Databricks DE Assoc Domain 7: Governance and Security (15%)

Overview

Section 7 tests how Unity Catalog protects data. The first objective compares managed tables, whose storage and lifecycle Unity Catalog controls, with external tables that point at a path you manage. You need to create, alter, drop and convert between the two and know what happens to the underlying files in each case. The second objective is about privileges: granting and removing access in the UI and with SQL for users, groups and service principals, at the right level of the catalog, schema and object hierarchy.

The last two objectives restrict what people see inside a table. Row filters and column masks use functions, often based on group membership, to hide rows or values. Attribute-based access control (ABAC) policies apply the same kinds of rules centrally, using governed tags so one policy covers every matching table or column.

Why it matters on the exam

About 7 of the 45 scored questions come from this section at 15%, making it the fourth-largest. Governance mistakes are costly: dropping a managed table also removes its data, a grant at the wrong level either fails or exposes far more than intended, and a mask added to one table but not its copies leaves sensitive values visible elsewhere. The exam expects least-privilege thinking. Grants usually go to groups rather than individuals, privileges such as USE CATALOG and USE SCHEMA are needed before SELECT is useful, and centrally managed ABAC policies scale better than repeated per-table rules. Several questions are short SQL statements where one keyword decides the outcome, so hands-on practice is the most reliable preparation.

How it's tested

Expect SQL statements and short scenarios. Typical items ask what DROP TABLE does to files, which GRANT statements a group needs to query a table, or how to hide a column from everyone outside a group. Options often differ only in privilege name, securable level or whether a rule is per table or a central policy.

Table type consequences

A table is created, dropped or converted and you predict what happens to metadata and files.
Minimum grants

A group needs a specific action and you choose the smallest set of privileges at the right levels.
Restrict visibility

Some users must not see certain rows or values and you choose a row filter, column mask or ABAC policy.

Reasoning it through

Analysts in the eu_analysts group must query sales.reporting.orders and nothing else. Granting SELECT on the table alone fails because they cannot reach the catalog and schema. Granting ALL PRIVILEGES on the catalog exposes too much. Granting USE CATALOG on sales, USE SCHEMA on sales.reporting and SELECT on the table to the group meets the need with least privilege.

Objectives 4

Official objectives from the Databricks outline, in outline order.

7.1 Differentiate between managed and external tables in Unity Catalog and perform basic operations (create, modify, delete, and convert between managed and external tables) on themOwnership of storage and lifecycle for the two table types.

What it means: A managed table stores its data in a Unity Catalog managed storage location, and Unity Catalog handles the file lifecycle. An external table points to a path in an external location that you register, and Unity Catalog manages only its metadata and access.
What to understand: Create a managed table with CREATE TABLE and no LOCATION clause; create an external table by adding LOCATION with a path covered by an external location. Dropping a managed table deletes its data after a retention period, during which UNDROP can restore it; dropping an external table removes only the metadata and leaves the files. Managed tables get features such as predictive optimization. ALTER TABLE ... SET MANAGED converts an external Delta table to managed. Going the other way is usually done by copying data to a new external table with CREATE TABLE AS SELECT or a clone.
How it shows up: Questions ask what happens to files after DROP, how to tell the types apart, and how to convert.
Common confusion: Thinking DROP TABLE on an external table deletes the files in cloud storage.

7.2 Configure access controls using the UI and SQL by applying GRANT, REVOKE, and DENY privileges to principals (users, groups, and service principals) at appropriate levels of the security hierarchyGranting and removing privileges on catalogs, schemas and objects.

What it means: Unity Catalog privileges are given to principals, meaning users, groups and service principals, on securable objects arranged in a hierarchy: metastore, catalog, schema, then tables, views, volumes and functions. Privileges granted at a higher level are inherited by objects below it.
What to understand: Use GRANT privilege ON object TO principal and REVOKE privilege ON object FROM principal, or the Permissions tab in Catalog Explorer. To read a table a principal needs USE CATALOG, USE SCHEMA and SELECT. Writing needs MODIFY, and creating tables needs CREATE TABLE on the schema. Granting SELECT on a schema covers current and future tables in it. Owners and users with MANAGE can grant on an object. The guide also lists DENY; check its current scope in the documentation, since explicit denial has historically belonged to legacy table access control. Prefer groups over individual users.
How it shows up: Expect questions on the minimum set of grants and the right level for a requirement.
Common confusion: Giving a group SELECT on a table while it still lacks USE CATALOG and USE SCHEMA.

7.3 Understand column-level masking and row-level security to restrict data visibility based on user groupsHiding rows and values per table with functions.

