Security & Governance Flashcards

Which system table in Unity Catalog can be queried to see a history of all privilege grants and revocations on a securable object?

Answer: system.access.audit

The system.access.audit table records all access-related events including GRANT and REVOKE operations, enabling compliance auditing.

What is the effect of granting the ALL PRIVILEGES privilege to a user on a Unity Catalog schema?

Answer: The user receives every applicable privilege on the schema and its child objects

ALL PRIVILEGES is a shorthand that grants every applicable permission (SELECT, MODIFY, CREATE TABLE, etc.) on the target object and cascades to its children.

In Unity Catalog, which component stores the cloud storage access credentials (e.g., an IAM role or managed identity) needed to access an external location?

Answer: Storage credential

A storage credential in Unity Catalog encapsulates the cloud IAM role or managed identity that Databricks uses to authenticate to cloud object storage.

A data steward needs to ensure that any new tables created in a production catalog automatically inherit a 'confidential' classification tag. Which approach best supports this at scale?

Answer: Use Unity Catalog tag propagation policies

Unity Catalog supports tag inheritance and propagation policies that allow tags set at a catalog or schema level to flow down to child objects automatically.

Which Databricks feature allows a data owner to share live, updateable data with an external organization while maintaining full control over what data is shared and with whom?

Answer: Delta Sharing with provider/recipient model

Delta Sharing's provider/recipient model lets a data owner define shares containing specific tables or partitions and control which named recipients can access them.

When using Databricks Secrets, what is the correct way to reference a secret value inside a notebook to avoid exposing it in plain text?

Answer: Store the secret in a Python variable using dbutils.secrets.get() and use the variable in code

Using dbutils.secrets.get() assigns the secret to a variable that Databricks redacts in notebook output, preventing accidental exposure in logs or cell results.

Which of the following best describes the principle of least privilege as applied to Unity Catalog?

Answer: Users and service principals should be granted only the minimum permissions required for their specific tasks

Least privilege means granting each identity only the permissions it needs — no more — reducing the blast radius of compromised accounts or misconfigured jobs.