Data Engineering Data Governance and Security Questions and Answers 1 — Questions and Answers
Question 1: A data engineering team is setting up access permissions for a new data lake containing sensitive customer information. The requirement is to grant access based on a combination of an employee's department (e.g., 'Sales', 'Marketing'), their seniority level (e.g., 'Analyst', 'Manager'), and the data's sensitivity classification. Access rights must be dynamic and reflect changes in an employee's role or data classification without manual intervention. Which access control model is most suitable for this requirement?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
- Role-Based Access Control (RBAC)
Correct answer: Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is the ideal model for this scenario because it provides fine-grained, dynamic control by evaluating rules against the attributes of users, resources, and the environment. [8, 9, 12] Unlike RBAC, which is tied to predefined roles, ABAC can use multiple attributes (like department, seniority, and data sensitivity) to make real-time access decisions, offering greater flexibility and scalability. [9, 14]
Question 2: A data engineer needs to provide a dataset to a third-party analytics vendor. The dataset contains user email addresses and phone numbers, which must be protected. The requirement is to replace these sensitive fields with irreversible, unique identifiers to prevent re-identification of individuals, while still allowing the vendor to count unique users. Which data protection technique should be used?
- Encryption at Rest
- Data Masking with Shuffling
- Anonymization using a cryptographic hash function (Correct answer)
- Data Virtualization
Correct answer: Anonymization using a cryptographic hash function
Anonymization using a one-way cryptographic hash function (like SHA-256) is the correct technique. Hashing transforms the PII into a fixed-length string that is computationally infeasible to reverse, thus protecting the original data. [7, 19, 21] Since the same input always produces the same output, it allows the vendor to count distinct individuals without exposing the actual PII. [11] Encryption is reversible, and data masking may not guarantee irreversibility or uniqueness suitable for counting.
Question 3: In a mature data governance framework, which of the following roles is primarily responsible for the day-to-day management of a specific data domain, including defining data quality rules and ensuring compliance with policies for that domain?
- Chief Data Officer (CDO)
- Data Steward (Correct answer)
- Data Engineer
- Data Custodian
Correct answer: Data Steward
A Data Steward is a subject matter expert for a specific data domain (e.g., Customer Data, Product Data). They are responsible for the hands-on governance of that data, including defining its meaning, setting quality standards, and managing its lifecycle. [18, 24] A Data Custodian is more focused on the technical implementation, storage, and security of the data, while a CDO focuses on overall data strategy. [2, 17, 20]
Question 4: A financial services company's compliance department is auditing a critical regulatory report and discovers a discrepancy in a key metric. To investigate, they need to trace the metric back through all the transformations and data pipelines to its original source systems. What data governance capability is essential for this investigation?
- Data Lineage (Correct answer)
- Master Data Management (MDM)
- Data Cataloging
- Data Encryption
Correct answer: Data Lineage
Data lineage provides a complete audit trail of data's journey, showing its origin, every transformation it undergoes, and its final destination. [1, 4, 6] This visibility is crucial for root cause analysis of errors, impact analysis of changes, and meeting regulatory compliance requirements by proving the provenance of data in reports. [5, 15]
Question 5: A data engineer is working for a healthcare provider in the United States and is building a pipeline to process patient records containing Protected Health Information (PHI). Which of the following regulations is the primary compliance framework they must adhere to when handling this data?
- GDPR (General Data Protection Regulation)
- CCPA (California Consumer Privacy Act)
- SOX (Sarbanes-Oxley Act)
- HIPAA (Health Insurance Portability and Accountability Act) (Correct answer)
Correct answer: HIPAA (Health Insurance Portability and Accountability Act)
The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law that establishes national standards to protect sensitive patient health information (PHI) from being disclosed without the patient's consent or knowledge. [31, 34] It is the primary regulation governing the use and disclosure of health data in the United States, and data engineers working with this data must implement appropriate technical safeguards to ensure compliance. [35]
Question 6: A data engineering team is establishing a data quality program. They are focusing on ensuring that all customer records in their data warehouse contain a valid state and ZIP code, as these fields are mandatory for shipping analysis. Which dimension of data quality are they primarily addressing?
- Completeness (Correct answer)
- Accuracy
- Timeliness
- Uniqueness
Correct answer: Completeness
Completeness is the data quality dimension that refers to the degree to which all required data is present in a dataset. [3, 10, 13] By ensuring that the mandatory state and ZIP code fields are not null or empty, the team is directly addressing the completeness of the customer records. [22] Accuracy would refer to whether the ZIP code is the *correct* one for the state, but the primary concern described is that the fields are filled in at all.
Data Engineering Data Governance and Security Questions and Answers 1
A data engineering team is setting up access permissions for a new data lake containing sensitive customer information.
The requirement is to grant access based on a combination of an employee's department (e.g., 'Sales', 'Marketing'), their seniority level (e.g., 'Analyst', 'Manager'), and the data's sensitivity classification.
Access rights must be dynamic and reflect changes in an employee's role or data classification without manual intervention.
Which access control model is most suitable for this requirement?