Skip to content
Cheat sheets

Generative AI Engineer Associate · Domain 5: Governance · 8% of the exam

Task 5.1: Use masking techniques as guard rails to meet a performance objective; Select guardrail techniques to protect against malicious user inputs to a Gen AI application

Masking PII in source data and traces, column masks, and defenses against prompt injection and malicious input at the gateway, in the prompt and in tool permissions.

Study it

  • Masking sensitive data in sources, prompts and traces

    Partly covered by: Finding and Masking PII

  • Guarding against prompt injection and malicious input

    Partly covered by: Guardrails

Sample questions

Try each one before opening the answer. Every option is explained, with the Databricks documentation page that proves it.

Question 1 · choose 1

Support transcripts contain card numbers and email addresses. A RAG agent over them must answer within 1.5 seconds, and a per-request output scan with a second model call would add about a second. The index must never expose the raw values. Which masking approach meets both goals?

  1. AScan every response with a second model call and redact matches
  2. BApply a Unity Catalog column mask to the source table and index it
  3. CMask the values in the pipeline before chunking and indexing
  4. DTag sensitive chunks and exclude them with an AI Search filter
Show the answer and why

  • AScan every response with a second model call and redact matches

    Incorrect

    The added call pushes responses past the latency target.

  • BApply a Unity Catalog column mask to the source table and index it

    Incorrect

    AI Search does not support row or column level permissions, so masks on the source table do not protect what the index returns.

  • CMask the values in the pipeline before chunking and indexing

    Correct

    Masking upstream keeps raw values out of the index and adds no work at request time.

  • DTag sensitive chunks and exclude them with an AI Search filter

    Incorrect

    Filters drop whole chunks, losing useful content, and the raw values still sit in the index.

Masking sensitive values before they reach the index is a guardrail that costs nothing per request. AI Search does not apply Unity Catalog row or column level permissions; applications must filter or the data must be clean.

Databricks documentation

Task 5.1Report a problem with this question

Question 2 · choose 1

A document-QA agent in a Databricks app can also call tools that read and update account records. A tester plants text in an uploaded document telling the agent to change another customer's address, and the agent tries. Which defense limits the damage even when such text gets through?

  1. ARun tool calls with user authorization and grant the agent only the tools it needs
  2. BAdd a system instruction telling the model to ignore any instructions found in documents
  3. CRun all tool calls through the app's service principal with broad write access
  4. DEvaluate the agent with the Safety judge before each release to catch such text
Show the answer and why

  • ARun tool calls with user authorization and grant the agent only the tools it needs

    Correct

    With user authorization the app acts with the signed-in user's permissions, so an injected instruction cannot reach records that user may not change.

  • BAdd a system instruction telling the model to ignore any instructions found in documents

    Incorrect

    Instructions help, but injected text can still override them; they do not limit what a successful injection can do.

  • CRun all tool calls through the app's service principal with broad write access

    Incorrect

    Broad write access lets a successful injection act on any record the principal can reach.

  • DEvaluate the agent with the Safety judge before each release to catch such text

    Incorrect

    Offline scoring does not stop a live injection, and the planted text is not harmful content of the kind Safety looks for.

Document sources are attack vectors for prompt injection and data poisoning. Least-privilege tools and user authorization, which enforces Unity Catalog permissions per user, bound what a malicious input can make the agent do.

Databricks documentation

Task 5.1Report a problem with this question

Question 3 · choose 2

An agent's MLflow traces are stored in Unity Catalog and contain customer email addresses. The team adds redaction. Which TWO statements about MLflow trace redaction are true? (Choose TWO.)

  1. ARedacting a span also removes the email address from the answer the user sees
  2. BA span processor registered with mlflow.tracing.configure redacts values before the trace backend receives them
  3. CRedaction changes only what the trace records; the agent still receives and returns the original content
  4. DTraces in Unity Catalog cannot use column masks, so redaction is the only control
  5. ESpan processors skip spans created by framework integrations such as LangChain
Show the answer and why

  • ARedacting a span also removes the email address from the answer the user sees

    Incorrect

    The response is unchanged; only the recorded trace is redacted.

  • BA span processor registered with mlflow.tracing.configure redacts values before the trace backend receives them

    Correct

    Client-side redaction runs before export, so raw values never leave the environment.

  • CRedaction changes only what the trace records; the agent still receives and returns the original content

    Correct

    MLflow redaction affects trace contents only; blocking PII in requests or responses needs a different control.

