SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
Databricks DEA · Domain 7

Governance and Security practice questions

Governance and Security is worth 15% of the Databricks DEA exam — the 4th-heaviest of the 7 domains. Unity Catalog governance: managed versus external tables, GRANT/REVOKE/DENY across the securable hierarchy, column masking and row-level security, and ABAC policies for central filtering and masking. 6 fully worked examples are further down this page, answers included.

Exam weight
15%
the 4th-heaviest of the 7 domains
Questions
77
across 2 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 7 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Governance and Security questions, fully explained

Questions from the Databricks DEA bank mapped to domain 7, with the answer key and the reasoning behind every option. None of them repeat the examples on the main Databricks DEA practice page.

Question 1Governance and Security

Partner teams run Spark outside Databricks and read Parquet files directly from s3://partner-share/orders/, a path covered by a Unity Catalog external location. Databricks analysts must now query the same data as a table, with access controlled by table grants. The files must stay where they are. What should the data engineer create?

Choose one.

  • a
    A managed table loaded from s3://partner-share/orders/ with CTAS

    CTAS copies the data into managed storage. The partners would keep reading the old files, so there would be two diverging copies.

  • b
    A managed volume holding a copy of the files in s3://partner-share/orders/

    A managed volume moves copies of the files into managed storage and governs file access, not table queries with table grants.

  • c
    An external table whose LOCATION is s3://partner-share/orders/ Correct

    Correct. An external table registers the existing files in Unity Catalog for SQL and table grants while the files stay at their path for the outside readers.

  • d
    An external volume over s3://partner-share/orders/ for querying by path

    An external volume governs file-level access to the path, but it is not a table, so table grants and SQL over a table name do not apply.

The concept

External tables govern data files that live at a path you control, including files other engines read directly.

Why that’s the answer

Two requirements decide: the files stay in place for engines outside Databricks, and analysts need a table governed by table grants. An external table with LOCATION on that path meets both. Copying into a managed table or managed volume moves the data, and an external volume governs files rather than a table.

How to reason it out
  1. Note that the files must stay where outside engines read them.
  2. Note that analysts need a table with table grants.
  3. An external table over the existing path satisfies both.
  4. Reject options that copy the data or govern only files.

Exam tip: Data that outside engines read in place belongs in an external table.

Unity Catalog Managed vs External Tables, GRANT, REVOKE and DENY (Databricks Data Engineer Associate) — the lesson that teaches this.

Question 2Governance and Security

Twelve days ago a data engineer ran DROP TABLE on main.raw.clicks, an external Delta table at s3://lake/raw/clicks/. The schema uses the default recovery period. The table is needed again with its full history, and the bucket's lifecycle rules have not removed anything. What should the engineer do?

Choose one.

  • a
    Create the table again with its LOCATION set to s3://lake/raw/clicks/ Correct

    Correct. Dropping an external table removes only its metadata, so the Delta files and log are still at the path and a new external table over it brings back the data and history.

  • b
    Run UNDROP TABLE main.raw.clicks to restore the table and its files

    UNDROP only works within the recovery period, 7 days by default, and twelve days have passed.

  • c
    Run RESTORE TABLE main.raw.clicks to the version before the drop

    RESTORE rolls back an existing table to an earlier version. The table no longer exists in the catalog, so there is nothing to restore.

  • d
    Recover the deleted files at s3://lake/raw/clicks/ from bucket versioning

    Nothing was deleted. Dropping an external table leaves its files in place, so there is nothing to recover from versioning.

The concept

DROP TABLE on an external table removes the metadata only; the data files stay at the LOCATION.

Why that’s the answer

Unity Catalog does not manage an external table's files, so DROP leaves the Delta log and data at the path. Re-registering the path with CREATE TABLE ... LOCATION brings the table back with its history. UNDROP is tempting, but the default recovery period of 7 days has passed, and RESTORE needs an existing table.

How to reason it out
  1. Identify the table type: external.
  2. Recall that dropping an external table leaves its files.
  3. Check whether UNDROP still applies: twelve days is past the default period.
  4. Re-create the table over the same path.

Exam tip: Dropped external table: the files survive, so a new table over the same LOCATION brings it back.

Unity Catalog Managed vs External Tables, GRANT, REVOKE and DENY (Databricks Data Engineer Associate) — the lesson that teaches this.

Question 3Governance and Security

A compliance analyst asks what happens to the data files of a Unity Catalog managed table, main.hr.reviews, when its owner runs DROP TABLE main.hr.reviews. The catalog and schema use the default settings. Which statement is accurate?

Choose one.

  • a
    They are deleted from cloud storage when the DROP statement commits

    Deletion is not immediate. The files are kept for the recovery period so the table can be undropped.

  • b
    They stay in managed storage until an engineer deletes them manually

    That describes an external table. For a managed table, Databricks deletes the files itself after the recovery period.

  • c
    They can be recovered with UNDROP for a period, then are deleted Correct

    Correct. A dropped managed table can be restored with UNDROP during the recovery period (7 days by default); after that Databricks deletes the files from cloud storage.

