Databricks DE Pro · Domain 7 of 9

Databricks DE Pro Domain 7: Data Governance

The smallest sections share 5% each, and this one has just two objectives: using Unity Catalog tags and comments to make data discoverable, and understanding how permissions inherit from catalogs to schemas to objects.

Exam weight
5%
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–4 hrs

About 9 min read Reviewed October 2026

Overview

Section 7 was narrowed in the October 2026 revision to two objectives. The first is metadata: tags are key-value labels on catalogs, schemas, tables, views, volumes and columns, and comments are free-text descriptions. Together they let people find and understand data through Catalog Explorer search, information_schema queries and AI-assisted discovery, and tags also feed security policies covered in Section 6. Databricks can draft comments with AI, which engineers then review.

The second objective is the permission model: privileges granted on a catalog flow down to every current and future schema and object inside it, and privileges on a schema flow to its tables, views, volumes and functions. Access to any object also needs USE CATALOG and USE SCHEMA on its parents. Owners hold full control of their objects, and Unity Catalog has no DENY statement, so access is shaped by what you grant and where.

How it's tested

Questions are short and rule-based. They show a set of grants and ask what a user can do, or describe a discovery problem and ask how to fix it with metadata. Watch for missing USE privileges and for options that rely on a DENY statement Unity Catalog does not have.

  • Trace the grants

    A list of grants at different levels is shown, and you work out whether a user can read or create an object.

  • Make it findable

    Users cannot find or understand datasets, and you choose tags, comments or BROWSE access.

  • Grant at the right level

    Access must cover all current and future objects in a container, and you choose where to grant.

Reasoning it through

An analyst has SELECT on the sales catalog but gets permission errors on sales.orders.daily. SELECT granted on the catalog inherits down to every table, so SELECT is not the gap. Reading still needs USE CATALOG on sales and USE SCHEMA on orders. Granting those two privileges to the analyst's group fixes the error.

Objectives 2

Official objectives from the Databricks outline, in outline order.

7.1 Demonstrate understanding of Unity Catalog tags and comments as mechanisms for adding metadata to improve discoverabilityLabelling and describing data so people can find it.
What it means
Tags are key-value pairs, or keys alone, attached to catalogs, schemas, tables, views, volumes, models and columns. Comments are text descriptions on the same objects and on columns. Both appear in Catalog Explorer, are searchable, and are queryable through information_schema views.
What to understand
Use tags for structured, filterable facts such as domain, owner team, sensitivity or certification status, and comments for human explanations of meaning and usage. Governed tags restrict values and who may assign them, which matters when tags drive policies. AI-generated comments speed up documentation but should be reviewed. The BROWSE privilege lets users see metadata without reading data, which supports discovery.
How it shows up
A discoverability or documentation problem is described, and you choose tags, comments or a privilege.
Common confusion
Using comments to hold values that should be filterable tags, such as sensitivity level.
7.2 Demonstrate understanding of the Unity Catalog permission inheritance model across catalogs, schemas and objectsHow grants flow down the object hierarchy.
What it means
Unity Catalog objects form a hierarchy: metastore, catalog, schema, then tables, views, volumes, functions and models. A privilege granted on a container applies to all current and future children of the relevant type. Access to any child also requires USE CATALOG and USE SCHEMA on its parents.
What to understand
Granting SELECT on a schema lets the grantee read every table and view in it, including ones created later. There is no DENY, so to exclude one table you grant at a lower level instead. Owners can grant privileges on their objects, and MANAGE lets a principal handle grants without full ownership. Workspace bindings can further limit which workspaces reach a catalog.
How it shows up
Expect a grants list and a question about effective access, or a request to cover future tables.
Common confusion
Expecting a DENY on one table to override a schema-level grant; Unity Catalog does not support DENY.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Tags

    Key-value labels on securables and columns.

    Remember
    Filterable and usable by policies.
    Tested as
    Discoverability questions.
    Trap
    Storing structured facts in comments.

  • Comments

    Free-text descriptions on objects and columns.

    Remember
    Shown in Catalog Explorer and search.
    Tested as
    Documentation questions.
    Trap
    Leaving columns undocumented.

  • Governed tags

    Tags with controlled values and assignment rights.

    Remember
    Needed when tags drive access policies.
    Tested as
    Governance and ABAC links.
    Trap
    Letting anyone edit sensitivity tags.

  • BROWSE privilege

    See object metadata without reading data.

    Remember
    Supports discovery across a catalog.
    Tested as
    Discovery questions.
    Trap
    Granting SELECT just so users can find tables.

  • Downward inheritance

    Grants on a container apply to current and future children.

    Remember
    Grant at schema level to cover new tables.
    Tested as
    Future table questions.
    Trap
    Granting table by table.

  • USE CATALOG and USE SCHEMA

    Required on parents to reach any child object.

    Remember
    Inheritance does not remove this need.
    Tested as
    Access troubleshooting.
    Trap
    Assuming SELECT alone is enough.

  • No DENY

    Unity Catalog grants are additive.

    Remember
    Exclude by granting lower in the tree.
    Tested as
    Exclusion scenarios.
    Trap
    Choosing a DENY option.

