Overview
Data Security & Governance is 15% of the ABDE exam. It covers implementing access control and authentication, configuring encryption, ensuring regulatory compliance, establishing data quality validation frameworks, managing metadata and data catalogs, and tracking lineage across transformations. DASCA names Great Expectations, an open-source library for declaring and testing expectations about data, which signals that quality validation is treated as an engineering task inside pipelines, not a manual review.
The domain exists because data platforms concentrate sensitive information and feed decisions. A data engineer decides who can read which columns, whether data is encrypted in transit and at rest, how personal data is minimized and deleted, and whether a bad batch is stopped before it reaches a dashboard. It overlays every other domain: ingestion, storage, orchestration and AI pipelines all inherit these controls.
How it's tested
Questions describe users, data sensitivity and a regulatory or trust problem, then ask for the BEST or MOST appropriate control. Correct answers apply least privilege, protect data both in transit and at rest, automate quality checks inside pipelines, and keep metadata and lineage current. Watch for the specific risk named, because the control must match that risk.
-
Match the control to the risk
Choose among access control, masking, tokenization or encryption for a named threat, such as analysts seeing identifiers or a stolen disk.
-
Stop bad data early
Pick where and how validation runs so that a failing batch is caught before consumers see it.
-
Answer the audit question
Use catalogs and lineage to show where data came from, who owns it and what changed it.
Marketing analysts need to count customers by region, but policy forbids them from seeing email addresses. Encrypting the table at rest does not help, because authorized queries return decrypted values. The fitting control is column-level access control or dynamic masking on the email column for the analyst role, or deterministic tokenization if they must still join or count distinct customers by email.
Practical applications 6
Official practical applications from the DASCA outline, in outline order.
4.1 Implementing access control and authentication systemsProving identity and granting only the access needed.
- What it means
- Authentication verifies who a user or service is, for example through single sign-on, Kerberos in Hadoop clusters or service credentials, while authorization decides what that identity can do using models such as role-based (RBAC) or attribute-based access control (ABAC).
- What to understand
- Apply least privilege: grant the minimum access for the job, at table, column or row level as needed, and review it periodically. RBAC is simple to administer through roles, while ABAC evaluates attributes such as department, region or data classification and scales better when rules depend on context. Service accounts for pipelines should have narrow permissions and credentials stored in a secrets manager.
- How it shows up
- A scenario requires regional managers to see only their region's rows, which points to row-level security or ABAC rather than separate copies of the table.
- Common confusion
- Confusing authentication with authorization; logging in proves identity but grants nothing by itself.
4.2 Configuring data encryptionProtecting data at rest and in transit, and managing keys.
- What it means
- Encryption at rest protects stored data, for example with AES-256 on disks and object storage, and encryption in transit protects data moving across networks using TLS; key management controls who can use the keys.
- What to understand
- Encryption at rest defends against stolen media or direct storage access but not against an authorized user who queries the data, so it complements rather than replaces access control. Keys should live in a key management service with rotation and separation of duties, and envelope encryption uses a master key to protect per-object data keys. Customer-managed keys give an organization the ability to revoke access to its data.
- How it shows up
- An auditor requires that data moving between a cluster and object storage cannot be read on the network, which points to TLS, not to disk encryption.
- Common confusion
- Assuming encrypted-at-rest data is hidden from users who have query permissions.
4.3 Ensuring regulatory complianceMeeting privacy and industry rules in pipeline design.
- What it means
- Regulatory compliance means designing data handling to satisfy laws and standards such as GDPR, HIPAA, CCPA and PCI DSS, covering lawful use, data minimization, retention limits, residency and individuals' rights such as erasure.
- What to understand
- Engineers implement compliance through classification of sensitive fields, minimization (collect and keep only what is needed), pseudonymization or anonymization, retention and deletion jobs, residency-aware storage location, and audit logs. Pseudonymized data can still be re-identified with a key, so it remains personal data under GDPR, while properly anonymized data cannot be linked back to a person. Right-to-erasure requests must reach copies and derived tables, which is where row-level deletes in table formats help.
- How it shows up
- A customer invokes the right to erasure and the question asks what the pipeline must do, including backups, derived tables and downstream copies.
- Common confusion
- Treating pseudonymized or hashed identifiers as anonymous and therefore outside privacy rules.
