Check Your Knowledge

Test your understanding of ABAC, governed tags, dynamic views, tag-based masking, and cross-engine governance before moving on to the cost iceberg.

  1. What is the core difference between a traditional Unity Catalog row filter/column mask and an ABAC policy? A. ABAC only works on views, never on base tables B. An ABAC policy targets a tag condition, applying to every current and future object carrying that tag, instead of one named object C. ABAC policies cannot use SQL functions D. There is no difference; they are the same feature under different names

  2. Why does the lecture recommend applying governed tags at the schema level rather than the table level? A. Table-level tags are not supported in Unity Catalog B. Schema-level tags inherit down to every table underneath automatically, avoiding per-table tagging sprawl C. Schema-level tags are required for row filters to function at all D. Table-level tags cost more in compute

  3. Which object type is the one exception that must always be tagged directly rather than inheriting a tag from its parent? A. Catalogs B. Schemas C. Columns D. Metastores

  4. What problem do dynamic views solve that a family of forty-seven near-duplicate per-audience views does not? A. They eliminate the need for any access control B. They replace hand-copied, drifting WHERE clauses with one view whose filter reads the querying user’s identity at run time C. They run faster than any base table query D. They remove the need for Unity Catalog grants entirely

  5. What is the main advantage of a native table-level row filter over a dynamic view for the same access rule? A. It is enforced even for queries that read the base table directly, bypassing any view B. It supports more SQL syntax than a view C. It does not require a SQL function D. It is the only option that works with Delta Sharing

  6. Why is tag-based column masking more resilient than manually applying SET MASK to individual columns? A. It removes the need for any masking function B. A new column added later is automatically covered the moment it carries the matching tag, with no follow-up migration step C. It only works on numeric columns D. It disables masking for admin accounts by default

  7. In the tiered masking function pattern, what determines whether a user sees a full value, a partially masked value, or a fixed redaction string? A. The time of day the query runs B. The user’s account group membership, checked inside the masking function C. The name of the catalog being queried D. Whether the query uses a view or a base table

  8. What is credential vending, and why does it matter for cross-engine access? A. It issues short-lived, scoped cloud credentials only after Unity Catalog checks grants, row filters, and masks – preserving governance for external engines B. It is a billing feature unrelated to security C. It permanently grants an external engine the workspace admin role D. It replaces the need for Delta Sharing entirely

  9. When sharing data with an external engine, what is the biggest governance risk described in the cross-engine access lecture? A. Sharing the governed, already-masked view instead of the raw base table B. Sharing the raw base table instead of a governed, filtered/masked object, recreating a storage-layer bypass C. Using the Iceberg REST catalog instead of Delta Sharing D. Granting credential vending to too few users

  10. Why does the tag taxonomy need to be defined in version-controlled code before rollout, rather than tagged ad hoc per team? A. Ad hoc tagging is technically blocked by Unity Catalog B. Inconsistent tag spellings (pii=true vs PII=Y vs sensitive=pii) defeat exact-match policy conditions and recreate the sprawl a governed taxonomy is meant to prevent C. Version control is required for Delta Sharing to function D. Governed tags cannot be applied through a notebook

Answer Key

  1. B – ABAC policies match on a tag condition, so they automatically cover every object, present or future, that carries the tag.
  2. B – Tags applied at the schema level are inherited by every table underneath, avoiding the need to tag each table individually.
  3. C – Because sensitivity varies column by column within a table, column tags must always be applied directly rather than inherited.
  4. B – A dynamic view centralizes the per-audience filter into one definition evaluated per query, eliminating drift across duplicate views.
  5. A – A row filter binds to the base table itself, so it’s enforced regardless of whether the query goes through a view.
  6. B – Because the mask is triggered by a tag rather than a specific column, any newly added column carrying that tag is covered immediately.
  7. B – The masking function checks is_account_group_member() (or similar) to decide which disclosure tier to return.
  8. A – Credential vending issues time-limited, scoped credentials only after Unity Catalog validates access, so external engines still respect governance.
  9. B – Sharing the raw, ungoverned table bypasses the row filters and masks that would otherwise apply, rebuilding the storage-bypass problem one layer up.
  10. B – Free-text, inconsistent tag values break exact-match policy conditions, reintroducing the same sprawl tags were meant to eliminate.

| ← Previous: The ABAC Tag Taxonomy and Masking Policy Pack | Next: The Cost Iceberg and Compute Arbitrage → | |:—|—:|

Back to top

Independent, self-authored Databricks companion notes.

This site uses Just the Docs, a documentation theme for Jekyll.