LFC Security & Governance 3 — Questions and Answers
Question 1: Delta Sharing is an open protocol for sharing data. Which of the following best describes what a 'recipient' is in Delta Sharing?
- A Databricks workspace that owns the shared data
- An entity (person or organization) authorized to access shared data (Correct answer)
- A Delta table configured for external access
- A Unity Catalog metastore in the receiving region
Correct answer: An entity (person or organization) authorized to access shared data
In Delta Sharing, a recipient is an authenticated entity — which can be inside or outside Databricks — that has been granted access to one or more shares.
Question 2: Which Unity Catalog privilege must be granted on a schema before a user can create new tables inside it?
- USE SCHEMA
- CREATE TABLE (Correct answer)
- MODIFY
- WRITE FILES
Correct answer: CREATE TABLE
The CREATE TABLE privilege on a schema allows a user to create new tables within that schema; USE SCHEMA is also required but alone is not sufficient for table creation.
Question 3: An audit log in Databricks records which of the following types of events?
- Only failed authentication attempts
- Cluster CPU utilization spikes
- Data access, permission changes, and workspace administration actions (Correct answer)
- Delta table VACUUM operations only
Correct answer: Data access, permission changes, and workspace administration actions
Databricks audit logs capture a broad range of events including data reads/writes, permission grants/revocations, login events, and admin actions for compliance purposes.
Question 4: What is the purpose of the INFORMATION_SCHEMA in Unity Catalog?
- To store encrypted credentials for external data sources
- To provide a queryable view of metadata such as tables, columns, and privileges (Correct answer)
- To cache query results for performance optimization
- To hold row-level security policies
Correct answer: To provide a queryable view of metadata such as tables, columns, and privileges
INFORMATION_SCHEMA is a system schema within each catalog that exposes metadata about tables, columns, grants, and other objects as queryable views.
Question 5: When using Unity Catalog, what happens if a user runs SELECT * on a table where a column mask is applied and they do not meet the mask's condition?
- The query fails with a permission denied error
- The masked column returns NULL or a transformed value instead of the real data (Correct answer)
- The entire row is hidden from the result set
- The query returns data only for rows where the mask condition is true
Correct answer: The masked column returns NULL or a transformed value instead of the real data
Column masks transform (e.g., nullify or hash) the column value for users who don't meet the policy condition, rather than blocking the query entirely.
Question 6: Which of the following is a key difference between workspace-local Hive metastore tables and Unity Catalog tables?
- Unity Catalog tables cannot store Parquet files
- Hive metastore provides cross-workspace lineage; Unity Catalog does not
- Unity Catalog provides centralized governance across workspaces; Hive metastore is workspace-scoped (Correct answer)
- Hive metastore supports column masks; Unity Catalog does not
Correct answer: Unity Catalog provides centralized governance across workspaces; Hive metastore is workspace-scoped
Unity Catalog provides centralized, account-level governance spanning multiple workspaces, while the legacy Hive metastore is isolated to a single workspace.
Question 7: In Unity Catalog's three-level namespace, what is the correct order of hierarchy?
- Schema → Catalog → Table
- Catalog → Table → Schema
- Catalog → Schema → Table (Correct answer)
- Metastore → Table → Schema
Correct answer: Catalog → Schema → Table
Unity Catalog uses a three-level namespace: catalog.schema.table, where catalog is the top container, schema organizes tables within it, and tables are the leaf objects.
LFC Security & Governance 3
Delta Sharing is an open protocol for sharing data.
Which of the following best describes what a 'recipient' is in Delta Sharing?