A governance team must redact a national_id column that appears in more than forty Unity Catalog tables inside one catalog, and further tables carrying the same column are created every month. The team wants one central definition of the rule rather than a mask attached table by table. Which two properties of Unity Catalog attribute-based access control support that requirement? (Select TWO.)
- AA policy created at catalog or schema level covers every table in that scope whose columns carry the governed tag, so tables created later fall under it without the policy being edited. Correct
- BAssigning a governed tag to a column rewrites the stored values in place, so the sensitive figures leave the table files and no reader can reach them through any query path afterwards.
- CA governed tag is defined centrally with a permitted set of values and controlled assignment, so the policy can target that tag instead of naming a column in every table it protects. Correct
- DThe policy supersedes the SELECT privilege on the tables it covers, so a reader matched by it stops needing a grant on the catalog and the schema before running a query.
- EEach table owner has to attach the shared masking function to the tagged column with a statement on that table before the central policy begins to take effect on it.
Why A is correct: Correct. An attribute-based access control policy is bound to a scope and to a tag rather than to a fixed list of tables, so a later table whose column carries the tag is governed by the same policy definition.
Why B is wrong: Tempting because tagging feels like an action on the data, but a tag is metadata on the column. Masking is applied when a query reads the column, and the stored values are left as they are.
Why C is correct: Correct. Governed tags give the vocabulary the policy matches on, so the mask follows the classification rather than a hand maintained list of table and column names.
Why D is wrong: Tempting because both features gate what a reader sees, but the privilege model still applies. A reader lacking SELECT with USE CATALOG and USE SCHEMA cannot query the table at all, policy or no policy.
Why E is wrong: Tempting because that is exactly how a per table column mask works, and it is the effort the team is trying to escape. A tag driven policy removes that per table step.