LFC Security & Governance 2 — Questions and Answers
Question 1: In Unity Catalog, which object represents the top-level container that is linked to a Databricks account and can be shared across multiple workspaces?
- Catalog
- Metastore (Correct answer)
- Schema
- Volume
Correct answer: Metastore
The metastore is the top-level Unity Catalog object that is associated with a Databricks account region and shared across workspaces.
Question 2: Which Unity Catalog privilege allows a user to read data from a table but explicitly prevents them from viewing the table's column definitions?
- SELECT (Correct answer)
- READ FILES
- BROWSE
- EXECUTE
Correct answer: SELECT
SELECT grants the ability to read rows from a table; however, BROWSE is required to view metadata without data access — SELECT alone does not hide column definitions.
Question 3: A data engineer wants to prevent a specific column containing Social Security Numbers from being visible to analysts while still letting them query other columns. Which Unity Catalog feature should they use?
- Row filters
- Column masks (Correct answer)
- Dynamic views
- Table ACLs
Correct answer: Column masks
Column masks in Unity Catalog allow you to apply a masking function to a specific column so that sensitive values are hidden or transformed for unauthorized users.
Question 4: What does Unity Catalog's data lineage feature automatically track?
- The cost of each query run against a table
- How data flows between tables, notebooks, and workflows (Correct answer)
- The number of rows inserted per transaction
- Encryption key rotation history
Correct answer: How data flows between tables, notebooks, and workflows
Unity Catalog automatically captures column-level and table-level lineage, showing how data moves and transforms across notebooks, jobs, and tables.
Question 5: In Databricks, which built-in role grants a user the ability to manage all objects within a specific catalog without being an account admin?
- Catalog Admin (Correct answer)
- Data Steward
- Metastore Admin
- Workspace Admin
Correct answer: Catalog Admin
Catalog Admin is a Unity Catalog role that grants full management privileges over all objects (schemas, tables, volumes) within a specific catalog.
Question 6: Which statement correctly describes how Unity Catalog handles external tables compared to managed tables from a security standpoint?
- External tables are automatically encrypted; managed tables are not
- Dropping a managed table deletes the data, while dropping an external table leaves the underlying files intact (Correct answer)
- External tables require row-level security; managed tables do not
- Unity Catalog cannot govern external tables
Correct answer: Dropping a managed table deletes the data, while dropping an external table leaves the underlying files intact
Managed tables have their lifecycle fully controlled by Unity Catalog (data deleted on drop), whereas external tables only drop the metadata and leave cloud storage files untouched.
Question 7: A company must ensure that only users in the EU region can access tables containing EU customer data. Which Unity Catalog capability supports this requirement?
- Attribute-based access control using location tags
- Delta Sharing with recipient profiles
- Row filters tied to session context functions like current_user() (Correct answer)
- Metastore-level geo-fencing
Correct answer: Row filters tied to session context functions like current_user()
Row filters in Unity Catalog can reference context functions such as current_user() or IS_ACCOUNT_GROUP_MEMBER() to dynamically restrict which rows a user can see based on their identity.
LFC Security & Governance 2
In Unity Catalog, which object represents the top-level container that is linked to a Databricks account and can be shared across multiple workspaces?