Databricks Data Engineer Associate Question 512
Select 2A data engineering team is tasked with setting up access control for a Delta table in Databricks. They want to ensure that only members of the 'data_analyst' group can read from the table and members of the 'data_engineer' group can perform both read and write operations. How can they achieve this using Databricks’ access control mechanisms?
- A
Assign the 'CAN_READ' permission to the 'data_analyst' group on the Delta table.
- B
Grant the 'SELECT' privilege to the 'data_analyst' group and the 'SELECT' and 'WRITE' privileges to the 'data_engineer' group on the Delta table.
- C
Set the ownership of the Delta table to the 'data_engineer' group and grant the 'SELECT' privilege to the 'data_analyst' group.
- D
Grant the 'READ' permission to the 'data_analyst' group and the 'ALL PRIVILEGES' permission to the 'data_engineer' group.
- E
Use cluster policies to restrict access to the Delta table based on group membership.
Show answer and explanation
Correct answers: B, D
Explanation
Databricks uses SQL privileges to implement fine-grained access control for data objects like Delta tables. To meet the requirements, the 'data_analyst' group should be granted the 'SELECT' privilege for read access, and the 'data_engineer' group should be granted both 'SELECT' and 'WRITE' privileges (or 'ALL PRIVILEGES' for full access). Incorrect options either describe invalid privileges or address unrelated features like cluster policies.
- A. Incorrect.
'CAN_READ' is not a valid permission in Databricks. Permissions in Databricks are managed using SQL privileges like 'SELECT', 'INSERT', etc.
- B. Correct.
'SELECT' and 'WRITE' privileges correctly align with the requirements to allow 'data_analyst' to read and 'data_engineer' to both read and write to the Delta table.
- C. Incorrect.
Setting ownership alone does not fulfill the requirement to manage read/write access for specific groups. Ownership provides full control, but additional privileges would still need to be granted to other groups.
- D. Correct.
'READ' is not a valid Databricks SQL privilege. However, the 'ALL PRIVILEGES' permission for 'data_engineer' would allow both read and write access, and the 'SELECT' privilege for 'data_analyst' satisfies the read-only requirement.
- E. Incorrect.
Cluster policies are used to enforce restrictions on cluster configurations rather than access to specific data objects like Delta tables.