Databricks Data Engineer Professional Question 205
Select 3A data engineering team needs to create a dynamic view in Databricks to mask sensitive customer data such as Social Security Numbers (SSNs) based on the user's role. Users with the 'admin' role should see the full SSN, while others should see only the last four digits of the SSN with the rest of the digits masked. Which of the following approaches should the team use to implement this requirement?
- A
Use a CASE statement in the view definition to conditionally display the masked or unmasked SSN based on the user's role.
- B
Store the user roles and permissions in a table, and join it with the data table in the dynamic view to determine the appropriate masking logic.
- C
Use Databricks secrets to store SSNs securely and dynamically retrieve them in the view for authorized users.
- D
Grant SELECT permission on the dynamic view to specific users, and use Databricks ACLs to enforce data masking.
- E
Leverage the
is_memberfunction within the view definition to check the user's group membership and apply masking logic.
Show answer and explanation
Correct answers: A, B, E
Explanation
Dynamic views in Databricks allow data masking by applying conditional logic within the view definition. Using a combination of the CASE statement, user role data, and the is_member function enables dynamic and scalable masking based on user roles or group memberships. Databricks secrets and ACLs are useful for other security purposes but are not directly applicable for implementing dynamic data masking in this scenario.
- A. Correct.
This is correct. A CASE statement can be used within the dynamic view to apply conditional logic to show masked or unmasked data based on user roles.
- B. Correct.
This is correct. Joining with a table containing user roles and permissions allows dynamic role-based decisions within the view, enabling appropriate masking.
- C. Incorrect.
This is incorrect. Databricks secrets are used for securely storing credentials, not for dynamically masking sensitive data in views.
- D. Incorrect.
This is incorrect. While ACLs can manage access at the table or view level, they do not handle row- or column-level masking logic within views.
- E. Correct.
This is correct. The
is_memberfunction is commonly used to check group membership and can be included in the view definition to dynamically apply masking logic.