Governance and Security

What this chapter covers

Governance and Security is 15% of the Databricks Data Engineer Associate exam. It covers how Unity Catalog stores tables and controls who can see and change them, down to individual rows and columns.

The chapter has two parts: managed and external tables with the privileges that protect them, and fine grained controls: row filters, column masks and attribute based access control (ABAC) policies.

Questions are mostly short scenarios in which the stated requirement (latency, cost, governance, data volume) decides the answer. They are single-answer multiple choice, with short SQL or PySpark shown as text. There are no exhibits.

How the topics fit together

Unity Catalog organizes data in a three level namespace, catalog.schema.table. Privileges granted at a level are inherited by the objects below it. Inside a table, row filters and column masks decide which rows and values each user sees, either per table or centrally through ABAC policies driven by governed tags.

• Table questions ask whether a table is managed or external, what DROP does to its files and how to convert one into the other.
• Privilege questions ask which privileges a principal needs, at which level to grant them and how to remove them.
• Row and column questions ask whether a row filter, a column mask or an ABAC policy fits the requirement.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with tables and examples.
• What to remember for the exam: the facts to memorize and how questions are phrased.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.