DATABRICKS-DEP Question 83

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A0

  ,B,C - Correct answer s : A, B, C — A single ABAC policy attached at the catalog level automatically extends to new tables created later in that catalog, as long as those tables carry the tag the policy's `WHEN` clause matches.; Governed tags applied at the catalog level propagate down to schemas and tables beneath it, so a lower-level object inherits the tag unless a more specific tag overrides it closer to the object.; A tag applied to a table does not automatically apply to that table's columns, so column-level ABAC policies require the columns themselves to carry a matching tag. A . This statement is accurate: attaching a policy at the catalog level lets it apply automatically to any table that later acquires the matching tag, which is the core scaling benefit of ABAC over manually attaching filters table by table. B . This statement is accurate: tags follow the catalog-to-schema-to-table hierarchy by default, so an object inherits a tag from its parent unless a more specific tag is set closer to that object. C . This statement is accurate: tags do not flow from a table down to its columns, so a column-level policy condition only matches columns that have been tagged directly, even if the parent table carries a matching tag. D . This statement is inaccurate: ABAC GRANT policies only add privileges when their tag condition is met, and documentation is explicit that they cannot revoke access a principal already holds through a direct grant made outside the policy. E . This statement is inaccurate: DENY policies are currently limited in scope to the `MANAGE ACCESS CONTROL` privilege, so they do not universally override every GRANT regardless of which privilege is involved. F . This statement is inaccurate: row filter and column mask policies apply to table-level securables such as tables, materialized views, and streaming tables, not to volumes or registered models.