  • d
    They are kept for time travel until VACUUM runs with zero retention

    VACUUM works on an existing table. After DROP the table is gone and file removal follows the recovery period, not a VACUUM run.

The concept

Dropping a managed table schedules deletion of its files after the UNDROP recovery period.

Why that’s the answer

Unity Catalog owns a managed table's files. DROP TABLE marks the table dropped; it stays recoverable with UNDROP for the recovery period, which is 7 days by default and configurable on the catalog or schema, and then Databricks deletes the files. Leaving the files behind is external-table behaviour.

How to reason it out
  1. Identify the table type: managed.
  2. Recall that managed files are deleted by Databricks, not by you.
  3. Recall the recovery period that allows UNDROP first.
  4. Pick the statement with recovery first, then deletion.

Exam tip: Managed table dropped: recoverable for a while, then its files are deleted for you.

Unity Catalog Managed vs External Tables, GRANT, REVOKE and DENY (Databricks Data Engineer Associate) — the lesson that teaches this.

Question 4Governance and Security

Yesterday a data engineer dropped the managed table main.sales.orders by mistake. No table with that name has been created since, and the catalog and schema use the default recovery settings. The team wants the table back with its data and history as quickly as possible. What should the engineer run?

Choose one.

  • a
    RESTORE TABLE main.sales.orders TO VERSION AS OF 0

    RESTORE needs an existing table to roll back. The table was dropped, so the statement has nothing to act on.

  • b
    CREATE TABLE main.sales.orders DEEP CLONE main.sales.orders

    A clone needs an existing source table; the dropped table cannot be cloned until it is restored.

  • c
    UNDROP TABLE main.sales.orders Correct

    Correct. UNDROP restores a dropped Unity Catalog table within the recovery period, 7 days by default.

  • d
    MSCK REPAIR TABLE main.sales.orders SYNC METADATA

    MSCK REPAIR re-syncs metadata for an existing external table. It does not bring back a dropped table.

The concept

UNDROP TABLE restores a dropped Unity Catalog table within the recovery period.

Why that’s the answer

One day is inside the default recovery period, so UNDROP TABLE brings back the managed table with its data and history. RESTORE and DEEP CLONE both need a table that exists, and MSCK REPAIR only re-syncs metadata of an existing external table.

How to reason it out
  1. Note the table was dropped one day ago.
  2. Recall the default recovery period of 7 days.
  3. Use UNDROP TABLE on the name.
  4. Reject statements that need an existing table.

Exam tip: Dropped within the recovery period? UNDROP TABLE.

Unity Catalog Managed vs External Tables, GRANT, REVOKE and DENY (Databricks Data Engineer Associate) — the lesson that teaches this.

Question 5Governance and Security

On Monday a data engineer dropped the managed table main.sales.orders. On Tuesday the same engineer created a new main.sales.orders and dropped it on Wednesday. On Thursday the business needs the table that was dropped on Monday, not the later one. Both are within the recovery period. What should the engineer do?

Choose one.

  • a
    Run UNDROP TABLE main.sales.orders twice to reach Monday's table

    UNDROP by name targets the most recently dropped table. Once it is restored, a second UNDROP by that name fails because a table with that name now exists.

  • b
    Run UNDROP TABLE main.sales.orders, then RESTORE it to version 0

    This brings back Wednesday's table. Its history started on Tuesday, so no version of it holds Monday's data.

  • c
    Find its table ID with SHOW TABLES DROPPED, then UNDROP TABLE WITH ID Correct

    Correct. When several dropped tables share a name, SHOW TABLES DROPPED lists their IDs and UNDROP TABLE WITH ID restores the specific one.

  • d
    Find its table ID with DESCRIBE HISTORY, then UNDROP TABLE WITH ID

    DESCRIBE HISTORY needs an existing table and shows commit versions, not dropped tables' IDs.

The concept

UNDROP TABLE WITH ID recovers a specific dropped table when several share a name.

Why that’s the answer

Undropping by name restores the latest dropped table with that name, which is Wednesday's. The Monday table is a different table with its own ID; SHOW TABLES DROPPED IN main.sales lists the dropped tables with their IDs and UNDROP TABLE WITH ID restores the one needed. Wednesday's table has a separate history, so restoring it to an old version cannot reach Monday's data.

How to reason it out
  1. Note that two dropped tables share the name.
  2. Recall that UNDROP by name takes the latest drop.
  3. List dropped tables and their IDs with SHOW TABLES DROPPED.
  4. Restore the right one with UNDROP TABLE WITH ID.

Exam tip: Same name dropped twice: SHOW TABLES DROPPED, then UNDROP TABLE WITH ID.

Unity Catalog Managed vs External Tables, GRANT, REVOKE and DENY (Databricks Data Engineer Associate) — the lesson that teaches this.

