Discuss Databricks Databricks Certified Data Engineer Professional Exam Topic 5 Question 26

The data architect has decided that once data has been ingested from external sources into the

Databricks Lakehouse, table access controls will be leveraged to manage permissions for all production tables and views.

The following logic was executed to grant privileges for interactive queries on a production database to the core engineering group.

GRANT USAGE ON DATABASE prod TO eng;

GRANT SELECT ON DATABASE prod TO eng;

Assuming these are the only privileges that have been granted to the eng group and that these users are not workspace administrators, which statement describes their privileges?

AGroup members have full permissions on the prod database and can also assign permissions to other users or groups.

BGroup members are able to list all tables in the prod database but are not able to see the results of any queries on those tables.

CGroup members are able to query and modify all tables and views in the prod database, but cannot create new tables or views.

DGroup members are able to query all tables and views in the prod database, but cannot create or edit anything in the database.

EGroup members are able to create, query, and modify all tables and views in the prod database, but cannot define custom functions.

Suggested Answer: D

The GRANT USAGE ON DATABASE prod TO eng command grants the eng group the permission to use the prod database, which means they can list and access the tables and views in the database. The GRANT SELECT ON DATABASE prod TO eng command grants the eng group the permission to select data from the tables and views in the prod database, which means they can query the data using SQL or DataFrame API. However, these commands do not grant the eng group any other permissions, such as creating, modifying, or deleting tables and views, or defining custom functions. Therefore, the eng group members are able to query all tables and views in the prod database, but cannot create or edit anything in the database.Reference:

Grant privileges on a database: https://docs.databricks.com/en/security/auth-authz/table-acls/grant-privileges-database.html

Privileges you can grant on Hive metastore objects: https://docs.databricks.com/en/security/auth-authz/table-acls/privileges.html

Get Premium Databricks Certified Data Engineer Professional Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Yuette 10 months ago

Just listing tables without seeing results sounds weird.

Susana 11 months ago

I thought they could modify tables too? Seems odd.

Kristian 11 months ago

Wait, how can they query but not see results? That doesn't add up.

Hermila 11 months ago

Definitely D, makes sense with the permissions given.

Shawna 11 months ago

They can query all tables but can't create or edit anything.

Charolette 12 months ago

I’m not entirely sure, but I feel like they can query the tables with SELECT, so maybe D is correct? I just hope I remember the details right!

Chauncey 12 months ago

This question feels similar to one we practiced where we discussed permissions. I think option D sounds right since they can query but not create or edit.

Mammie 12 months ago

I think the SELECT privilege means they can query the tables, but I'm confused about whether they can modify anything.

Ciara 1 year ago

I remember that granting USAGE allows users to access the database, but I'm not sure if they can see query results without SELECT on tables.

Filiberto 1 year ago

I'm feeling pretty confident about this one. Based on the information provided, option D seems to be the correct answer. The eng group members can query the tables and views in the prod database, but they don't have any administrative or modification privileges.

Blondell 1 year ago

I'm a bit confused here. The wording in the options is a bit tricky, and I'm not sure if I fully understand the implications of the USAGE and SELECT privileges. I'll need to double-check my understanding before selecting an answer.

Lauryn 1 year ago

I think the answer is D. The question says the eng group members are not workspace administrators, so they can't assign permissions to other users or groups. And the privileges granted only allow them to query the tables and views, not create or modify anything.

Theron 1 year ago

Okay, let's see. The question states that the only privileges granted are USAGE and SELECT on the prod database. So the eng group members should have read-only access to the tables and views in that database.

Denise 1 year ago

Hmm, this one seems a bit tricky. I'll need to carefully read through the question and the options to understand the exact permissions granted to the eng group.

Carman 2 years ago

I'm not sure, but I think the answer might be E.

Isaiah 2 years ago

I disagree, I believe the answer is D.

Garry 2 years ago

I think the answer is C.

Micheline 2 years ago

D has to be the answer. Granting 'SELECT' without 'CREATE' or 'ALTER' is just cruel, like giving a dog a treat but not letting it play fetch. Poor engineers, they're basically just data janitors at this point.

Cristal 2 years ago

Option D sounds like the winner to me. I mean, if they can't even create new tables or views, what's the point of being in the 'core engineering group'? They must be feeling pretty powerless right now.

Anglea 2 years ago

↳ replying to Cristal

Definitely, it helps maintain data integrity and security.

Jerry 2 years ago

↳ replying to Cristal

It's important to have some level of control over who can create or edit tables.

Jess 2 years ago

↳ replying to Cristal

Yeah, it does seem like they have some restrictions in place.

Jacklyn 2 years ago

↳ replying to Cristal

I agree, option D seems to limit their abilities quite a bit.

Chantay 2 years ago

Hmm, this is a tricky one. I was going to say C, but after re-reading the question, I think D is the right answer. They can't do anything except view the data, which is a bit disappointing for the core engineering group.

Ernest 2 years ago

↳ replying to Chantay

Definitely. It's better to have limited access than risk unauthorized modifications to the data.

Sherita 2 years ago

↳ replying to Chantay

It's important to have strict access controls in place to protect the data in the database.

Domingo 2 years ago

↳ replying to Chantay

Yeah, I agree. It seems like they have limited permissions despite being part of the core engineering group.

Leanna 2 years ago

↳ replying to Chantay

I think D is the correct answer. They can query tables but not create or edit anything in the database.

Valda 2 years ago

I think the correct answer here is D. The granted privileges only allow the eng group to query all tables and views in the prod database, but they don't have the ability to create, edit, or modify anything.

Iluminada 2 years ago

↳ replying to Valda

Exactly. It's important to manage permissions carefully in a production environment.

Paris 2 years ago

↳ replying to Valda

So they can't create new tables or views, just view existing data.

Santos 2 years ago

↳ replying to Valda

That makes sense. They can query tables but not make any changes.

Danilo 2 years ago

↳ replying to Valda

I think the correct answer here is D.

Databricks Certified Data Engineer Professional Exam - Topic 5 Question 26 Discussion