Task 7.4: Understand Unity Catalog ABAC policies to centrally control row-level filtering and column masking for sensitive data.

• AA column mask set on each current pii column with ALTER TABLE ... ALTER COLUMN ... SET MASK

  Incorrect

  Table-level masks are configured per table, do not cover new tables, and can be modified or removed by table owners.

• BA column mask policy ON CATALOG hr matching has_tag('pii'), to account users except compliance

  Correct

  An ABAC policy on the catalog applies to every table in scope through governed tags, covers new tagged tables automatically, and cannot be overridden by table owners.

• CA dynamic view over each table that masks pii columns with is_account_group_member

  Incorrect

  Views must be built and maintained per table and do not cover new tables automatically.

• DA GRANT policy ON CATALOG hr that grants SELECT on pii-tagged tables to the compliance group

  Incorrect

  GRANT policies add privileges on supported securables such as models and services; they do not mask column values in tables.

ABAC column mask policies attach at the catalog or schema level and match columns by governed tags, so one policy covers current and future tables and sits above table owners' control.

• AColumn conditions match column tags, and columns do not inherit tags

  Correct

  has_tag in MATCH COLUMNS checks column-level tags only; schema and table tags do not propagate to columns.

• BPolicies take up to 24 hours to apply after tagging

  Incorrect

  Policies are evaluated at query time against the current tags.

• CGoverned tags can be applied at the catalog level but not to schemas

  Incorrect

  Governed tags can be applied to catalogs, schemas, tables, columns and other objects.

• Dhas_tag ignores tags that an object inherits from its parents

  Incorrect

  Tag functions see tags that are present directly or through inheritance; the gap here is that columns do not inherit tags at all.

Securables inherit tags from their catalog and schema, except columns. Tag the sensitive columns themselves for column mask policies to match.

• AMATCH COLUMNS has_tag('region') AS rgn ON COLUMN rgn USING COLUMNS ('EMEA')

  Incorrect

  ON COLUMN names the column a mask is applied to; a row filter receives its arguments through USING COLUMNS.

• BWHEN has_tag('region') USING COLUMNS ('EMEA')

  Incorrect

  WHEN passes no column to the function, so the UDF would get the constant without any region values.

• CMATCH COLUMNS has_tag('region') AS rgn USING COLUMNS (rgn, 'EMEA')

  Correct

  MATCH COLUMNS finds the tagged column in each table, and USING COLUMNS passes it and the constant to the UDF.

• DGRANT SELECT FOR TABLES WHEN has_tag('region')

  Incorrect

  GRANT clauses belong to GRANT policies, which add privileges rather than filter rows.

Row filter policies match columns by tag and pass them, plus constants, to a boolean UDF; rows where it returns FALSE are hidden.

• AMATCH COLUMNS has_tag('pii') AS c

  Incorrect

  has_tag checks only that the tag key is present, so every pii column would match, including the email and phone ones.

• BMATCH COLUMNS has_tag_value('pii', 'ssn') AS c

  Correct

  has_tag_value('tag_name', 'tag_value') matches columns whose tag has that value, so only the columns tagged pii with the value ssn are masked.

• CMATCH COLUMNS has_tag('ssn') AS c

  Incorrect

  has_tag takes a tag name; ssn is a value of the pii tag here, not a tag of its own, so no column would match.

• DMATCH COLUMNS has_tag_value('ssn', 'pii') AS c

  Incorrect

  The arguments are the tag name first and the tag value second, so this looks for a tag named ssn with the value pii.

Policy conditions are built from has_tag('tag_name') and has_tag_value('tag_name', 'tag_value'), combined with AND, OR and NOT when needed. Matching on a tag's value lets one governed tag classify several kinds of sensitive data while each policy targets only one of them.

• AThe policy must be attached to the table instead of the catalog

  Incorrect

  Catalog-level policies apply to tables in the catalog; the scope is not the problem.

• BThe filtering UDF must be written in Python

  Incorrect

  The language of the filtering function does not decide whether analysts can reach the table.

• CThe analysts group must be listed in the policy's EXCEPT clause

  Incorrect

  EXCEPT exempts principals from the filter, which would show them every row.

• DSELECT and the USE CATALOG and USE SCHEMA grants for analysts

  Correct

  ABAC policies add restrictions on top of object privileges; they do not grant access by themselves.

Policies never replace grants: give the base privileges with GRANT, and let row filters and column masks narrow what users see.