Secure Unity Catalog Objects DP-750 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which privilege is required to allow a user to read data from a table in Unity Catalog?

   • AMODIFY
   • BSELECT
   • CCREATE
   • DUSAGE
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A data engineering team runs Azure Databricks notebooks that need to access a storage account using a SAS token stored in Azure Key Vault. The team wants to avoid exposing the SAS token in notebook code or Databricks secrets. They have enabled the Databricks-managed Key Vault integration. What should they do to securely access the SAS token in a notebook?

   • AMount the storage account using the SAS token and access files via the mount point.
   • BStore the SAS token in a notebook cell and reference it as a variable.
   • CUse `dbutils.secrets.get(scope="my-scope", key="sas-token")` in the notebook to retrieve the secret.
   • DUse the Azure Key Vault REST API directly from the notebook to fetch the secret.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which Azure Active Directory object is used to represent an application or automated workload for authentication?

   • AGroup principal
   • BManaged identity
   • CUser principal
   • DService principal
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A financial services company uses Unity Catalog to manage access to a table `finance.transactions`. The table contains a `region` column and a `amount` column. Compliance requires that users in the `auditors` group see all rows but only for regions where they have been explicitly granted access. Users in the `analysts` group should see all rows but with `amount` masked for rows where the `region` is not their own. You need to implement this with minimal administrative overhead. What should you do?

   • AGrant `SELECT` on the table to both groups and rely on the users to only query allowed regions.
   • BUse column-level security to hide the `amount` column from analysts and row-level security for auditors.
   • CCreate two separate views: one for auditors that filters rows, and one for analysts that masks the amount column.
   • DCreate a dynamic view that filters rows for auditors based on a region mapping table, and for analysts, masks the `amount` column using a CASE expression based on the same mapping.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses Azure Databricks for ETL jobs that run on a schedule. The jobs are owned by a service principal. The service principal needs to access a Unity Catalog table and an Azure Key Vault secret. What should you configure to allow the service principal to authenticate and access these resources?

   • AStore the service principal's client secret in a Databricks secret scope and use it in the job.
   • BUse a managed identity instead of a service principal for the job.
   • CAdd the service principal to the Databricks workspace, grant it `SELECT` on the table, and grant it `Get` permission on the Key Vault secret.
   • DGrant the service principal `SELECT` on the table and add it to the `admins` group.
   Reveal Solution Discussion Select an answer first