Databricks Certified Data Engineer Associate Practice Questions: Data Governance and Security Domain

A) Configuring database encryption for all customer tables

B) Defining business-approved rules for how customer address data must be validated and corrected

C) Restricting VPN access to the corporate network to approved devices

D) Enforcing multi-factor authentication for all analytics users

A) Implement cost and usage monitoring with alerts and per-team budgets for serverless workloads, then review and optimize the most expensive and highly concurrent queries.

B) Disable row-level security and masking policies to reduce overhead, assuming this will lower serverless costs and reduce throttling.

C) Switch all workloads from serverless to a single large provisioned cluster without monitoring, assuming fixed capacity will automatically control cost and performance.

D) Increase serverless concurrency limits indefinitely so that all queries run immediately, which will eliminate throttling and reduce cost per query.

A) Revoke or delete the open recipient associated with the vendor so they can no longer query the shared data.

B) Delete the underlying Unity Catalog tables so the vendor cannot access any of the data they previously received.

C) Change the storage location of the underlying Delta tables so that the vendor’s existing credentials no longer work.

D) Rotate the vendor’s open recipient token but keep the share and recipient active so they can still query historical data only.

A) Publishing a slide deck explaining the four classification levels to all employees

B) Requiring that all "Confidential" tables, including customer transactions, are encrypted at rest and have access limited to specific roles

C) Renaming all "Confidential" tables with a CONF_ prefix in the database

D) Archiving all "Confidential" data to cheaper storage to reduce infrastructure costs

A) Increase warehouse compute resources so that queries run faster and reduce user frustration

B) Assign data stewards and data owners to critical domains to define standard business definitions, data quality rules, and accountability

C) Turn off the data catalog because incomplete metadata is confusing users

D) Grant all users administrative access so they can fix data issues directly in the warehouse

A) Remove all access to sensitive data from actuaries and require them to request extracts from IT for each analysis

B) Keep actuaries as administrators but require them to log all access changes in a shared spreadsheet for transparency

C) Separate duties by revoking administrative privileges from actuaries, keeping their analytical data access via roles, and assigning access administration to a designated technical or security team

D) Do nothing, because actuaries need flexibility and are trusted professionals

A) Approve the proposal because hashing the patient IDs makes the data anonymous and compliant

B) Reject the proposal and require full anonymization so that individuals cannot be re-identified, even when combined with other attributes

C) Approve the proposal but add encryption at rest to the test environment to ensure anonymity

D) Approve the proposal as long as access to the test environment is restricted to data scientists

A) Provide the full dataset as-is since the partner is under contract and uses secure networks

B) Replace patient IDs with randomly generated tokens that only the hospital can map back to real identities

C) Mask all diagnosis codes with generic placeholders such as 'Condition A', 'Condition B', etc.

D) Remove only names and addresses and keep the original patient IDs for easier analysis

A) The infrastructure/DBA team, because they control the physical databases

B) The cloud provider, because they host the data platform

C) A designated business data owner from the customer operations or product area

D) The data engineering team, because they design the data pipelines

A) Run ELT pipelines on serverless compute using a dedicated service principal with only the required data permissions, keep all existing governance policies on the datasets, and define monitoring and alerting for job duration and resource usage.

B) Run ELT pipelines on serverless compute using a highly privileged shared admin account so that permissions do not block any transformations, and disable masking to simplify access.

C) Keep all ELT pipelines on provisioned clusters because serverless cannot use managed identities or service principals and cannot support existing governance controls.

D) Move ELT pipelines to serverless compute and rely on serverless to automatically optimize performance and enforce all necessary governance, so explicit RBAC and row-level security are no longer needed.