Overview
Securing Data is worth 8% and has three objectives. The first is about using Unity Catalog roles and sharing settings to keep workspace objects secure. That means granting privileges such as USE CATALOG, USE SCHEMA, SELECT, MODIFY and CREATE TABLE to groups, understanding admin and owner roles, and controlling sharing of dashboards, Genie spaces and data with others.
The second objective is the three-level namespace. Every table, view or volume is addressed as catalog.schema.object, and privileges are inherited downward from catalog to schema to object. Volumes hold files rather than tables. The third objective covers storage and management practices: assigning table ownership to groups rather than individuals, preferring managed tables, and protecting personally identifiable information with column masks, row filters, dynamic views and tag-driven policies. Together these controls determine who can see which rows and columns.
How it's tested
Expect access scenarios. A user or group needs to read, write or create something, or must be prevented from seeing sensitive values, and you choose the grant, ownership change or protection feature. Read for the minimum privilege that satisfies the request and check the parent objects.
-
Minimum grants
A group needs to query or create tables, and you choose the complete, least-privilege set of grants across catalog, schema and table.
-
Protect PII
Some users must not see email or phone values or rows for other regions, and you choose a column mask, row filter or dynamic view.
-
Resolve the namespace
A fully qualified name or a missing USE privilege is described, and you explain how catalog, schema and object resolve.
Analysts in the marketing group must query all current and future tables in sales.reporting but nothing else in the sales catalog. Granting SELECT on each table misses future ones. Granting SELECT on the catalog exposes other schemas. Granting USE CATALOG on sales, plus USE SCHEMA and SELECT on sales.reporting, gives exactly the needed access through inheritance and covers tables added later.
Objectives 3
Official objectives from the Databricks outline, in outline order.
9.1 Use Unity Catalog roles and sharing settings to ensure workspace objects are secure.Privileges, admin roles and sharing controls.
- What it means
- Unity Catalog secures objects through privileges granted to users, groups and service principals with GRANT and REVOKE or the Permissions tab. Roles include account admins, metastore admins, workspace admins and object owners. Sharing settings cover Delta Sharing of data and the share permissions on dashboards, Genie spaces, queries and warehouses.
- What to understand
- Common privileges are USE CATALOG and USE SCHEMA to traverse containers, SELECT to read, MODIFY to change data, CREATE TABLE and CREATE SCHEMA to add objects, and ALL PRIVILEGES. Owners can grant privileges on their objects. Grant to groups rather than individuals for manageability. Catalogs can be bound to specific workspaces to limit where they are visible. Workspace object permissions, such as Can View on a dashboard, are separate from data privileges.
- How it shows up
- A group needs access and you choose the correct set of grants or the role that can perform the grant.
- Common confusion
- Granting SELECT on a table without USE CATALOG and USE SCHEMA on its parents.
9.2 Understand how the 3-level namespace (Catalog / Schema / Tables or Volumes) works in the Unity Catalog.catalog.schema.object naming and inheritance.
- What it means
- Unity Catalog organises data as metastore, then catalog, then schema, then objects such as tables, views, volumes, functions and models. Objects are referenced with three-part names like main.sales.orders, and the USE CATALOG and USE SCHEMA statements set defaults for unqualified names.
- What to understand
- Privileges granted on a catalog or schema are inherited by everything inside it, including objects created later, which makes container-level grants efficient but powerful. Catalogs often separate environments or business units, and schemas group related tables. Volumes store non-tabular files such as CSV, images or PDFs and are addressed with paths under /Volumes/catalog/schema/volume. The legacy hive_metastore appears as a catalog but lacks Unity Catalog governance features.
- How it shows up
- Expect questions on resolving a name, the effect of a container grant, or when to use a volume.
- Common confusion
- Thinking a grant on a schema covers only the tables that exist at grant time.
9.3 Apply best practices for storage and management to ensure data security, including table ownership and PII protection.Ownership, managed storage and protecting personal data.
- What it means
- Good practice includes assigning ownership of tables and schemas to groups, preferring managed tables in governed storage, restricting external locations, and protecting PII through column masks, row filters, dynamic views and attribute-based policies driven by governed tags.
