Databricks Data Engineer Professional Question 216
Select 2A company is using Databricks to manage sensitive customer data in a Delta table. The table contains columns for 'CustomerID', 'Name', 'Email', and 'CreditScore'. The company wants to implement row-level security to allow only 'Finance' department users to see rows where the 'CreditScore' is greater than 700, and column-level security so only 'CustomerID' and 'CreditScore' are visible to non-admin users. Which of the following steps should you take to meet these requirements?
- A
Create a dynamic view that filters rows based on the 'CreditScore' column and includes only the 'CustomerID' and 'CreditScore' columns.
- B
Grant SELECT permissions on the base Delta table directly to all users.
- C
Define a dynamic view with conditions for row-level and column-level filtering, then grant SELECT permissions on the view to the appropriate roles or groups.
- D
Use table ACLs to define both row-level and column-level access directly on the Delta table.
- E
Leverage Databricks' dynamic views to enforce column masking instead of completely restricting access to columns.
Show answer and explanation
Correct answers: A, C
Explanation
Dynamic views in Databricks allow you to enforce fine-grained access control by filtering rows and restricting access to specific columns. In this scenario, creating a dynamic view with the required filtering logic and granting SELECT permissions on the view ensures that users only see authorized data. Granting permissions directly on the base Delta table or relying on table ACLs alone would not provide the necessary level of control.
- A. Correct.
This is a correct step as dynamic views can be used to filter rows and restrict visible columns. The view can be configured to enforce both row-level and column-level security.
- B. Incorrect.
This is incorrect because granting SELECT permissions on the base Delta table does not enforce the required row-level or column-level security.
- C. Correct.
This is a correct step because dynamic views allow for fine-grained access control by defining both row-level and column-level restrictions. Granting SELECT permissions on the view ensures users see only what they are allowed to see.
- D. Incorrect.
This is incorrect because table ACLs in Databricks do not currently support both row-level and column-level security directly. Dynamic views must be used for such granular control.
- E. Incorrect.
This is incorrect because column masking is not equivalent to restricting access. Instead, the columns should be excluded entirely from the view to meet the requirement.