4.4 Establishing data quality validation frameworksAutomated checks that stop bad data before consumers see it.
- What it means
- A data quality framework defines expectations such as completeness, uniqueness, validity, consistency, accuracy and timeliness, and tests each batch against them automatically, for example with Great Expectations suites or dbt tests.
- What to understand
- Validate at stage boundaries: on landing, after transformation and before publishing. Decide per check whether failure should block publication, quarantine rows or only warn, based on business impact. Great Expectations expresses checks as expectations, groups them into suites, runs them through checkpoints and produces human-readable data docs, so results are visible as well as enforced.
- How it shows up
- A null customer ID reached a revenue dashboard, and you choose an automated not-null and uniqueness check that blocks publication when it fails.
- Common confusion
- Relying on manual spot checks by analysts after publication, which detects problems only after consumers are affected.
4.5 Managing metadata and data catalogsMaking data findable, understood and owned.
- What it means
- Metadata describes data: technical metadata (schemas, types, locations), business metadata (definitions, owners, glossary terms) and operational metadata (load times, row counts, quality results). A data catalog collects it so users can search, understand and request access.
- What to understand
- Catalogs work only when metadata is captured automatically from pipelines and metastores and each dataset has a named owner or steward. Classification tags, such as PII or confidential, connect the catalog to access policies and masking. A business glossary resolves conflicting definitions, such as two teams computing 'active customer' differently.
- How it shows up
- Analysts cannot find trusted datasets or disagree on metric definitions, and you choose a catalog with ownership and a glossary.
- Common confusion
- Treating the Hive metastore as a full data catalog; it stores technical schemas, not business definitions, owners or quality status.
4.6 Tracking data lineage across transformationsRecording where data came from and what changed it.
- What it means
- Data lineage traces data from source systems through each transformation to reports and models, at table or column level, so you can see upstream origins and downstream dependents.
- What to understand
- Lineage supports impact analysis before a change (what breaks if this column is dropped), root-cause analysis after an incident (which upstream job introduced the error) and regulatory audit. It is best captured automatically from orchestration and transformation tools, for example through the OpenLineage standard or dbt's dependency graph, because manually maintained diagrams quickly fall out of date.
- How it shows up
- A source team plans to change a field, and the question asks how to identify every affected report before the change.
- Common confusion
- Confusing lineage (the flow and transformation of data) with a catalog entry (a description of one dataset).
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Least privilege
Least privilege grants each user or service only the access its task requires, at the narrowest practical scope.
- Remember
- Apply it to pipeline service accounts too, and review grants regularly because access tends to accumulate.
- Tested as
- The default principle behind most access questions.
- Trap
- Granting broad read access to a whole schema for convenience.
-
RBAC vs. ABAC
Role-based access control grants permissions through roles, while attribute-based access control evaluates attributes of the user, the data and the context at request time.
- Remember
- ABAC handles rules like 'region matches the user's region' without creating a role per combination.
- Tested as
- Questions about many fine-grained rules point to ABAC or row-level policies.
- Trap
- Creating hundreds of roles to express attribute rules.
-
Encryption at rest vs. in transit
At-rest encryption protects stored data such as disks and objects, and in-transit encryption (TLS) protects data moving over networks.
- Remember
- Neither hides data from authorized users; they protect against stolen media and network interception.
- Tested as
- The named threat tells you which one is needed.
- Trap
- Choosing disk encryption to stop analysts from seeing a sensitive column.
-
Key management and envelope encryption
A key management service stores and controls master keys, and envelope encryption encrypts data with data keys that are themselves encrypted by a master key.
- Remember
- Rotate keys, separate key administrators from data users, and log key use.
- Tested as
- Appears in questions about controlling or revoking access to encrypted data.
- Trap
- Storing encryption keys alongside the data or in pipeline code.
-
Masking vs. tokenization
Masking hides all or part of a value from viewers, for example showing only the last four digits, while tokenization replaces a value with a surrogate token that can be mapped back only through a secured vault.
- Remember
- Deterministic tokens keep joins and distinct counts possible without exposing the raw value.
- Tested as
- Used when analysts need to work with identifiers they must not see.
- Trap
- Using random masking when the scenario requires joining on the protected field.
-
Pseudonymization vs. anonymization
Pseudonymization replaces identifiers but allows re-identification with additional information, while anonymization irreversibly removes the link to an individual.
- Remember
- Under GDPR, pseudonymized data is still personal data; only truly anonymized data falls outside its scope.
