Task 7.2: Configure access controls using the UI and SQL by applying GRANT, REVOKE, and DENY privileges to principals (users, groups, and service principals) at appropriate levels of the security hierarchy.

• AUSE CATALOG on main and USE SCHEMA on each of its schemas

  Incorrect

  Usage privileges are required to interact with objects inside a catalog or schema but give no privilege on the tables themselves; discovering objects and requesting access is what BROWSE provides.

• BBROWSE on each table in main, granted table by table

  Incorrect

  For tables, views, volumes and functions, BROWSE can be granted at the catalog level only, not on the individual tables.

• CBROWSE on the catalog main

  Correct

  BROWSE on a catalog lets users see that its objects exist, view their name, description and tags, and request access, without access to the data and without USE CATALOG or USE SCHEMA.

• DMANAGE on the catalog main

  Incorrect

  MANAGE is an administrative privilege that goes far beyond discovery, and on a catalog it extends to every schema and table in it.

BROWSE is the discovery privilege of Unity Catalog. Granted on a catalog, it shows every object in it with its metadata and lets users request access, while reading data still needs SELECT on the object. Databricks recommends granting BROWSE on catalogs to the All account users group to make data discoverable.

• ADENY SELECT on a Unity Catalog table blocks SELECT the group inherits from the catalog

  Incorrect

  The DENY statement is not supported by Unity Catalog; access there is controlled by what is granted, or by ABAC policies.

• BABAC DENY policies can currently deny SELECT on tables tagged as sensitive

  Incorrect

  DENY policies are in Beta and currently scoped to the MANAGE ACCESS CONTROL privilege, not SELECT.

• CThe DENY statement applies to the legacy hive_metastore catalog and its objects

  Correct

  DENY is a table access control statement for the Hive metastore; the reference page notes that Unity Catalog does not support it.

• DIn the Hive metastore, revoking the same privilege undoes a DENY

  Correct

  To undo a DENY you REVOKE the same privilege from the principal.

• EA DENY SELECT on a hive_metastore schema leaves SELECT on its tables

  Incorrect

  Denying a privilege on a schema implicitly denies that privilege on all objects in the schema, and a deny takes precedence over any explicit or implicit grant.

In Unity Catalog you restrict access by not granting it, by revoking it, or with row filters, column masks and ABAC policies. DENY belongs to the legacy Hive metastore model.

• ASELECT granted on each table that is currently in main.sales

  Incorrect

  Grants on individual tables do not cover tables created later.

• BUSE CATALOG, USE SCHEMA and SELECT granted on the catalog main

  Incorrect

  Grants on the catalog are inherited by every schema in it, which is broader than needed.

• CUSE CATALOG on main, plus USE SCHEMA and SELECT on main.sales

  Correct

  SELECT on a schema is inherited by its current and future tables, and the usage privileges let analysts reach them.

• DOwnership of main.sales given to the analysts group

  Incorrect

  Ownership grants far more than read access, including dropping objects and managing grants.

Grant at the lowest container that covers the need, so inheritance handles future objects without extra scope.

• AShe is in analysts, and the schema-level SELECT reaches the table

  Correct

  Privileges reach a principal through group membership and through inheritance from parent objects; revoking her direct grant leaves those in place.

• BREVOKE takes effect after a 24-hour delay

  Incorrect

  Privilege changes are not delayed in this way.

• CA row filter on the table lets her keep reading it

  Incorrect

  A row filter limits which rows readers see; it does not give anyone access to the table.

• DREVOKE failed silently because she had no direct grant

  Incorrect

  REVOKE succeeds whether or not the privilege was granted, but that does not explain her access.

To take access away, find every path to it: direct grants, group grants and grants on parent catalogs and schemas.

• AALL PRIVILEGES on finance

  Incorrect

  ALL PRIVILEGES gives data access but leaves out MANAGE, so the steward could not manage grants.

• BOwnership of finance

  Incorrect

  An object has one owner, and the current owner must stay.

• CBROWSE on finance

  Incorrect

  BROWSE gives no right to grant or revoke privileges on the catalog or its objects.

• DMANAGE on finance

  Correct

  MANAGE lets a non-owner grant and revoke privileges, transfer ownership and drop the object, and it is inherited by child objects.

MANAGE delegates administration without ownership. Ownership belongs to one principal; MANAGE can be granted to several.

• ADESCRIBE HISTORY main.sales.orders

  Incorrect

  This lists the table's write operations and their metadata, not its grants.

• BSHOW GRANTS ON TABLE main.sales.orders

  Correct

  SHOW GRANTS returns the privileges granted on a securable object and the principals holding them.

• CDESCRIBE TABLE EXTENDED main.sales.orders

  Incorrect

  This shows table metadata such as type, location and properties, not the list of grants.

• DSHOW TABLES IN main.sales

  Incorrect

  This lists the tables in the schema, not their privileges.

SHOW GRANTS lists the privileges granted, inherited or denied on a securable object, for every principal unless one is named.