DATABRICKS-DEA Question 117

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A0

  - Correct answer : A — Add an `EXCEPT compliance_team` clause to the policy's principal list, so the masking function is skipped whenever a member of that group runs the query. A . This is correct: the `EXCEPT` clause in a policy's principal list exempts named principals from the masking or filtering behavior, so the compliance team sees the unmodified column value while everyone else still sees the masked one. B . This is incorrect. Stacking a second masking policy for every group does not create a targeted exception for one team, and relying on implicit override behavior between overlapping policies is not how exceptions are expressed. C . This is incorrect. Write privileges like `MODIFY` govern the ability to change data, not whether a read-time column mask policy is applied; masking exceptions are controlled through the policy's principal clause, not table privileges. D . This is incorrect. A `WHEN` clause in `CREATE POLICY` scopes which tagged tables the policy applies to, not which principals are exempt; principal exceptions belong in the `TO`/`EXCEPT` clause instead.