Data Engineer Professional · Domain 6: Ensuring Data Security and Compliance · 8% of the exam
Task 6.4: Implement a compliant data pipeline that enforces PII detection and masking controls across batch and streaming workloads using Unity Catalog features.
Data classification and its tags, masking through policies on classified columns, masks on streaming tables and materialized views, and auditing access.
Study it
PII detection and masking across batch and streaming
Try each one before opening the answer. Every option is explained, with the Databricks documentation page that proves it.
Question 1 · choose 1
In the catalog crm, a catalog-level ABAC column mask policy masks every column tagged with the email classification tag, for everyone except the privacy group. Email addresses keep appearing in new tables written by batch and streaming pipelines, in columns nobody tags, so they stay unmasked. What should the data engineer do so that new email columns are masked without per-table work?
AAdd a column mask with SET MASK to each new column holding email addresses
BChange the policy to mask every STRING column, not only classification-tagged ones
CCreate dynamic views over each new table that hide email columns
DEnable Data Classification on crm with automatic tagging for email addresses
Show the answer and why
AAdd a column mask with SET MASK to each new column holding email addresses
Incorrect
Table-level masks must be added table by table, which is the per-table work to avoid.
BChange the policy to mask every STRING column, not only classification-tagged ones
Incorrect
That masks far more than email addresses and breaks other uses of the data.
CCreate dynamic views over each new table that hide email columns
Incorrect
Views must be written for each table and do not cover tables created later.
DEnable Data Classification on crm with automatic tagging for email addresses
Correct
Automatic tagging puts the classification tag on detected columns, including in new tables, and the existing policy then masks them.
Data Classification detects sensitive data and can apply classification tags automatically. Databricks recommends ABAC policies on these tags, so an existing policy that matches the tag covers newly classified columns.
A data steward wants to turn on Data Classification for the catalog crm. What privilege must they have?
AOwnership of crm or MANAGE on it
BAPPLY TAG on the catalog crm only
CCREATE SCHEMA on crm
DSELECT on every table in crm
Show the answer and why
AOwnership of crm or MANAGE on it
Correct
Enabling classification requires owning the catalog or having MANAGE on it.
BAPPLY TAG on the catalog crm only
Incorrect
APPLY TAG is needed for automatic tagging, not for enabling scans.
CCREATE SCHEMA on crm
Incorrect
Creating schemas is unrelated.
DSELECT on every table in crm
Incorrect
Data access does not allow enabling classification.
To enable data classification for a catalog, you must own it or have MANAGE on it. Automatic tagging also needs USE CATALOG, APPLY TAG and ASSIGN on the tag.
A steward enables automatic tagging for the email class in a classified catalog. An hour later, detected email columns still have no tag. Why?
AAutomatic tagging only works on tables created after it is enabled
BExisting detections are tagged in the next scan, within about a day
CTags appear only after a manual full scan of the catalog is run
DThe steward must apply each tag with SET TAG before tagging can start
Show the answer and why
AAutomatic tagging only works on tables created after it is enabled
Incorrect
Existing and future detections are tagged.
BExisting detections are tagged in the next scan, within about a day
Correct
Automatic tagging populates existing detections in the next scan, which should take effect within 24 hours.
CTags appear only after a manual full scan of the catalog is run
Incorrect
A full scan is optional; the next scheduled scan applies tags.
DThe steward must apply each tag with SET TAG before tagging can start
Incorrect
Automatic tagging removes the need for manual tagging.
When automatic tagging is enabled, existing detections are tagged in the next scan, typically within 24 hours, and later detections are tagged immediately.
Automatic tagging is enabled at the metastore level, but one research catalog must not be tagged automatically. What can the team do?
ANothing; metastore settings cannot be overridden
BDisable automatic tagging for the whole metastore
CRemove the catalog's owner
DSet the catalog's automatic tagging to Inactive
Show the answer and why
ANothing; metastore settings cannot be overridden
Incorrect
A catalog can be set to Active, Inactive or Default.
BDisable automatic tagging for the whole metastore
Incorrect
That affects every catalog, not just the research catalog.
CRemove the catalog's owner
Incorrect
Ownership does not control tagging settings.
DSet the catalog's automatic tagging to Inactive
Correct
Catalog-level settings take precedence over the metastore-level setting.
Automatic tagging can be set at the metastore and catalog levels. A catalog can inherit, or be explicitly Active or Inactive, overriding the metastore setting.
A privacy lead asks which objects Data Classification scans by default in an enabled catalog. What is the answer?
AOnly managed tables in the enabled catalog
BTables, views and metric views in every schema
CTables, streaming tables and materialized views
DOnly tables that already carry a pii governed tag
Show the answer and why
AOnly managed tables in the enabled catalog
Incorrect
Streaming tables and materialized views are scanned too.
BTables, views and metric views in every schema
Incorrect
Metric views are never scanned, and views need the Beta feature.
CTables, streaming tables and materialized views
Correct
These are scanned by default; scanning regular views needs a Beta setting.
DOnly tables that already carry a pii governed tag
Incorrect
Classification finds sensitive data in untagged tables.
By default, Data Classification scans tables, streaming tables and materialized views. Regular views can be scanned through a Beta feature; metric views are not scanned.