LFC Unity Catalog & Data Governance 3 — Questions and Answers
Question 1: What is the key difference between a managed table and an external table in Unity Catalog?
- Managed tables support ACID transactions; external tables do not
- Unity Catalog controls the lifecycle and storage of managed tables; external tables use user-specified storage (Correct answer)
- External tables can only be read; managed tables support full DML
- Managed tables are stored in Delta format; external tables must use Parquet
Correct answer: Unity Catalog controls the lifecycle and storage of managed tables; external tables use user-specified storage
For managed tables Unity Catalog controls the data location and deletes the underlying files when the table is dropped, while external tables point to user-managed storage.
Question 2: A Unity Catalog admin needs to configure access to an S3 bucket for external tables. Which two objects must be created?
- Storage credential and external location (Correct answer)
- Instance profile and external location
- Storage credential and volume
- Service principal and storage credential
Correct answer: Storage credential and external location
A storage credential (IAM role or service principal) and an external location (path + credential binding) are both required to access external cloud storage in Unity Catalog.
Question 3: Which statement about Unity Catalog's row-level security is correct?
- It is configured via CREATE POLICY SQL statements at the catalog level
- It is implemented using dynamic views that filter rows based on the current user or group (Correct answer)
- It requires a separate Databricks add-on license
- It can only be applied to Delta tables, not external tables
Correct answer: It is implemented using dynamic views that filter rows based on the current user or group
Row-level security in Unity Catalog is implemented by creating dynamic views that use current_user() or IS_MEMBER() functions to filter rows.
Question 4: In Unity Catalog, which built-in function is used within a dynamic view to return the email address of the currently logged-in user?
- SESSION_USER()
- current_user() (Correct answer)
- CURRENT_ACCOUNT()
- USER_CONTEXT()
Correct answer: current_user()
The current_user() function in Unity Catalog dynamic views returns the email of the authenticated user making the query.
Question 5: A data steward applies a column mask to a PII column in Unity Catalog. What happens when a user without the 'unmask' privilege queries that column?
- The query fails with a permission denied error
- The column is hidden and not returned in results
- The masking function returns a substituted or redacted value (Correct answer)
- The column displays NULL for all rows
Correct answer: The masking function returns a substituted or redacted value
Column masking applies a masking function that returns a transformed (e.g., redacted or tokenized) value rather than blocking access entirely.
Question 6: Which Unity Catalog object represents a named, reusable set of permissions that can be assigned to principals?
- Workspace group
- Account group
- Role (Correct answer)
- Privilege set
Correct answer: Role
Unity Catalog does not use traditional RBAC roles in the same way; permissions are granted directly, but account groups serve as the primary way to manage access at scale.
Question 7: When auditing data access in Unity Catalog, where are the audit logs stored by default?
- In the Unity Catalog metastore's system tables under system.access (Correct answer)
- In the Databricks workspace's DBFS root
- In a user-specified S3 bucket configured during metastore setup
- In Azure Monitor or AWS CloudWatch only
Correct answer: In the Unity Catalog metastore's system tables under system.access
Unity Catalog audit logs are available via system tables in the system.access schema, enabling SQL-based audit queries.
LFC Unity Catalog & Data Governance 3
What is the key difference between a managed table and an external table in Unity Catalog?