What describes a primary technical challenge in ensuring consistent PII masking across all nodes in large-scale, distributed Databricks batch and streaming pipelines?

• A. Native masking in Databricks automatically synchronizes with all downstream external Databricks systems.
• B. Masking functions must be standardized and managed through Unity Catalog, with enforcement applied across all relevant datasets to avoid any data inconsistency.
• C. Dynamic data masking is applied only at rest, so it does not affect query performance.
• D. PII masking is only required for direct identifiers.

A data engineering team is configuring access controls in Databricks Unity Catalog. They grant the SELECT privilege on the sales catalog to the analyst_group, expecting that members of this group will automatically have SELECT access to all current and future schemas, tables, and views within the catalog. What describes the privilege inheritance behavior in Unity Catalog?

• A. Granting SELECT at the catalog level applies to existing schemas and tables but not to those created in the future.
• B. Granting SELECT on a catalog automatically applies SELECT to all current and future schemas, tables, and views within that catalog.
• C. Privileges granted at the schema level override any catalog-level privileges and prevent access unless explicitly revoked.
• D. Privileges in Unity Catalog do not cascade; SELECT must be explicitly granted on each schema and table, even if granted at the catalog level.

The security team is exploring whether or not the Databricks secrets module can be leveraged for connecting to an external database.
After testing the code with all Python variables being defined with strings, they upload the password to the secrets module and configure the correct permissions for the currently active user. They then modify their code to the following (leaving all other variables unchanged).

Which statement describes what will happen when the above code is executed?

• A. The connection to the external table will succeed; the string value of password will be printed in plain text.
• B. An interactive input box will appear in the notebook; if the right password is provided, the connection will succeed and the encoded password will be saved to DBFS.
• C. The connection to the external table will succeed; the string "redacted" will be printed.
• D. The connection to the external table will fail; the string "redacted" will be printed.
• E. An interactive input box will appear in the notebook; if the right password is provided, the connection will succeed and the password will be printed in plain text.

A data engineer is building a Lakeflow Declarative Pipelines pipeline to process healthcare claims data. A metadata JSON file defines data quality rules for multiple tables, including:
{
"claims": [
{"name": "valid_patient_id", "constraint": "patient_id IS NOT NULL"},
{"name": "non_negative_amount", "constraint": "claim_amount >= 0"}
]
}
The pipeline must dynamically apply these rules to the claims table without hardcoding the rules.
How should the data engineer achieve this?

• A. Reference each expectation with @dlt.expect decorators in the table declaration.
• B. Load the JSON metadata, loop through its entries, and apply expectations using dlt.expect_all.
• C. Invoke an external API to validate records against the metadata rules.
• D. Use a SQL CONSTRAINT block referencing the JSON file path.

Two of the most common data locations on Databricks are the DBFS root storage and external object storage mounted with dbutils.fs.mount().
Which of the following statements is correct?

• A. The DBFS root stores files in ephemeral block volumes attached to the driver, while mounted directories will always persist saved data to external storage between sessions.
• B. DBFS is a file system protocol that allows users to interact with files stored in object storage using syntax and guarantees similar to Unix file systems.
• C. Neither the DBFS root nor mounted storage can be accessed when using %sh in a Databricks notebook.
• D. The DBFS root is the most secure location to store data, because mounted storage volumes must have full public read and write permissions.
• E. By default, both the DBFS root and mounted data sources are only accessible to workspace administrators.