Databricks DE Professional: security and governance
Ensuring Data Security and Compliance (10%), Data Governance (7%) and Data Sharing and Federation (5%) are 22% of the Databricks Data Engineer Professional exam between them — around 13 of the 59 scored questions.
Three small sections that candidates routinely under-prepare because each looks negligible alone. Together they are worth more than the optimisation section.
Security and compliance (10%)
- Encryption at rest and in transit, and which parts you control.
- Access control at depth: the Unity Catalog privilege model, inheritance down the catalog–schema–table hierarchy, and least privilege in practice.
- Sensitive data: identifying it, masking it, and applying column-level and row-level restrictions rather than duplicating tables.
- Audit — a record of who accessed what and when, sufficient to answer a compliance question months later.
- Compliance obligations: retention requirements, data residency, and the right to have personal data deleted.
The recurring answer: restrict in place, do not copy. A second table without the sensitive column drifts, doubles storage and multiplies the governance problem. Column masking solves it once.
Data governance (7%)
About four questions, mostly Unity Catalog beyond the basics:
- Lineage — what a table was built from and what depends on it. The answer to any impact-analysis question before a change.
- Ownership — every object has an accountable owner.
- Discovery — people finding the right table rather than building their own copy.
- Policies applied consistently across workspaces rather than per-object exceptions.
- Managing governance as the estate grows, where ad-hoc grants stop scaling.
Data sharing and federation (5%)
About three questions on the two ways to give access without moving data.
Delta Sharing — sharing data with people outside your organisation without copying it or giving them workspace access. The recipient reads live data through the share. The exam scenario is always a partner, supplier or customer who needs data you do not want to export.
Federation — querying data that lives in an external system without ingesting it first. Useful when a copy would be stale, redundant or prohibited.
The distinction: sharing is outbound — your data, their access. Federation is inbound — their data, your queries. Questions offer both.
Both exist to avoid the default bad answer: exporting a copy. A copy is stale the moment it is made, doubles storage, and creates a governance object nobody tracks.
Sample questions
Question 1. A partner organisation needs ongoing read access to three tables. They must not have workspace accounts, and the data must not be exported to a location you no longer control. Which approach fits?
- A. A nightly export to a shared cloud storage bucket
- B. Delta Sharing with the partner organisation
- C. Create workspace accounts for the partner’s analysts
- D. A scheduled extract emailed to the partner
Show answer
Answer: B
Delta Sharing gives an external organisation live read access without workspace accounts and without exporting copies, which matches both constraints. A nightly export creates uncontrolled copies, partner accounts grant workspace access, and emailed extracts are both stale and uncontrolled.
Question 2. Analysts need a customer table, but must not see the column containing payment card data. What is the appropriate implementation?
- A. Maintain a separate copy of the table without that column
- B. Deny access to the table entirely
- C. Column-level access control or masking in Unity Catalog
- D. A written policy instructing analysts not to query the column
Show answer
Answer: C
Column-level access control or masking restricts the sensitive column while leaving the rest of the table usable, applied once and consistently. A filtered copy drifts from source and doubles governance effort, denying the whole table blocks legitimate work, and relying on policy alone enforces nothing.
Question 3. Before deprecating a widely used silver table, an engineer must identify every downstream table, job and dashboard that depends on it. Which capability provides this?
- A. Unity Catalog lineage
- B. Delta Lake time travel on the table
- C. Job run history for the past ninety days
- D. Emailing all teams to ask whether they use it
Show answer
Answer: A
Unity Catalog lineage records what a table was built from and what consumes it, which is exactly what impact analysis requires. Time travel reads earlier versions, job run history shows executions not dependencies, and asking teams is unreliable and incomplete.
What to practise
Apply a column mask to one table and query it as a restricted user. Open the lineage graph for a table with real downstream dependencies. Then read enough about Delta Sharing to explain, in two sentences, why it beats exporting a copy.
Three small exercises for three small sections that together are worth nearly a quarter of the exam.