  • DTraces in Unity Catalog cannot use column masks, so redaction is the only control

    Incorrect

    Traces stored in Unity Catalog are governed Delta tables that inherit RBAC, column masking and row filters.

  • ESpan processors skip spans created by framework integrations such as LangChain

    Incorrect

    Processors apply to every span in a trace, including those from framework integrations.

Storing traces in Unity Catalog applies the usual governance. Client-side span processors redact before export; server-side redaction can process stored spans. Neither changes what the agent itself sends or returns.

Databricks documentation

Task 5.1Report a problem with this question

Question 4 · choose 1

A Databricks app uses user authorization to query a SQL warehouse as the signed-in user. Security asks how the app is kept from using the token for anything else. What limits it?

  1. AThe app's service principal grants
  2. BA rate limit on the app
  3. CThe authorization scopes the app declares
  4. DNothing; the forwarded token carries all of the user's rights
Show the answer and why

  • AThe app's service principal grants

    Incorrect

    Those apply to app authorization, not to the forwarded user token.

  • BA rate limit on the app

    Incorrect

    Rate limits cap volume, not which APIs can be used.

  • CThe authorization scopes the app declares

    Correct

    Apps that use user authorization declare scopes, such as sql, that restrict which APIs the app can call on the user's behalf.

  • DNothing; the forwarded token carries all of the user's rights

    Incorrect

    Scopes exist to prevent that kind of privilege escalation.

Scope-based security limits what an app can do through user authorization; without selected scopes the app gets only basic identity scopes.

Databricks documentation

Task 5.1Report a problem with this question

Question 5 · choose 1

Account numbers enter an agent's traces only through one lookup tool. The team wants trace redaction that targets that source rather than scanning every payload. What should the span processor check?

  1. Aspan.span_type, redacting TOOL span outputs
  2. BThe trace ID of each incoming request
  3. CThe experiment the trace is logged to
  4. DThe model endpoint that served the call
Show the answer and why

  • Aspan.span_type, redacting TOOL span outputs

    Correct

    Filtering by span type lets redaction target the span where a sensitive value originates.

  • BThe trace ID of each incoming request

    Incorrect

    Trace IDs identify requests, not where sensitive data enters.

  • CThe experiment the trace is logged to

    Incorrect

    Every span in the experiment would be treated the same.

  • DThe model endpoint that served the call

    Incorrect

    The tool output, not the model endpoint, is the source here.

Use span.span_type to apply different redaction logic to LLM, TOOL and AGENT spans, with a regex backstop elsewhere if needed.

Databricks documentation

Task 5.1Report a problem with this question

Question 6 · choose 1

Regex redaction catches emails in traces but misses personal names and street addresses. Which approach does Databricks show for broader detection?

  1. AA longer list of regex patterns for each field
  2. BTurning off tracing for all production traffic
  3. CLowering the trace sampling rate in production
  4. DPresidio analyzer and anonymizer in a span processor
Show the answer and why

  • AA longer list of regex patterns for each field

    Incorrect

    Names and addresses vary too much for reliable regex coverage.

  • BTurning off tracing for all production traffic

    Incorrect

    This loses the observability that traces provide.

  • CLowering the trace sampling rate in production

    Incorrect

    Fewer traces still contain unredacted PII.

  • DPresidio analyzer and anonymizer in a span processor

    Correct

    The redaction guide includes a Microsoft Presidio example for detecting and anonymizing PII in spans.

Span processors can call libraries such as Presidio to find entities that simple patterns miss.

Databricks documentation

Task 5.1Report a problem with this question

Question 7 · choose 1

A Genie Agent author hides the salary column so Genie stops using it. Can users still read salaries?

  1. ANo; hiding revokes SELECT
  2. BYes, through direct table access
  3. CNo; hiding applies a column mask
  4. DNo; hidden columns are deleted
Show the answer and why

  • ANo; hiding revokes SELECT

    Incorrect

    Hiding does not change Unity Catalog grants.

  • BYes, through direct table access

    Correct

    Hiding a column removes it from the agent's context but does not affect the data or Unity Catalog permissions.

  • CNo; hiding applies a column mask

    Incorrect

    A column mask is a separate Unity Catalog control.

  • DNo; hidden columns are deleted

    Incorrect

    The column still exists in the table.

To restrict access, use Unity Catalog permissions or a column mask; hiding is for keeping Genie focused.

Databricks documentation

Task 5.1Report a problem with this question

Practice domain 5 →Practice all domains →