Data-Engineer-Associate - Governance and Security (15% of the exam) - Section 7.2

Configure access controls using the UI and SQL by applying GRANT, REVOKE and DENY privileges to users, groups and service principals at appropriate levels of the security hierarchy.

Apply privileges on the metastore, catalog, schema, table and volume hierarchy, including the USE CATALOG and USE SCHEMA privileges needed to reach an object. Grant to groups rather than individuals, and predict effective access through inheritance, object ownership and revocation.

GRANT and REVOKEsecurable object hierarchyUSE CATALOG and USE SCHEMAprivilege inheritanceservice principals

Practice question for this objective

Free sampleGovernance and Securityhard

An administrator runs the grant below so that members of the account group analysts can read a Unity Catalog table. The grant succeeds, but an analyst querying prod.sales.orders from a SQL warehouse receives an error saying the table cannot be found. The table exists and the analyst is in the group. What explains the behaviour?

GRANT SELECT ON TABLE prod.sales.orders TO `analysts`;

AThe analyst also needs USE CATALOG on prod and USE SCHEMA on prod.sales, because every parent securable in the path must be traversable before SELECT applies. Correct
BThe SELECT privilege applies to the table owner's own sessions, so the analyst needs an equivalent grant issued at the metastore level instead.
CSQL warehouses resolve privileges through the workspace Hive metastore, so the same grant has to be repeated there before the table becomes visible.
DTable level grants take effect at the next warehouse restart, so the analyst has to wait for the privilege cache on the SQL warehouse to be rebuilt.

Reading a Unity Catalog table requires USE CATALOG and USE SCHEMA on the parent securables in addition to SELECT on the table. Unity Catalog authorises a query by walking the full securable path from catalog to schema to table. The USE CATALOG and USE SCHEMA privileges make each parent traversable; without them the name cannot be resolved at all, so the engine reports that the object does not exist rather than revealing that a privilege is missing.

Why A is correct: Correct, because Unity Catalog evaluates the whole path to a securable, and without USE CATALOG on the catalog and USE SCHEMA on the schema the analyst cannot resolve the name, which surfaces as a table not found error rather than a permission error.

Why B is wrong: Tempting because metastore administrators can see everything, which suggests privileges must be assigned high in the hierarchy, but SELECT granted on a table applies to the named principal, not to the owner alone, and Unity Catalog does not require a metastore level grant for ordinary reads.

Why C is wrong: Plausible for anyone who remembers the legacy table access control model, but a three level name such as prod.sales.orders is resolved by Unity Catalog, and the workspace Hive metastore is a separate legacy catalog that holds no privileges for it.

Why D is wrong: Attractive because caching does explain some delayed behaviour in distributed systems, but Unity Catalog grants are evaluated per statement against the metastore, so a restart would change nothing while the traversal privileges are missing.

See more Data-Engineer-Associate practice questions, answers explained.

Exam traps in Governance and Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the Data-Engineer-Associate bank for this domain.

USE CATALOG on the catalog, USE SCHEMA on the schema, and ALL PRIVILEGES on the schema, so the job can write to whichever table in it the pipeline needs.
Why it is wrong: Tempting because it certainly makes the job work, but ALL PRIVILEGES on the schema covers every table in it plus object creation, which is far wider than the single table the job writes to and defeats the narrowing goal.
REVOKE SELECT ON TABLE prod.customer.pii_contacts FROM `support`, which withdraws the privilege that the group inherited from the parent schema.
Why it is wrong: Tempting because REVOKE is the natural counterpart of GRANT, but REVOKE can only remove a privilege that was explicitly granted on that object, and no table level grant exists here, so the inherited SELECT survives untouched.
Privilege changes take effect only after the SQL warehouse is restarted, so the running warehouse is still serving queries from the permission set it cached when it started.
Why it is wrong: It is tempting because stale caching explains many delayed-effect problems, but Unity Catalog evaluates privileges per request, and a caching explanation cannot account for exactly one table behaving differently from its siblings.

Examworthy is not affiliated with or endorsed by Databricks. Original, blueprint-aligned practice material only.