Databricks Data Engineer Professional Question 207
Select 3A company is storing sensitive customer information, such as Social Security Numbers (SSNs), in a Delta table. As a data engineer, you are tasked with creating a dynamic view in Databricks to mask the SSNs for users who do not have the 'admin' role. Which of the following steps should you take to implement this requirement?
- A
Use the
CREATE VIEWstatement with a CASE WHEN clause to mask the SSN column based on the user's role. - B
Leverage the
IS_MEMBERfunction to dynamically check a user's role within the view definition. - C
Directly modify the underlying Delta table to apply masking logic using SQL UPDATE statements.
- D
Grant SELECT privileges only to 'admin' users and block all others from accessing the table.
- E
Use Unity Catalog's row-level security with dynamic views to enforce the masking policy.
Show answer and explanation
Correct answers: A, B, E
Explanation
To mask sensitive data dynamically based on user roles, you should create a dynamic view using the CREATE VIEW statement with a CASE WHEN clause to conditionally mask the data based on roles. The IS_MEMBER function can be used to check the user's role dynamically within the view. Additionally, Unity Catalog's row-level security can enhance this approach by enforcing fine-grained access control at the view or table level. Modifying the underlying table or blocking access entirely does not meet the requirement of dynamic masking.
- A. Correct.
Correct: Using the
CREATE VIEWstatement with a CASE WHEN clause allows you to dynamically mask the SSN column based on the user's role. - B. Correct.
Correct: The
IS_MEMBERfunction is essential for checking the user's role dynamically within the view definition. - C. Incorrect.
Incorrect: Modifying the underlying Delta table directly does not meet the requirement of dynamic masking and can lead to data loss or incorrect masking.
- D. Incorrect.
Incorrect: Only granting SELECT privileges to 'admin' users does not solve the requirement of masking SSNs dynamically for other roles, it completely blocks access instead.
- E. Correct.
Correct: Unity Catalog enables row-level security and can be combined with dynamic views to enforce data masking policies at a fine-grained level.