Databricks Data Engineer Professional Question 202
Single answerA data engineering team is tasked with securing sensitive data stored in a Databricks workspace. They want to limit access to specific tables based on user roles while ensuring auditability of access events. What is the most appropriate approach to achieve this in Databricks?
- A
Implement table ACLs (Access Control Lists) in Unity Catalog and enable audit logging.
- B
Use workspace object permissions to restrict access to Delta tables.
- C
Encrypt the Delta tables using a custom encryption algorithm and distribute decryption keys to users.
- D
Store sensitive data in plain text files in a private S3 bucket and manage access using AWS IAM policies.
Show answer and explanation
Correct answer: A
Explanation
Unity Catalog is the recommended solution for securing sensitive data in Databricks. It provides fine-grained access control through table ACLs, which allow permissions to be granted at the table, schema, or catalog level. Additionally, Unity Catalog supports audit logging, ensuring that access events can be tracked for compliance and governance purposes. Other approaches, such as workspace object permissions or custom encryption, either lack necessary functionality or introduce unnecessary complexity.
- A. Correct.
This is correct because Unity Catalog provides fine-grained access control via table ACLs, along with audit logging for tracking access events. This is the recommended approach for securing sensitive data in Databricks.
- B. Incorrect.
This is incorrect because workspace object permissions do not provide the fine-grained access control needed for table-level security. Additionally, they are not used for managing access to Delta tables specifically.
- C. Incorrect.
This is incorrect as custom encryption algorithms introduce complexity and potential security risks. Distributing decryption keys securely is also challenging and not aligned with Databricks' security best practices.
- D. Incorrect.
This is incorrect because storing sensitive data as plain text files lacks the necessary fine-grained access control. While AWS IAM policies can control access at the bucket level, they do not offer the table-level permissions or audit logging required for robust data governance.