DP-750 Unity Catalog security explained
Secure and govern Unity Catalog objects is worth 15–20% of DP-750. It tests whether you can give the right people the right access and no more, authenticate pipelines without hard-coded secrets, and show where data came from and who touched it. Most questions describe a symptom (a user gets a permission error) or a requirement (hide a column from one group) and ask which Unity Catalog feature fits.
Secure Unity Catalog objects
Grant privileges
Privileges are granted to a principal (user, service principal or group) on a securable object and are inherited downward: a grant on a catalog applies to its schemas and tables. Granting to groups rather than individuals is the standard recommendation.
The detail that catches people: to read a table you need SELECT on it, but also USE CATALOG on its catalog and USE SCHEMA on its schema. A user with only SELECT gets a permission error. Other privileges to know are MODIFY, CREATE TABLE, EXECUTE for functions and READ VOLUME or WRITE VOLUME for files. Object ownership also carries rights, so a question about who can grant often comes down to the owner.
Table, column and row-level control
Table-level control is a grant. Column- and row-level control use two separate features:
| Feature | What it does |
|---|---|
| Row filter | A function attached to a table that decides which rows a user sees |
| Column mask | A function attached to a column that returns masked or full values by user or group |
Neither duplicates data. A common requirement is “analysts see the last four digits, compliance sees everything”, which is a column mask checking group membership.
Secrets and authentication
- Azure Key Vault: a Key Vault-backed secret scope lets notebooks read secrets with the Databricks secrets utility, without values appearing in code or output.
- Service principals: unattended jobs should run as a service principal, not a person, and be granted only what the pipeline needs.
- Managed identities: for access to Azure resources such as storage, a managed identity (through an access connector and a storage credential) removes the need to store a key at all.
When a question asks how to reach storage without a stored credential, prefer the managed identity over a secret.
Govern Unity Catalog objects
Discovery and metadata
Good table and column comments make data discoverable in Catalog Explorer and improve Genie answers. The outline expects you to create and preserve them, for example keeping descriptions when you recreate a table.
Attribute-based access control
ABAC drives access from tags and policies rather than object by object: you tag columns (for example as sensitive) and a policy applies a mask or filter to every tagged column for the principals you name. It scales better than hand-written grants when hundreds of tables share the same rule. Check the current status of the feature in Databricks documentation, because it is newer than row filters and column masks.
Retention, lineage and audit
- Data retention: Delta tables keep history and old files for a configured period; VACUUM removes files past the retention threshold, and retention settings define how far back time travel works. Lawful deletion requirements usually mean setting retention deliberately.
- Lineage: Catalog Explorer shows upstream and downstream tables, columns, notebooks and jobs, plus owner and history for an object. It answers “what breaks if I change this table” and “where did this column come from”.
- Audit logging: account and workspace events, such as who read or granted what, are recorded in audit logs and can be queried or exported to monitoring tools.
Delta Sharing (OpenSharing)
Delta Sharing, which current Azure Databricks documentation calls OpenSharing (the old /delta-sharing/ pages on Microsoft Learn now redirect to “What is OpenSharing?”), lets you share live data with recipients without copying it. A secure strategy shares only the specific tables or views needed, uses a recipient per party, limits who can create shares, sets expiry on tokens or credentials, and monitors access. Sharing to another Databricks workspace is simpler than open sharing to a recipient using other tools. The DP-750 outline still says Delta Sharing; treat both names as the same feature. More in the Delta Sharing (OpenSharing) guide.
Sample questions
Question 1. A group has been granted SELECT on the table sales.orders.line_items, but its members get a permission error when they query it. They have no other grants. What is missing?
- A. MODIFY on the table
- B. USE CATALOG on the catalog and USE SCHEMA on the schema
- C. CREATE TABLE on the schema
- D. EXECUTE on the schema
Show answer
Answer: B
Reading a table needs USE CATALOG on the catalog and USE SCHEMA on the schema in addition to SELECT on the table. MODIFY allows writes, which is not required to read. CREATE TABLE lets users create objects. EXECUTE applies to functions and is irrelevant here.
Want more questions like this? Full DP-750 practice tests →
Question 2. A notebook must connect to an external API using a key. The key must not appear in notebook code or in output, and the security team wants it managed in Azure. What should you use?
- A. A notebook widget holding the key
- B. A variable defined at the top of the notebook
- C. A Key Vault-backed secret scope
- D. A text file in the workspace
Show answer
Answer: C
A secret scope backed by Azure Key Vault keeps the key in Key Vault and exposes it to authorised notebooks through the secrets utility, with values redacted in output. A widget or notebook variable stores the key in plain view. A comment in the code or a workspace file exposes it to anyone who can read the notebook.
Want more questions like this? Full DP-750 practice tests →
Question 3. You must share one curated table with an external partner that does not use Databricks. The partner must receive only that table and the access must be revocable. What is the best approach?
- A. Email a SAS token for the storage container
- B. Add the partner as a workspace user with SELECT on the catalog
- C. Export CSV files by hand each week
- D. A Delta Sharing (OpenSharing) share containing the table, with a dedicated recipient
Show answer
Answer: D
Delta Sharing (now OpenSharing) supports open sharing: you create a share containing only the table, create a recipient for the partner, and can revoke or expire access. Emailing a SAS to the whole storage container exposes far more than one table. Giving the partner workspace access over-grants. Exporting copies by hand breaks freshness and control.
Want more questions like this? Full DP-750 practice tests →
What to practise
Grant a group access in stages and watch the error change: SELECT alone, then USE SCHEMA, then USE CATALOG. Add a column mask and a row filter. Create a Key Vault-backed secret scope. Open the lineage tab on a table you built, then query the audit logs. After that, move on to the data processing guide.