- Tested as
- Compliance questions test which datasets still carry obligations.
- Trap
- Assuming a hashed email is anonymous.
-
Data quality dimensions
Quality is commonly measured on completeness, uniqueness, validity, consistency, accuracy and timeliness.
- Remember
- Each check should map to a dimension and have a defined action on failure: block, quarantine or warn.
- Tested as
- Questions ask which check catches a described defect.
- Trap
- Using a format (validity) check to catch duplicates, which needs a uniqueness check.
-
Great Expectations
Great Expectations is an open-source framework where you declare expectations about data, group them into suites and run them in checkpoints that report results as data docs.
- Remember
- It validates data, so it complements rather than replaces the orchestrator and the transformation tool.
- Tested as
- DASCA names it as this domain's reference tool.
- Trap
- Thinking it schedules pipelines or transforms data.
-
Data lineage
Lineage records how data flows from sources through transformations to consumers, at table or column level.
- Remember
- Use it for impact analysis before changes, root-cause analysis after incidents, and audit evidence.
- Tested as
- Questions about tracing a wrong number or assessing a change's impact point here.
- Trap
- Relying on manually drawn diagrams that drift out of date.
-
Data catalog and business glossary
A catalog indexes datasets with technical, business and operational metadata, and a glossary defines shared business terms.
- Remember
- Ownership, classification tags and automated metadata capture are what keep a catalog useful.
- Tested as
- Discovery, trust and definition-conflict scenarios.
- Trap
- Expecting a catalog to enforce quality on its own.
-
Audit logging
Audit logs record who accessed or changed data, when and how.
- Remember
- Logs must be tamper-resistant and retained per policy to serve as compliance evidence.
- Tested as
- Compliance questions asking how to prove access controls work.
- Trap
- Treating application debug logs as an audit trail.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Access control vs. masking vs. tokenization vs. encryption at rest
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Access control | Decides who may read or change which tables, rows or columns | Prevents unauthorized queries outright | Granting whole-schema access when only some columns are needed |
| Dynamic masking | Shows authorized users a hidden or partial value based on their role | Users can query the column but not see full values | Using it when users must join on the hidden value |
| Tokenization | Replaces a value with a surrogate that only a secured vault can reverse | Preserves joins and counts with deterministic tokens | Leaving the token vault accessible to the same users |
| Encryption at rest | Encrypts stored files and disks | Protects against stolen media, not against authorized queries | Expecting it to hide data from analysts |
Pseudonymization vs. anonymization
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Pseudonymization | Identifiers replaced, re-identification possible with extra information | Still personal data under GDPR | Treating hashed or tokenized data as outside privacy obligations |
| Anonymization | Link to the individual irreversibly removed | Falls outside GDPR when re-identification is not reasonably possible | Assuming removing names alone anonymizes data that quasi-identifiers can still reveal |
Data catalog vs. data lineage vs. metastore
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Metastore | Technical schemas and file locations for query engines | Serves engines, not people looking for meaning or owners | Calling it a full catalog |
| Data catalog | Searchable inventory with business definitions, owners and tags | Helps people find and understand datasets | Expecting it to show how a value was calculated |
| Data lineage | Flow of data through jobs from source to consumer | Shows dependencies for impact and root-cause analysis | Maintaining it by hand so it drifts from reality |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Encryption fixes everything
- What candidates pick
- Enable encryption at rest so analysts cannot see customer phone numbers.
- Why it looks right
- Encryption is the best-known security control and sounds strongest.
- Why it's wrong
- Storage encryption is transparent to authorized queries, so analysts would still see the numbers; column access control or masking addresses the actual risk.
Clue to watch for The threat is a legitimate user seeing too much, not stolen storage or network interception.
-
Hashed means anonymous
- What candidates pick
- Hash email addresses and treat the dataset as exempt from deletion requests.
- Why it looks right
- The raw email is no longer visible.
- Why it's wrong
- A hash of an email can be matched by hashing the same email again, so the data is pseudonymized and still personal data subject to rights such as erasure.
Clue to watch for The scenario involves GDPR or erasure requests on data with hashed or tokenized identifiers.
-
Most restrictive wins
- What candidates pick
- Remove analysts' access to the customer table entirely.
- Why it looks right
- It eliminates exposure and feels safest.
- Why it's wrong
- It breaks a legitimate business need; least privilege means granting what the job requires, such as aggregates or masked columns.