- What to understand
- An owner has full control and can grant access, so an individual owner creates risk when that person leaves; transfer ownership to a group with ALTER ... OWNER TO. A column mask is a SQL function that returns a masked value for unauthorised users, and a row filter is a function that limits visible rows, both evaluated at query time for the querying user. Dynamic views achieve similar results with current_user or is_account_group_member. Tag sensitive columns so policies apply consistently and audits can find them.
- How it shows up
- A requirement to hide or partially reveal sensitive values, or to fix risky ownership, is the typical stem.
- Common confusion
- Copying a table without the PII columns instead of masking, which creates ungoverned duplicates.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
USE CATALOG and USE SCHEMA
Privileges to traverse containers.
- Remember
- Needed in addition to SELECT.
- Tested as
- Grant completeness.
- Trap
- Omitting them.
-
SELECT
Privilege to read a table or view.
- Remember
- Can be granted at schema or catalog level.
- Tested as
- Read access scenarios.
- Trap
- Granting MODIFY for reading.
-
MODIFY
Privilege to insert, update or delete data.
- Remember
- Separate from SELECT.
- Tested as
- Write access scenarios.
- Trap
- Assuming it includes read.
-
Privilege inheritance
Grants flow from catalog to schema to object.
- Remember
- Includes future objects.
- Tested as
- Container grant questions.
- Trap
- Thinking only current tables are covered.
-
Object owner
Principal with full control of an object.
- Remember
- Assign to groups.
- Tested as
- Ownership best practice.
- Trap
- Leaving tables owned by individuals.
-
Metastore admin
Manages the Unity Catalog metastore.
- Remember
- Can create catalogs and manage grants.
- Tested as
- Role questions.
- Trap
- Confusing with workspace admin.
-
Three-level namespace
catalog.schema.object.
- Remember
- Fully qualified names avoid ambiguity.
- Tested as
- Naming questions.
- Trap
- Using two-part names in another catalog.
-
Volume
Governed storage for non-tabular files.
- Remember
- Paths under /Volumes.
- Tested as
- File storage questions.
- Trap
- Treating it as a table.
-
Column mask
Function returning masked values per user.
- Remember
- Applied to a column at query time.
- Tested as
- PII protection.
- Trap
- Creating redacted copies instead.
-
Row filter
Function limiting visible rows per user.
- Remember
- Applied to a table at query time.
- Tested as
- Regional access scenarios.
- Trap
- Using a view per region.
-
Dynamic view
View using user or group functions.
- Remember
- Alternative to masks and filters.
- Tested as
- PII scenarios.
- Trap
- Thinking it stores data.
-
Workspace binding
Restricts a catalog to chosen workspaces.
- Remember
- Limits environment exposure.
- Tested as
- Sharing settings.
- Trap
- Assuming catalogs are visible everywhere.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
PII protection options
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Column mask | Masks a column's values for unauthorised users. | Table keeps one copy; values hidden per user. | Thought to delete data. |
| Row filter | Hides rows based on the user. | Restricts which records appear. | Used to hide a single column. |
| Dynamic view | View with per-user logic. | Users query the view, not the table. | Base table left open to the same users. |
| Redacted copy | Separate table without sensitive columns. | Creates duplicates to govern. | Chosen over built-in controls. |
Grant levels
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Catalog-level grant | Applies to all schemas and objects inside. | Broadest scope. | Over-grants when one schema is needed. |
| Schema-level grant | Applies to all current and future objects in the schema. | Common least-privilege choice. | Assumed to exclude new tables. |
| Table-level grant | Applies to one object. | Most precise. | Misses tables created later. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
SELECT alone
- What candidates pick
- GRANT SELECT ON TABLE main.sales.orders TO analysts.
- Why it looks right
- SELECT is the read privilege.
- Why it's wrong
- Without USE CATALOG on main and USE SCHEMA on main.sales, the group cannot reach the table, so queries fail.
Clue to watch for Users still get permission errors after the grant.
