rows for unauthorized users.
   • DApply dynamic masking to the sensitive columns and grant appropriate roles exemptions, while using simpler masking functions for high-traffic tables.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the key characteristic of dynamic data masking in Databricks?

   • AIt encrypts the data in the table so that only users with the decryption key can see the original values.
   • BIt permanently replaces the original data with masked values in the source table.
   • CIt redacts sensitive data at query time based on the user's role, without altering the underlying stored data.
   • DIt creates a separate, sanitized copy of the table that is used for all queries.
   Reveal Solution Discussion Select an answer first