Databricks Data Engineer Associate Question 514
Select 2A data engineering team is tasked with ensuring that only specific users have access to sensitive data in a Delta table on Databricks. They want to configure access control so that one user has read-only access, another user has write access, and the rest of the users have no access. Which of the following steps should the team take to achieve this?
- A
Grant the 'SELECT' privilege to the user who needs read-only access.
- B
Grant the 'WRITE' privilege to the user who needs write access.
- C
Grant the 'ALL PRIVILEGES' permission to the user who needs write access.
- D
Revoke all privileges from the group 'users' to ensure no access for other users.
- E
Set the table's access control to 'public' so users without explicit permissions cannot access the table.
Show answer and explanation
Correct answers: A, D
Explanation
To implement data object access control in Databricks, privileges need to be explicitly granted to users based on their access requirements. Granting the 'SELECT' privilege provides read-only access, while revoking privileges from other users ensures they cannot access the table. Other options either grant excessive permissions or fail to restrict access appropriately.
- A. Correct.
Correct: Granting the 'SELECT' privilege ensures that the user has read-only access to the Delta table.
- B. Incorrect.
Incorrect: The 'WRITE' privilege is not a valid Databricks-specific privilege. Instead, specific privileges like 'SELECT' or 'INSERT' should be granted.
- C. Incorrect.
Incorrect: Granting 'ALL PRIVILEGES' gives full access, which includes both read and write permissions. This does not align with the requirement of providing only write access.
- D. Correct.
Correct: Revoking all privileges from the group 'users' ensures that no other users can access the table unless explicitly granted permissions.
- E. Incorrect.
Incorrect: Setting the table's access control to 'public' contradicts the goal of restricting access, as it would allow unrestricted access to all users.