Task 1.3: Configure security and governance

• AAdd her to the Sales workspace with the Viewer role so she can use the endpoint

  Incorrect

  A workspace role opens every item in the workspace, which the requirement rules out.

• BShare LH_Sales with her and select Read all with Apache Spark

  Incorrect

  This permission opens the data to Spark and OneLake APIs, which she mustn't use.

• CShare LH_Sales with her without any additional permission

  Incorrect

  Base Read alone opens the item but doesn't let her read the tables' data.

• DShare LH_Sales and select Read all with SQL analytics endpoint

  Correct

  Sharing gives access to that item only, and this permission allows T-SQL reads without Spark access.

Sharing a lakehouse grants Read on the lakehouse and its SQL analytics endpoint without workspace membership. Read all with SQL analytics endpoint (ReadData) lets the user read data through T-SQL; Read all with Apache Spark (ReadAll) adds Spark and OneLake API access. Workspace roles apply to all the workspace's items.

• AALTER TABLE dbo.Customer ALTER COLUMN Email ADD MASKED WITH (FUNCTION = 'random(1, 100)')

  Incorrect

  That mask doesn't produce the aXXX@XXXX.com form the agents must see.

• BALTER TABLE dbo.Customer ALTER COLUMN Email ADD MASKED WITH (FUNCTION = 'email()')

  Correct

  The email() function shows the first letter and the constant suffix .com in that form.

• CGRANT ALTER ANY MASK to the auditor

  Incorrect

  ALTER ANY MASK lets a user add or remove masks; it doesn't reveal masked values.

• DGRANT UNMASK to the auditor

  Correct

  UNMASK lets a user retrieve unmasked data from masked columns.

• EMove the auditor to the Contributor role and the agents to the Member role

  Incorrect

  Members and Contributors see unmasked data by default, so the agents would see real emails.

Dynamic data masking applies masking rules to query results without changing stored data. Users who aren't Admins, Members or Contributors of the workspace (and lack elevated permissions on the warehouse) see masked values; granting UNMASK, or CONTROL, lets a user see the real data, while ALTER ANY MASK is for managing masks.

• ACreate one OneLake security role per region with an RLS rule on Region, and add each rep to the matching role

  Incorrect

  OneLake RLS rules can't be dynamic or read a second table, so role membership would have to follow RepRegion by hand.

• BCreate a security policy in the SQL analytics endpoint whose predicate looks up RepRegion

  Correct

  The endpoint accepts CREATE FUNCTION and CREATE SECURITY POLICY, and the predicate can match USER_NAME() against RepRegion.

• CCopy Sales into a warehouse each night with CTAS and add a security policy to the warehouse table

  Incorrect

  Row-level security would work there, but it needs the copy the requirement rules out.

• DCreate a view in the SQL analytics endpoint that joins Sales to RepRegion on USER_NAME(), and grant the reps the view

  Incorrect

  The reports query dbo.Sales itself, so a filtered view doesn't change what they return.

Row-level security in Fabric applies to both warehouses and SQL analytics endpoints: an inline table-valued function holds the predicate and CREATE SECURITY POLICY adds it as a filter predicate on the table, so existing queries against dbo.Sales return only permitted rows. In a SQL analytics endpoint you can't create tables, but you can create schemas, functions and security policies over the existing tables, and with the endpoint's default settings those SQL rules govern reads. OneLake security RLS roles don't support dynamic or multitable rules.

• AAdd a second role that denies access to the other folders

  Incorrect

  OneLake security supports only Grant roles; there are no Deny roles.

• BGrant the HR_Files role ReadWrite instead of Read

  Incorrect

  Changing the role's permission level doesn't limit what a Contributor can read.

• CRemove the contractor from the lakehouse's DefaultReader role

  Incorrect

  DefaultReader isn't what grants a Contributor access; the Write permission is.

• DMake the contractor a Viewer and keep the HR_Files membership

  Correct

  OneLake security restricts users with Read access; Contributors and above keep full access through Write.

OneLake security uses deny-by-default Grant roles to give users with Read access to selected tables or folders. Workspace Admins, Members and Contributors have elevated access through the Write permission, so OneLake security roles don't limit what they can read. To restrict a user to specific folders, give them read-only access, such as the Viewer role, and a role for the folders they need.

• AMaster data, applied by a user the Fabric administrator specified

  Correct

  Master data marks core, authoritative data and can be applied only by users the Fabric admin specifies.

• BPromoted, applied by a domain admin of the lakehouse's domain

  Incorrect

  The Promoted badge doesn't designate an authoritative, single source of truth.

• CCertified, applied by any user with write permission on the lakehouse

  Incorrect

  Certification is done by authorized reviewers, not by anyone with write permission.

• DMaster data, applied by any Admin or Member of the workspace

  Incorrect

  Workspace roles don't grant the right to apply the master data badge.

Master data marks an item as a core source of organizational data: the authoritative, single source of truth for data such as product codes or customer lists. Only users specified by the Fabric administrator can apply it, once the admin has enabled master data endorsement. The other badges signal different things, and workspace roles don't grant the right to apply master data.

• AWith Spark notebooks and OneLake APIs

  Incorrect

  Spark and OneLake API reads need ReadAll, which Viewers don't get.

• BWith T-SQL through the SQL analytics endpoint

  Correct

  Viewers get ReadData, which reads data through the TDS endpoint.

• CThrough the Lakehouse explorer only

  Incorrect

  Reading data in Lakehouse explorer also needs ReadAll.

• DThrough Spark, T-SQL and the Lakehouse explorer alike

  Incorrect

  Viewers lack ReadAll, so Spark and explorer reads are excluded.

All four workspace roles can connect to the SQL analytics endpoint and read lakehouse and warehouse data with T-SQL (ReadData). Reading data through OneLake APIs, Spark or the Lakehouse explorer (ReadAll) is limited to Admins, Members and Contributors.

• Aemail()

  Incorrect

  email() doesn't return a number in a range.

• Bpartial(1, "XXX", 0)

  Incorrect

  partial() is a custom string mask with a prefix, padding and suffix.

• Cdefault()

  Incorrect

  default() shows a fixed value, such as zero for numeric types.

• Drandom(1, 1000)

  Correct

  random() masks numeric values with a random value in the given range.

Fabric Data Warehouse offers full and partial masking functions and a random mask: random() works on any numeric type and replaces the value with a random number within the range you specify.

• AA lakehouse

  Incorrect

  Lakehouses contain data and can be labeled master data.

• BA warehouse

  Incorrect

  Warehouses contain data and can be labeled master data.

• CA Spark notebook

  Correct

  Master data applies only to items that contain data, and a notebook doesn't.

• DA semantic model

  Incorrect

  Semantic models contain data and can be labeled master data.

The master data label can be applied only to items that contain data, such as lakehouses, warehouses and semantic models.

• AAny workspace Admin

  Correct

  You must be a workspace admin to create and manage a workspace identity.

• BA workspace Member

  Incorrect

  Members can't create the workspace identity.

• CA workspace Contributor

  Incorrect

  Contributors can't create the workspace identity.

• DAny user who owns an item in the workspace

  Incorrect

  Item ownership doesn't grant workspace identity management.

A workspace identity is an automatically managed service principal associated with a workspace. Only workspace admins can create and manage it, and it can't be created for My workspace.