What it means: Row filters and column masks apply a SQL function to a table so different users see different data from the same query. A row filter returns true or false for each row, and a column mask returns either the real value or a masked one.
What to understand: Write a SQL UDF that checks membership with is_account_group_member, then attach it with ALTER TABLE ... SET ROW FILTER function ON (column) or ALTER TABLE ... ALTER COLUMN column SET MASK function. The rules run at query time for every reader, including SQL and DataFrame access, so no copies of the data are needed. Dynamic views offer a similar result but require users to query the view rather than the table. Filters and masks are defined per table, so many tables need many attachments.
How it shows up: Questions describe who may see what and ask for the matching filter or mask approach.
Common confusion: Creating separate filtered table copies per group instead of a row filter.

7.4 Understand Unity Catalog ABAC policies to centrally control row-level filtering and column masking for sensitive dataTag-driven policies that apply filters and masks at scale.

What it means: Attribute-based access control lets administrators define a policy once, at the catalog, schema or table level, and have it apply to every table or column that carries a matching governed tag. The policy uses a row filter or column mask function and names which principals it applies to.
What to understand: Governed tags, such as a pii tag on email columns, describe data. A policy attached to a catalog or schema is inherited by objects below it and matches columns or tables by tag, so newly tagged columns are protected without extra steps. Policies specify the function, the principals they apply to and principals excepted from them. Compared with per-table filters and masks, ABAC reduces repeated work and keeps rules consistent. Managing policies requires the right privileges, and tags themselves can be controlled so not everyone can assign them.
How it shows up: Expect questions on protecting many tables consistently and on how tags and policies interact.
Common confusion: Attaching a column mask to each table one by one when an ABAC policy on tagged columns would cover them.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Managed table

Storage and lifecycle handled by Unity Catalog.

Remember
DROP removes data after retention; UNDROP can restore.

Tested as
Table type items.

Trap
Assuming files always survive DROP.
External table

Table at a registered external path.

Remember
DROP removes metadata only.

Tested as
Table type items.

Trap
Expecting data deletion on DROP.
SET MANAGED

Converts an external table to managed.

Remember
Uses ALTER TABLE.

Tested as
Conversion questions.

Trap
Copying data by hand when a command exists.
USE CATALOG / USE SCHEMA

Privileges to reach objects inside.

Remember
Required before SELECT is useful.

Tested as
Minimum grant items.

Trap
Granting only SELECT.
Privilege inheritance

Grants flow down the hierarchy.

Remember
Schema-level SELECT covers future tables.

Tested as
Scope questions.

Trap
Granting table by table.
Groups as principals

Grant to groups, not individuals.

Remember
Easier to manage and audit.

Tested as
Best practice items.

Trap
Granting to each user.
Row filter

Function deciding which rows a user sees.

Remember
Attached with SET ROW FILTER.

Tested as
Row-level security.

Trap
Making filtered copies.
Column mask

Function returning real or masked value.

Remember
Attached with ALTER COLUMN SET MASK.

Tested as
Column-level security.

Trap
Dropping the column from a copy.
is_account_group_member

Checks if the current user is in a group.

Remember
Used inside filter and mask functions.

Tested as
Function logic questions.

Trap
Using workspace-local group checks.
ABAC policy

Central rule matched by governed tags.

Remember
Inherited from catalog or schema.

Tested as
Scale governance items.

Trap
Repeating masks per table.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Managed vs external tables

Concept	Meaning	Key difference	Common trap
Managed table	Data in Unity Catalog managed storage.	Unity Catalog controls files and maintenance.	Expecting files to remain after DROP.
External table	Data at a path you manage.	Unity Catalog controls metadata and access only.	Expecting predictive optimization on it.
Conversion	SET MANAGED moves external to managed.	The reverse needs a copy to a new table.	Assuming conversion works both ways with one command.

Fine-grained access methods

Concept	Meaning	Key difference	Common trap
Row filter / column mask	Per-table functions attached with ALTER TABLE.	Precise, but set table by table.	Forgetting to attach to every copy.
ABAC policy	Tag-matched rules at catalog or schema level.	Central and inherited.	Forgetting the tags drive matching.
Dynamic view	View with filtering logic in its query.	Users must query the view.	Leaving direct table access open.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

External DROP deletes files

What candidates pick
Files are removed when the external table is dropped

Why it looks right
DROP sounds destructive.

Why it's wrong
Dropping an external table removes only the Unity Catalog metadata; the files stay at the path.

Clue to watch for LOCATION clause or external location.
SELECT is enough

What candidates pick
GRANT SELECT on the table only

Why it looks right
SELECT is the obvious read privilege.

Why it's wrong
Without USE CATALOG and USE SCHEMA on the parents, the principal cannot reach the table at all.

