Data Engineer Professional · Domain 6: Ensuring Data Security and Compliance · 8% of the exam
Task 6.2: Apply attribute-based access control (ABAC) policies with governed tags to enforce row filters and column masks at scale.
Governed tags and who can assign them, policy scope and principals, row filter and column mask policies, and how policies combine.
Study it
ABAC policies with governed tags
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Databricks documentation page that proves it.
Question 1 · choose 1
A catalog-level ABAC column mask policy masks columns tagged pii for account users. A Lakeflow pipeline whose run-as identity is the service principal etl-sp builds a gold materialized view from a tagged table. Even the compliance team, who are exempt from the policy, now sees masked values in the materialized view. What should the data engineer do?
AGrant the compliance team SELECT on the source table instead of the materialized view
BAdd etl-sp to the policy's EXCEPT list, then fully refresh the materialized view
CChange the policy to a table-level column mask on the materialized view
DRemove the pii tag from the materialized view's columns
Show the answer and why
AGrant the compliance team SELECT on the source table instead of the materialized view
Incorrect
That bypasses the gold view rather than fixing values that were stored already masked.
BAdd etl-sp to the policy's EXCEPT list, then fully refresh the materialized view
Correct
The refresh evaluated the policy as etl-sp, so masked values were stored; exempting the pipeline identity and recomputing fixes it.
CChange the policy to a table-level column mask on the materialized view
Incorrect
A mask on the view masks it again; the stored data is still masked.
DRemove the pii tag from the materialized view's columns
Incorrect
The values were masked when they were computed; untagging the view does not unmask stored data.
A pipeline refresh evaluates ABAC policies with the pipeline owner's or run-as identity. If that identity is subject to a policy, the materialized view or streaming table permanently holds masked or filtered data, so the pipeline identity should be listed in the policy's EXCEPT clause.
ABAC needs Databricks Runtime 16.4 or above, or serverless; otherwise access is denied.
DThe read succeeds once the cluster restarts with the policy
Incorrect
Restarting does not change the runtime version.
ABAC follows a fail-closed model: compute below Databricks Runtime 16.4 cannot access ABAC-secured tables unless the principal is exempt from the policies.
After an admin deleted an unused-looking governed tag, every query on tables in the catalog finance fails with UC_ABAC_UNKNOWN_TAG_POLICY. What is the fix?
ARestore the tag, or update or delete the policy that uses it
BRe-run the queries on serverless compute, which skips stale tags
CGrant the users MANAGE on the catalog finance and its schemas
DRemove the tag from all tables and columns in the catalog
Show the answer and why
ARestore the tag, or update or delete the policy that uses it
Correct
A policy that references a deleted governed tag breaks queries in its scope until the tag returns or the policy changes.
BRe-run the queries on serverless compute, which skips stale tags
Incorrect
Compute type does not resolve a missing tag.
CGrant the users MANAGE on the catalog finance and its schemas
Incorrect
Privileges do not fix a policy with a missing dependency.
DRemove the tag from all tables and columns in the catalog
Incorrect
The tag is already gone; the policy still references it.
ABAC policies depend on governed tags and UDFs. If a referenced governed tag is deleted, queries against objects in the policy's scope fail, even on tables that never had the tag.
A pipeline schema change that drops a column fails because the column has a governed tag used by ABAC policies. What must happen first?
AThe pipeline runs with a full refresh so that the table is recreated
BA user with ASSIGN on the tag and APPLY TAG on the table removes it
CThe policy is moved from the catalog to the schema level
DThe table owner grants MODIFY on the table to the pipeline
Show the answer and why
AThe pipeline runs with a full refresh so that the table is recreated
Incorrect
A full refresh still tries to drop the tagged column.
BA user with ASSIGN on the tag and APPLY TAG on the table removes it
Correct
Columns with a governed tag cannot be dropped until a user with the tag permissions removes it.
CThe policy is moved from the catalog to the schema level
Incorrect
Policy scope does not change the column rule.
DThe table owner grants MODIFY on the table to the pipeline
Incorrect
Data privileges do not allow dropping a tagged column.
Databricks prevents deleting a column that has a governed tag. A user with ASSIGN on the tag and APPLY TAG on the object must remove the tag; then the column can be dropped and the tag reapplied as needed.
A team wants a row filter policy to apply to 45 named analysts. The policy creation fails. What should they do?
ASplit the analysts across 45 separate policies on the same table
BUse a table-level row filter function instead of a policy
CGrant the users ALL PRIVILEGES on the table instead
DPut the analysts in a group and name the group in the policy
Show the answer and why
ASplit the analysts across 45 separate policies on the same table
Incorrect
A table allows at most 50 policies, and per-user policies are hard to manage.
BUse a table-level row filter function instead of a policy
Incorrect
That gives up the central management that ABAC provides.
CGrant the users ALL PRIVILEGES on the table instead
Incorrect
Privileges do not apply row filters.
DPut the analysts in a group and name the group in the policy
Correct
A policy accepts at most 20 principals across TO and EXCEPT, so groups are the way to cover many users.
ABAC quotas include 20 principals per policy across TO and EXCEPT, 50 policies per table and 100 per catalog or schema, so policies should target groups.