Clue to watch for The scenario states a business need for some form of access.
-
Validate after publishing
- What candidates pick
- Have analysts review the dashboard each morning for anomalies.
- Why it looks right
- Humans understand business context.
- Why it's wrong
- Problems are found only after consumers see wrong numbers; automated checks at stage boundaries can block or quarantine bad data first.
Clue to watch for The question asks how to prevent bad data from reaching consumers.
-
Catalog equals lineage
- What candidates pick
- Search the data catalog to find every report affected by a column change.
- Why it looks right
- The catalog lists all datasets and their descriptions.
- Why it's wrong
- A catalog describes datasets but does not necessarily trace dependencies; lineage shows which downstream jobs and reports use the column.
Clue to watch for The question is about impact or root cause across transformations.
-
Delete only the main table
- What candidates pick
- Delete the customer's row from the primary customer table to satisfy an erasure request.
- Why it looks right
- The primary record is the obvious place to look.
- Why it's wrong
- Copies persist in raw layers, derived tables, extracts and feature stores; lineage helps find them and deletion jobs must cover each.
Clue to watch for Mentions of multiple layers, downstream copies or derived datasets.
Answer framework
When an ABDE governance question asks for the right control, apply these steps in order.
- Name the exact risk: unauthorized viewing, stolen storage, network interception, bad data, or a regulatory obligation.
- Match the control to that risk: access policies or masking for viewers, encryption for storage and transit, validation for quality, retention and deletion for compliance.
- Apply least privilege while still meeting the stated business need, preferring masked or aggregated access over blanket denial.
- Automate quality checks at landing, transformation and publishing stages, with a defined block, quarantine or warn action for each.
- Keep catalogs, ownership, classification tags and lineage current automatically, so audits, impact analysis and erasure requests can be answered from evidence rather than from memory or hand-drawn diagrams.
Practice question
Want more like this? The ABDE practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the risk-to-control mapping, because most questions in this domain turn on choosing the control that matches the named risk. Make a one-page table of threats (unauthorized viewing, stolen media, interception, bad data, over-retention) and the controls that address each.
Next, study access control and data protection in depth: least privilege, RBAC versus ABAC, row and column security, masking, tokenization and encryption with key management. Candidates most often underestimate the limits of encryption at rest and the GDPR status of pseudonymized data.
Then move to data quality. If possible, install Great Expectations or use dbt tests on a small dataset, write expectations for nulls, uniqueness and value ranges, and wire a failing check to stop a publish step. Seeing a check block bad data makes the exam scenarios intuitive.
Finish with metadata, catalogs and lineage, practicing impact analysis questions such as which reports break if a column is renamed. Afterwards, answer timed practice questions and, for each miss, identify whether you misread the risk or chose a control that was too broad or too narrow. Then revisit Domain 1 to connect masking decisions with ETL versus ELT.
FAQ
How much of the ABDE exam covers security and governance?
DASCA weights Data Security & Governance at 15%, which suggests about 11 of the 75 questions. DASCA does not publish per-domain question counts.
Do I need to know specific regulations in detail?
DASCA's outline lists ensuring regulatory compliance without naming specific laws. Expect engineering implications of common regimes such as GDPR, HIPAA and PCI DSS, like minimization, retention, residency and erasure, rather than legal article numbers.
Does encryption at rest stop analysts from seeing sensitive data?
No. Encryption at rest protects stored files from someone who obtains the media or bypasses the database. Authorized queries see decrypted data, so use access control or masking to limit what users see.
What is Great Expectations used for?
It lets you declare expectations about data, such as no nulls in a key or values within a range, and validate each batch against them. DASCA names it for this domain as the reference quality validation tool.
Is hashed or tokenized data still personal data?
Usually yes. If identifiers can be re-linked to a person with additional information, the data is pseudonymized and remains personal data under GDPR, so obligations such as erasure still apply.
What is the difference between a data catalog and lineage?
A catalog helps people find and understand datasets through definitions, owners and tags. Lineage shows how data flows between datasets and jobs, which supports impact analysis and incident investigation.
How does governance connect to the AI domains?
Training data, feature stores and retrieval sources for language models need the same access control, privacy and lineage as any dataset. Domains 7 and 8 build on these controls rather than replacing them.
Other Data & Analytics certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have covered access control, encryption, compliance, quality validation, catalogs and lineage. Test whether you can match each governance risk to the right control under exam conditions.