Secure Unity Catalog Objects DP-750 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of using a service principal for authentication in Azure Databricks?

   • ATo allow multiple users to share the same login credentials.
   • BTo replace the need for Azure Key Vault in storing secrets.
   • CTo provide interactive login for end users.
   • DTo enable automated and secure access to Azure resources without using a user's personal credentials.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company runs Azure Databricks on a cluster that uses a managed identity to access Azure Data Lake Storage Gen2. The managed identity has been granted Storage Blob Data Reader on the storage account. The cluster is configured with the managed identity as the credential. Users run queries on external tables in Unity Catalog that point to this storage. Queries fail with a permission error. What should you check first?

   • AVerify that the managed identity has been added as a service principal in Databricks.
   • BVerify that the managed identity has been granted `SELECT` on the external tables in Unity Catalog.
   • CVerify that the cluster has the correct managed identity assigned and that the storage account firewall allows access from the managed identity.
   • DVerify that the managed identity has been granted `Storage Blob Data Contributor` instead of Reader.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare company has a Unity Catalog table `patients.visits` with columns `patient_id`, `doctor_id`, `diagnosis`, and `visit_date`. Doctors should see only the rows for patients they have treated. The table has a column `doctor_id`. Each doctor is a user in Databricks. You need to implement row-level security so that each doctor sees only their own patients. What is the most efficient approach?

   • ACreate a dynamic view that filters `doctor_id = current_user()` and grant `SELECT` on the view to all doctors.
   • BUse column-level security to hide the `diagnosis` column from doctors.
   • CCreate a view that filters `doctor_id = 'doctor@example.com'` and grant access to that doctor only.
   • DCreate a separate table for each doctor and grant access to each table.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You are setting up an Azure Databricks cluster that runs a streaming job. The job reads from an Azure Event Hub and writes to a Unity Catalog table. You want to authenticate to Event Hub using a managed identity to avoid managing secrets. What should you do?

   • ACreate a service principal and assign it the `Azure Event Hubs Data Sender` role, then configure the cluster to use the service principal.
   • BUse the cluster's managed identity to access Key Vault and retrieve the Event Hub connection string.
   • CEnable a managed identity on the cluster and grant it the `Azure Event Hubs Data Sender` role on the Event Hub namespace, then configure the streaming job to use the managed identity.
   • DStore the Event Hub connection string in a Key Vault-backed secret scope and reference it in the streaming job.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A data engineering team runs Azure Databricks on a cluster that uses a managed identity to access Azure Data Lake Storage. The managed identity has been granted `Storage Blob Data Contributor` on the storage account. The cluster is configured to use the managed identity. Users run queries on external tables that point to this storage. Queries fail with a permission error. You have verified that the managed identity is assigned to the cluster and the storage account firewall allows the identity. What should you check next?

   • AVerify that the storage account is in the same region as the Databricks workspace.
   • BVerify that the external tables in Unity Catalog have been granted `SELECT` to the users.
   • CVerify that the managed identity has been granted `Storage Blob Data Reader` instead of Contributor.
   • DVerify that the cluster has been restarted after assigning the managed identity.
   Reveal Solution Discussion Select an answer first