Data Engineer Professional · Domain 6: Ensuring Data Security and Compliance · 8% of the exam
Task 6.1: Apply least-privilege access control lists (ACLs) to secure Unity Catalog securable objects and workspace resources.
Unity Catalog privileges for each task, ownership and MANAGE, job, pipeline, warehouse and secret scope permissions, and service principals as run identities.
Study it
Least privilege on Unity Catalog objects and workspace resources
Try each one before opening the answer. Every option is explained, with the Databricks documentation page that proves it.
Question 1 · choose 1
A data engineer created the service principal etl-sp and has CAN MANAGE on a production job. When they try to set the job's Run as to etl-sp, the service principal is not offered. Security wants the smallest change that fixes this. What should be granted?
AIS OWNER on the job, transferred to the engineer from its creator
BThe workspace admin role to the engineer
CCAN MANAGE on the job for the service principal etl-sp
DThe Service Principal User role on etl-sp to the engineer
Show the answer and why
AIS OWNER on the job, transferred to the engineer from its creator
Incorrect
CAN MANAGE already allows changing Run as; the missing piece is the role on the service principal.
BThe workspace admin role to the engineer
Incorrect
Admin rights are far broader than needed for this one change.
CCAN MANAGE on the job for the service principal etl-sp
Incorrect
Permissions for the service principal on the job do not let the engineer select it as the run identity.
DThe Service Principal User role on etl-sp to the engineer
Correct
Run as can be set to a service principal on which the user has the Service Principal User role; the manager role does not include it.
Changing a job's Run as needs CAN MANAGE or IS OWNER on the job and the Service Principal User role on the service principal. The creator of a service principal becomes its manager, but managers do not inherit the user role and must assign it to themselves.
An operations team must be able to start and cancel runs of a production job, but must not change its tasks or settings. Which job permission should they get?
ACAN MANAGE RUN
BCAN MANAGE
CCAN VIEW
DIS OWNER
Show the answer and why
ACAN MANAGE RUN
Correct
CAN MANAGE RUN lets users trigger and cancel job runs.
BCAN MANAGE
Incorrect
CAN MANAGE also allows editing the job definition and permissions.
CCAN VIEW
Incorrect
CAN VIEW shows run results but does not allow starting runs.
DIS OWNER
Incorrect
IS OWNER brings full control of the job, far more than running it.
Job permissions are CAN VIEW, CAN MANAGE RUN, CAN MANAGE and IS OWNER. Databricks advises granting CAN MANAGE or IS OWNER only to users trusted to modify production code.
A team wants the group data_eng, rather than any one person, to be the Run as identity of a production job. When an engineer who belongs to data_eng opens the job's Run as setting, the group is not offered. data_eng is a workspace-local group. What should the team do?
ASet Run as to the built-in users group, which includes data_eng
BGrant data_eng CAN MANAGE on the job so that its runs use the group
CRecreate data_eng as an account group assigned to the workspace
DSet Run as to a workspace admin who is also a member of data_eng
Show the answer and why
ASet Run as to the built-in users group, which includes data_eng
Incorrect
The broad built-in groups admins, users and account users cannot be used as a run-as identity.
BGrant data_eng CAN MANAGE on the job so that its runs use the group
Incorrect
CAN MANAGE lets the group edit and run the job; it does not set the group as Run as.
CRecreate data_eng as an account group assigned to the workspace
Correct
Run as accepts an account group that is assigned to the workspace; workspace-local groups cannot be used as a run-as identity.
DSet Run as to a workspace admin who is also a member of data_eng
Incorrect
The team wants the group itself, not one person, in Run as.
Run as can be set to a group. The group must be an account group that is assigned to the workspace; workspace-local groups cannot be used as a run-as identity, and neither can the built-in groups admins, users and account users.