Databricks Data Engineer Professional Question 211
Select 3You are tasked with implementing row and column-level security for a table containing employee data in Databricks. The table includes sensitive columns such as 'salary' and 'ssn'. You decide to use dynamic views to enforce these rules. Which of the following steps are required to correctly implement this security model?
- A
Create a view that filters rows based on the user's role or attributes.
- B
Define a view with SELECT permissions for all users without restrictions.
- C
Use
is_member()orcurrent_user()functions in the view to dynamically apply filtering logic. - D
Grant users direct SELECT permissions on the underlying table.
- E
Grant SELECT permissions on the dynamic view instead of the underlying table.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement row and column-level security using dynamic views in Databricks, you must create a view that filters rows and columns based on user attributes (e.g., role or group membership). Functions like is_member() and current_user() are used to enforce these dynamic rules. It is also crucial to grant SELECT permissions only on the dynamic view, not the underlying table, to ensure that the security logic is always applied.
- A. Correct.
Creating a view that filters rows based on the user's role or attributes is a key step in implementing row-level security. This logic ensures that only the rows relevant to the user are displayed.
- B. Incorrect.
Defining a view with unrestricted SELECT permissions for all users would expose all data, defeating the purpose of row and column-level security.
- C. Correct.
Using
is_member()orcurrent_user()functions allows the filtering logic to dynamically adapt based on the current user's identity or group memberships, which is crucial for dynamic views. - D. Incorrect.
Granting users direct SELECT permissions on the underlying table bypasses the security implemented in the dynamic view, exposing all data to users.
- E. Correct.
Granting SELECT permissions on the dynamic view ensures that all access control logic is enforced, as users interact only with the view and not the underlying table.