Question 6Governance and Security

The group data-eng holds USE CATALOG on main and USE SCHEMA and CREATE TABLE on main.bronze. A member runs CREATE TABLE main.bronze.vendors ... LOCATION 's3://raw-zone/vendors/' and gets a permission error. The path is covered by the external location raw_zone. Which grant fixes it with the least access?

Choose one.

  • a
    GRANT READ FILES ON EXTERNAL LOCATION raw_zone TO `data-eng`

    READ FILES lets the group read files at the path directly, but it does not allow registering a table there.

  • b
    GRANT CREATE EXTERNAL TABLE ON EXTERNAL LOCATION raw_zone TO `data-eng` Correct

    Correct. Creating an external table needs CREATE EXTERNAL TABLE on the external location that covers the path, in addition to the schema privileges the group already has.

  • c
    GRANT WRITE FILES ON EXTERNAL LOCATION raw_zone TO `data-eng`

    WRITE FILES allows writing files by path. It still does not allow creating an external table on the location.

  • d
    GRANT CREATE MANAGED STORAGE ON EXTERNAL LOCATION raw_zone TO `data-eng`

    CREATE MANAGED STORAGE lets a catalog or schema use the location as its managed storage; it has nothing to do with external tables.

The concept

An external table needs CREATE EXTERNAL TABLE on the external location plus USE CATALOG, USE SCHEMA and CREATE TABLE.

Why that’s the answer

The group already has the schema-side privileges, so the missing piece is on the storage side. CREATE EXTERNAL TABLE on the external location is the privilege that allows registering a table at a path it covers. READ FILES and WRITE FILES govern direct file access, and CREATE MANAGED STORAGE is for catalog or schema managed locations.

How to reason it out
  1. Check the schema-side privileges: already held.
  2. Identify the statement as an external table (LOCATION clause).
  3. Recall the external location privilege it requires.
  4. Grant CREATE EXTERNAL TABLE on raw_zone.

Exam tip: External table = CREATE TABLE on the schema + CREATE EXTERNAL TABLE on the external location.

Unity Catalog Managed vs External Tables, GRANT, REVOKE and DENY (Databricks Data Engineer Associate) — the lesson that teaches this.

What Databricks DEA domain 7 tests, topic by topic

The official exam guide breaks Governance and Security into 2 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published Databricks DEA practice questions per topic in Governance and Security
TopicWhat it coversQuestions
Managed vs External Tables and Access ControlOfficial exam-guide objectives (Section 7): "Differentiate between managed and external tables in Unity Catalog and perform basic operations (create, modify, delete, and convert between managed and external tables) on them." "Configure access controls using the UI and SQL by applying GRANT, REVOKE, and DENY privileges to principals (users, groups, and service principals) at appropriate levels of the security hierarchy."38
Column Masking, Row Filters and ABAC PoliciesOfficial exam-guide objectives (Section 7): "Understand column-level masking and row-level security to restrict data visibility based on user groups." "Understand Unity Catalog ABAC policies to centrally control row-level filtering and column masking for sensitive data."39
Total77

Revise Governance and Security before you drill it

Unity Catalog Managed vs External Tables, GRANT, REVOKE and DENY (Databricks Data Engineer Associate)Expect scenarios in which a data engineer must meet a stated requirement: files that must stay at a path for an outside engine, data that must stay managed, least privilege, access that must cover future tables or schemas, or a steward who must not get data access. Items ask which table type, statement, privilege set or grant level fits, or why an operation failed or left access in place. Harder items combine two facts, such as a conversion that fails on both ownership and runtime, an UNDROP that needs an extra storage privilege, a MERGE that needs SELECT alongside MODIFY, or a REVOKE defeated by inheritance where DENY is not available, and the options are near-twins that differ in one privilege, level or command.Unity Catalog Row Filters, Column Masks and ABAC Policies (Databricks Data Engineer Associate)Expect scenarios in which a data engineer must restrict what a group or user sees under a stated constraint: the table must keep its name, queries cannot change, no copies, no group per value, least privilege, owners must not bypass the rule, or a cluster must stay on its access mode and runtime. Items ask which mechanism fits (row filter, column mask, dynamic view or ABAC policy), which statement or clause attaches it, which privilege is missing, which compute change is needed, or what a user sees given a function's code. Harder items combine two facts, such as a shared function that must change for one table only, a mapping table that gained its own filter, a pipeline identity storing masked data, a catalog tag that widened a policy, or two policies that conflict, and the options are near-twins that differ in one clause, privilege or runtime.

Other Databricks DEA domains

Domain 2: Data Ingestion and Loading21% of the exam · 108 questionsDomain 3: Data Transformation and Modeling22% of the exam · 114 questionsDomain 4: Working with Lakeflow Jobs16% of the exam · 84 questionsAll Databricks DEA practice questionsMixed sessions across all 7 domains — the way the real exam interleaves them.

Governance and Security: your questions

Governance and Security is domain 7 of the Databricks DEA exam guide and carries 15% of the scored content — the 4th-heaviest of the 7 domains. On a 45-question paper that works out to roughly 7 questions, though Databricks does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official Databricks DEA exam guide.