Databricks DE Professional: security and governance
Ensuring Data Security and Compliance (8%) and Data Governance (5%) are 13% of the Databricks Data Engineer Professional exam between them in the outline that applies from 9 October 2026: around 8 of the 60 scored questions.
This page used to cover a third section, Data Sharing and Federation. The October 2026 outline folded sharing, Clean Rooms and Lakehouse Federation into ingestion, so they are now explained on the ingestion, manipulation and modelling page.
Two small sections that candidates routinely under-prepare because each looks negligible alone. Together they are worth more than either Monitoring or Debugging.
Security and compliance (8%)
About five questions on five objectives:
- Least-privilege access control on Unity Catalog securables and on workspace resources such as jobs, notebooks and clusters.
- Attribute-based access control (ABAC). Policies that apply row filters and column masks based on governed tags, so a column tagged as sensitive is masked wherever it appears instead of each table getting its own hand-written filter. This is the “at scale” answer.
- Anonymisation and pseudonymisation of confidential data: hashing, tokenisation, suppression and generalisation, typically delivered through column masks.
- PII detection and masking across batch and streaming pipelines, with Unity Catalog features rather than custom code in every job.
- Data purging for retention and deletion obligations such as a GDPR erasure request.
The recurring answer: restrict in place, do not copy. A second table without the sensitive column drifts, doubles storage and multiplies the governance problem. A mask or a tag-driven policy solves it once.
Purging is the one people get wrong. Deleting the current row is not enough. A Delta DELETE leaves the row in older table versions until VACUUM removes files past the retention period, and with deletion vectors enabled the row stays in the data file until the file is rewritten (REORG TABLE ... APPLY (PURGE)) and the old files vacuumed. Downstream copies, and any change data feed consumers, need the same treatment.
Data governance (5%)
About three questions on two objectives:
- Tags and comments as metadata on securable objects, so people can find the right table in search and Catalog Explorer instead of building their own copy.
- The permission inheritance model. A privilege granted on a catalog applies to its schemas and their tables, and on a schema to the objects in it. Reading a table also needs
USE CATALOGandUSE SCHEMAon its parents, a frequent cause of “I was granted SELECT but still cannot query it”.
Lineage is still useful for impact analysis before a change, but the 2026 outline does not name it as an objective.
Sample questions
Question 1. A company tags every column that holds personal data with a governed tag. Security wants those columns masked for all non-privileged users across hundreds of tables, including tables created next month. What is the most scalable approach?
- A. An attribute-based access control policy that masks columns carrying the tag
- B. A column mask function attached to each table by hand
- C. Filtered copies of each table without the personal columns
- D. A written policy telling users not to query personal columns
Show answer
Answer: A
An ABAC policy keyed on the governed tag applies the mask wherever the tag appears, including on new tables, without per-table work. Per-table masks do not scale and miss new tables, filtered copies drift and double storage, and a written policy enforces nothing.
Want more questions like this? Full Data Engineer Pro practice tests →
Question 2. Analysts need a customer table, but must not see the column containing payment card data. What is the appropriate implementation?
- A. Maintain a separate copy of the table without that column
- B. Deny access to the table entirely
- C. Column-level access control or masking in Unity Catalog
- D. A written policy instructing analysts not to query the column
Show answer
Answer: C
Column-level access control or masking restricts the sensitive column while leaving the rest of the table usable, applied once and consistently. A filtered copy drifts from source and doubles governance effort, denying the whole table blocks legitimate work, and relying on policy alone enforces nothing.
Want more questions like this? Full Data Engineer Pro practice tests →
Question 3. An analyst was granted SELECT on a table but gets a permission error when querying it. Which missing privileges are the most likely cause?
- A. MODIFY on the table
- B. Ownership of the table
- C. Workspace administrator rights
- D. USE CATALOG and USE SCHEMA on the table’s parents
Show answer
Answer: D
Unity Catalog requires USE CATALOG and USE SCHEMA on the parent objects in addition to SELECT on the table. MODIFY is for writing, ownership is not needed to read, and workspace admin is unrelated to data privileges in Unity Catalog.
Want more questions like this? Full Data Engineer Pro practice tests →
What to practise
Apply a column mask to one table and query it as a restricted user. Then tag a column with a governed tag and write an ABAC policy that masks it. Finally, delete a row from a Delta table with deletion vectors, and work out which commands actually remove it from storage.
Three exercises for two small sections that together are worth more than most people give them.