Clue to watch for Users get permission errors after a grant.
Over-broad grant

What candidates pick
ALL PRIVILEGES on the catalog

Why it looks right
It solves the access error quickly.

Why it's wrong
It breaks least privilege by allowing writes and management on every object in the catalog.

Clue to watch for Least privilege or read-only.
Copies for each audience

What candidates pick
Create a filtered table per region

Why it looks right
Separate tables look simple to secure.

Why it's wrong
Copies multiply storage and drift; a row filter or ABAC policy restricts rows on the single source table.

Clue to watch for Different users see different rows.
Per-table masks at scale

What candidates pick
Add a mask to every table with an email column

Why it looks right
Masks are the known feature.

Why it's wrong
An ABAC policy matched on a governed tag applies once and covers new tagged columns automatically.

Clue to watch for Hundreds of tables or new tables appearing.

Answer framework

Use these checks when a governance question involves table types, grants or data visibility.

Identify whether the question concerns table type, privileges, or restricting rows and values inside a table.
For table type, check for a LOCATION clause and predict what DROP, UNDROP or SET MANAGED does to files and metadata.
For privileges, list every level the principal must reach and grant USE CATALOG, USE SCHEMA and the object privilege to a group.
For visibility on one or a few tables, use a row filter or column mask function based on group membership.
For many tables or columns that share a classification, tag them and apply an ABAC policy at catalog or schema level.

Practice question

A data engineer runs DROP TABLE on a Unity Catalog table that was created with a LOCATION clause pointing to a path in an external location. What happens to the table's metadata and data files?

Both the metadata and the files are deleted immediately The files are deleted after the retention period and the metadata stays Nothing changes until VACUUM is run on the path The metadata is removed from Unity Catalog and the files remain at the path

Show the answer

Answer D. A table created with a LOCATION clause is an external table. Unity Catalog manages its metadata and permissions but not the underlying files, so DROP TABLE removes the table definition while the data stays in cloud storage. Deleting files after a retention period describes a managed table. VACUUM removes old files for an existing Delta table and has no role in the drop.

Want more like this? The Databricks DE Assoc practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Allocate eight to ten hours and do almost all of it in SQL. Create a managed table and an external table in a test catalog, drop each, and check storage to see what remains. Use UNDROP on the managed one. Convert an external Delta table with SET MANAGED and confirm its new location in DESCRIBE DETAIL.

Next, practise privileges with a test group. Grant SELECT on a table only and confirm that the group cannot query it, then add USE CATALOG and USE SCHEMA. Try a schema-level grant and create a new table to see inheritance. Use SHOW GRANTS to review results, and revoke access again. Read the current documentation on DENY so you know how Databricks describes it.

Finally, write a row filter and a column mask that use is_account_group_member, attach them, and query as users inside and outside the group. Then read the ABAC documentation, create a governed tag, tag a column and attach a policy at the schema level if your workspace supports it. Rehearse explaining when a central policy is better than per-table rules.

FAQ

How much of the exam is Governance and Security?

Governance and Security is Section 7 and carries 15% of the exam, about 7 of the 45 scored questions. It has four official objectives on table types, privileges, fine-grained access and ABAC.

Does the exam cover Unity Catalog setup such as creating metastores?

The objectives focus on tables, privileges and fine-grained access. Metastore creation and account administration are not listed for this exam.

Which privileges are needed to create a table?

A principal needs USE CATALOG on the catalog, USE SCHEMA and CREATE TABLE on the schema, and for external tables, rights on the external location as well.

Is DENY supported in Unity Catalog?

The exam guide lists DENY with GRANT and REVOKE. Check the current Unity Catalog documentation for its scope, because explicit denial historically applied to legacy table access control rather than Unity Catalog.

What is the difference between a dynamic view and a row filter?

A dynamic view puts filtering logic in a view that users must query. A row filter is attached to the table itself, so every query on the table is filtered.

Do ABAC policies replace row filters and column masks?

They use the same kinds of functions but apply them centrally through tags. Per-table filters and masks remain useful for one-off cases.

Related domains

Other Data & Analytics certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Databricks DE Assoc Domain 7: Governance and Security

Overview

How it's tested

Table type consequences

Minimum grants

Restrict visibility

Objectives 4

High-yield concepts

Managed table

External table

SET MANAGED

USE CATALOG / USE SCHEMA

Privilege inheritance

Groups as principals

Row filter

Column mask

is_account_group_member

ABAC policy

Side by side

Managed vs external tables

Fine-grained access methods

Exam traps

External DROP deletes files

SELECT is enough

Over-broad grant

Copies for each audience

Per-table masks at scale

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Data & Analytics certifications

Test your Domain 7 knowledge

Keep going