Task 7.2: Demonstrate understanding of the Unity Catalog permission inheritance model as a mechanism for managing access control across catalogs, schemas, and objects.

• AUSE SCHEMA on the catalog sales

  Correct

  Granted on the catalog, USE SCHEMA applies to every current and future schema, completing the usage privileges that SELECT needs.

• BUSE SCHEMA on the schema sales.crm

  Incorrect

  That fixes one schema but not the other or future schemas.

• CBROWSE on the catalog sales

  Incorrect

  BROWSE shows metadata only; it does not allow reading data.

• DALL PRIVILEGES on the catalog sales

  Incorrect

  That includes write privileges such as MODIFY, which the analysts must not have.

Privileges granted on a container apply to its current and future child objects. Reading a table still requires USE CATALOG on its catalog and USE SCHEMA on its schema, and USE SCHEMA granted at the catalog level covers all schemas.

• AA user who holds SELECT on the catalog main

  Incorrect

  SELECT lets a user read data; it does not allow granting privileges.

• BA user who holds CREATE TABLE on the schema main.sales

  Incorrect

  Creating tables in a schema does not allow managing privileges on other users' tables.

• CThe owner of the schema main.sales

  Correct

  Owning a container gives the ability to manage all of its child objects, even ones owned by others.

• DA user with USE CATALOG, USE SCHEMA and SELECT on the table

  Incorrect

  Reading a table does not include the right to grant access to it.

• EA user who holds MANAGE on the catalog main

  Correct

  MANAGE granted on a container applies to the objects within it, including managing their privileges.

Object owners and principals with MANAGE can grant privileges. Owners of a container can manage its children, and MANAGE on a container extends to the objects inside it.

• AREAD METADATA, because it was granted explicitly

  Correct

  Revoking a composite privilege does not revoke a child privilege that was granted explicitly.

• BNothing, because revoking MANAGE removes its children

  Incorrect

  Composite and child privileges are revoked independently.

• CMANAGE, because READ METADATA restores it

  Incorrect

  A child privilege does not bring back its composite.

• DFull ownership of the schema

  Incorrect

  Privileges never turn into ownership.

MANAGE is a composite privilege with children such as READ METADATA. Composite and child privileges are granted and revoked independently.

• AGroup owners are hidden from SHOW GRANTS to protect group membership

  Incorrect

  Nothing hides group owners; owners simply hold no explicit grants to list.

• Bdata_eng lost its rights to the table when its membership changed

  Incorrect

  The group stays the owner, with all capabilities, whoever its members are.

• COwners hold every capability without an ALL PRIVILEGES grant

  Correct

  Owners automatically have all capabilities on the object, but Databricks does not grant them ALL PRIVILEGES, so SHOW GRANTS does not return it.

• DSHOW GRANTS shows this auditor only the auditor's own grants

  Incorrect

  With READ METADATA on the table, the auditor sees all grants on it.

Object owners can perform all capabilities on the objects they own, but Databricks does not explicitly grant ALL PRIVILEGES to the owner, so it is not returned by SHOW GRANTS or the API. Users with READ METADATA or MANAGE on an object, its owner, the owner of its catalog or schema and metastore admins can see all grants on it.

• ANo; USE CATALOG must be granted to the steward first

  Incorrect

  MANAGE is an exception to the usual usage requirement.

• BYes; MANAGE on a catalog needs no usage privileges

  Correct

  MANAGE needs usage privileges only on parents above the object, and a catalog has none.

• CNo; MANAGE can be granted only on tables and views

  Incorrect

  MANAGE can be granted on catalogs and other securables.

• DOnly after the steward becomes the catalog's owner

  Incorrect

  MANAGE is enough without ownership.

Usage privileges are normally prerequisites for working with objects in a catalog or schema. MANAGE is an exception: it requires usage only on the parent containers above the object, so MANAGE on a catalog needs none.

• AThe group data_eng, which owns the schema

  Incorrect

  The schema's owner does not become the owner of new tables.

• BThe owner of the catalog main

  Incorrect

  Ownership of new objects is not taken from the catalog.

• CThe metastore admin

  Incorrect

  Metastore admins do not become owners of new tables.

• Dbob, who created the table

  Correct

  The principal that creates an object becomes its initial owner.

Every securable has an owner, which can be a user, service principal or group. The principal that creates an object becomes its initial owner; ownership can be transferred later.