-
Catalog grant for one schema
- What candidates pick
- Grant SELECT on the whole catalog.
- Why it looks right
- It covers everything quickly.
- Why it's wrong
- Catalog grants are inherited by every schema, exposing data beyond the request and breaking least privilege.
Clue to watch for Access to only one schema is required.
-
Individual ownership
- What candidates pick
- Keep the creator as the table owner.
- Why it looks right
- It is the default.
- Why it's wrong
- If the owner leaves or changes role, administration stalls; group ownership keeps control shared and auditable.
Clue to watch for A team should manage the table.
-
Redacted copies
- What candidates pick
- Create a second table without the email column.
- Why it looks right
- Simple and obvious.
- Why it's wrong
- Copies multiply data, drift from the source and need separate governance, whereas a column mask hides values on the single governed table.
Clue to watch for Some users need emails, others must not see them.
-
Row filter for columns
- What candidates pick
- Add a row filter to hide the phone column.
- Why it looks right
- It is a per-user control.
- Why it's wrong
- Row filters remove whole rows; hiding a column's values for certain users calls for a column mask.
Clue to watch for All rows visible, one column hidden.
-
Dashboard permission equals data access
- What candidates pick
- Give Can View on the dashboard to grant table access.
- Why it looks right
- Viewers then see the data.
- Why it's wrong
- Workspace object permissions are separate from Unity Catalog privileges; data access depends on grants or embedded credentials.
Clue to watch for Users can open the dashboard but widgets fail.
Answer framework
Use these steps to choose grants and protections for any access scenario.
- Identify the principal, ideally a group, and the exact action needed: read, write, create or manage.
- Choose the narrowest container that covers the need, remembering grants on catalogs and schemas include future objects.
- Add the traversal privileges USE CATALOG and USE SCHEMA on every parent container of the target object. Without them, a SELECT grant on a table alone does not let the user query it.
- For sensitive data, use a column mask for values, a row filter for records, or a dynamic view where needed. A dynamic view can combine both by checking group membership with is_account_group_member.
- Assign ownership of important objects to groups and keep data in managed tables to centralise governance.
Practice question
Want more like this? The Databricks DA Assoc practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Practise security in a workspace where you can create a catalog or at least a schema, since this section is easiest to learn by granting and testing.
Start by drawing the namespace: metastore, catalog, schema, then tables, views, volumes and functions. Next to each level, write the privileges that apply there. Then create a schema with two tables, grant SELECT on one table to a test group without USE SCHEMA, and see the failure. Add the traversal privileges and retest. Grant SELECT at schema level, create a new table and confirm the group can read it, which demonstrates inheritance of future objects.
Next, write a column mask function that reveals a full email only to members of a compliance group, attach it to a column and query as different users if possible. Do the same with a row filter that limits rows by region. Compare these with a dynamic view using is_account_group_member. Finally, transfer ownership of your schema to a group and read the documentation on workspace-catalog binding and Delta Sharing recipients. Review the four traps about traversal privileges, inheritance, masks and ownership before the exam.
FAQ
How much of the Databricks Data Analyst exam is Securing Data?
Securing Data is 8% of the exam, about four of 45 scored questions, though security ideas also appear in dashboard and Genie questions.
What privileges does a user need to read a table?
USE CATALOG on the catalog, USE SCHEMA on the schema, and SELECT on the table or on a parent container.
Do schema grants apply to tables created later?
Yes. Privileges granted on a catalog or schema are inherited by current and future objects inside it.
When should I use a volume?
Use a volume to store and govern non-tabular files such as CSV, JSON, images or PDFs, addressed by paths under /Volumes.
What is the difference between a column mask and a row filter?
A column mask changes the values a user sees in one column. A row filter changes which rows a user sees.
Why assign ownership to groups?
Owners control grants and changes. Group ownership avoids losing control when an individual leaves and makes responsibility clearer.
Other Data & Analytics certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 9 knowledge
Test whether you can choose least-privilege grants, explain namespace inheritance and pick the right PII protection under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Databricks DA Assoc AI tutor Get any concept explained your way