  • Ownership and MANAGE

    Owners and MANAGE holders can grant on an object.

    Remember
    Transfer ownership to groups.
    Tested as
    Administration questions.
    Trap
    Leaving ownership with a departed user.

  • information_schema

    SQL views over catalog metadata, tags and privileges.

    Remember
    Query tags and comments programmatically.
    Tested as
    Metadata reporting.
    Trap
    Thinking metadata is only visible in the UI.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Tags vs. comments

ConceptMeaningKey differenceCommon trap
Tags Structured key-value labels Filterable and drive policies Free-form values without governance
Comments Narrative descriptions Explain meaning and usage Used for values that should be filterable

Where to grant

ConceptMeaningKey differenceCommon trap
Catalog level Applies to everything in the catalog Broadest reach including future schemas Over-granting for a narrow need
Schema level Applies to all objects in one schema Covers future tables in that schema Forgetting USE CATALOG on the parent
Object level Applies to one table, view or function Precise, but must be repeated for new objects Used where future tables must be covered

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. DENY exists

    What candidates pick
    Deny SELECT on one table to exclude it.
    Why it looks right
    Other database systems support DENY.
    Why it's wrong
    Unity Catalog has no DENY; grant at a lower level so the excluded table is never covered.

    Clue to watch for An option uses DENY or REVOKE on an inherited privilege.

  2. SELECT is enough

    What candidates pick
    Grant SELECT on a table and stop.
    Why it looks right
    SELECT is the read privilege.
    Why it's wrong
    The user also needs USE CATALOG and USE SCHEMA on the parents to reach the table.

    Clue to watch for The user still gets an error after SELECT is granted.

  3. Grants are static

    What candidates pick
    Grant on each existing table to cover a schema.
    Why it looks right
    It mirrors the current list.
    Why it's wrong
    New tables will be missed; granting on the schema covers current and future tables.

    Clue to watch for The schema keeps getting new tables.

  4. SELECT for discovery

    What candidates pick
    Grant SELECT so users can find datasets.
    Why it looks right
    Users need to see tables.
    Why it's wrong
    BROWSE exposes metadata for discovery without giving data access.

    Clue to watch for Users should find data but request access before reading.

  5. Comments as labels

    What candidates pick
    Store sensitivity levels in table comments.
    Why it looks right
    Comments are easy to edit.
    Why it's wrong
    Comments are not structured or governed; governed tags are filterable and can drive policies.

    Clue to watch for The label must be used for filtering or access rules.

Answer framework

Apply these steps for any Section 7 metadata or permission question.

  1. Decide whether the problem is finding and understanding data, which calls for tags, comments or BROWSE, or reading and changing data, which calls for grants.
  2. For metadata, use tags for structured filterable facts, governed tags when values drive policies, and comments for meaning and usage notes.
  3. For access, find the lowest level in the hierarchy that covers every required object, including future ones, and grant there to a group.
  4. Add USE CATALOG and USE SCHEMA on the parents, since inherited object privileges do not grant the right to traverse containers.
  5. Reject any option that relies on DENY, and exclude objects by restructuring schemas or granting at a lower level instead.

Practice question

A data engineering group must be able to read every table in the finance.reporting schema, including tables created next quarter, but nothing else in the finance catalog. Which grants meet this with least privilege?

Want more like this? The Databricks DE Pro practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Plan a short, focused block for this section and then reuse it while studying Section 6. Start by drawing the Unity Catalog hierarchy from metastore to columns, and mark where each privilege can be granted and what it inherits to.

Next, run a small experiment in a sandbox catalog. Create a schema with two tables, grant SELECT at the schema level to a test group, create a third table, and confirm the group can read it. Remove USE SCHEMA and observe the error. Try granting at table level instead and note how new tables are missed.

For metadata, add tags and comments to a few tables and columns, search for them in Catalog Explorer, and query them from information_schema. Generate an AI comment and edit it. Read how governed tags restrict values and assignment.

Finish with ten quick self-made questions that list grants and ask what a user can do. This section rewards exact rules, so short drills are more useful than long reading here.

FAQ

How much of the exam is Data Governance?

Data Governance is 5% of the scored content, about three questions, tied with Data Modeling as the smallest section.

Does a catalog-level grant cover new schemas?

Yes. Privileges on a catalog inherit to all current and future schemas and objects of the relevant type inside it.

Is there a DENY statement in Unity Catalog?

No. Grants are additive. To keep a user out of one table, grant at the schema or table level that excludes it.

What is the difference between tags and comments?

Tags are structured key-value labels that can be filtered and used by policies. Comments are text descriptions explaining what data means.

What does BROWSE allow?

It lets a principal see an object's metadata in Catalog Explorer and search without reading its data, which helps discovery and access requests.

Why did this section get smaller?

In the October 2026 revision, detailed security controls such as ABAC moved to Ensuring Data Security and Compliance, leaving metadata and inheritance here.

Other Data & Analytics certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 7 knowledge

You have covered tags, comments and the Unity Catalog inheritance model. Check whether you can trace effective access from a grant list quickly.

Take the Databricks DE Pro practice test Check your Databricks DE Pro readiness

Keep going