HOTSPOT (Drag and Drop is not supported)You have an Azure Databricks workspace.You have an Azure key vault named kv-secure that stores a secret named storageKey. The value of storageKey is managed and updated by the cloud security team at your company.You need to enable a Databricks notebook named Notebook1 to retrieve the value of storageKey securely at runtime. The solution must follow the principle of least privilege and always retrieve the latest value.What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: A Key Vault-backed secret scope To securely expose the storageKey to your Databricks notebook while adhering to the principle of least privilege, use an Azure Key Vault-backed secret scope.This approach acts as a read-only bridge to your Key Vault, ensuring the security team manages the key centrally, while the notebook always fetches the latest version dynamically. Secret Exposure: Notebooks reference the secret by an alias name.Always Updated: Databricks fetches the secret directly from Key Vault at runtime, ensuring it always gets the latest version updated by your security team.Least Privilege: Access can be restricted to specific users or groups using Databricks Access Control Lists (ACLs).Box 2: dbutils.secrets.get Use an Azure Key Vault-backed secret scope in combination with the dbutils.secrets.get function.This approach centralizes the secret's management for your security team, follows the principle of least privilege through Azure IAM, and ensures your notebook always fetches the latest runtime value.Run this specific command inside your Databricks Python notebook: storage_key = dbutils.secrets.get(scope="your-scope-name", key="storageKey")
HOTSPOT (Drag and Drop is not supported)You have an Azure Databricks workspace that is enabled for Unity Catalog and contains a catalog named Catalog1. Catalog1 contains a schema named Schema1 and a table named Table1.You need to ensure that access to the data in Table1 is controlled by using attribute-based access control (ABAC).What should you apply to Table1, and how should you control access for users? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: A governed tag You must apply governed tags (key-value pairs) to the table or its columns. These tags represent the attributes of the data, such as its sensitivity level or business domain.Box 2: Create a Unity Catalog access policy To control user access using attribute-based access control (ABAC) on a tagged table in Azure Databricks, you should create an ABAC policy (specifically a row filter policy or a column mask policy) that evaluates the governed tag applied to the table.When configured, Unity Catalog dynamically maps the tag on the table against your policy rules to determine which users can view or mask specific rows and columns.1. Create a User-Defined Function (UDF)You must first write the specific data restriction logic inside a standard SQL User-Defined Function (UDF).2. Configure the ABAC Policy Once your UDF is created, you build the centralized ABAC policy in Unity Catalog. During creation, you must specify:The Target Principals: The users or groups the restrictions apply to.The Scope: The exact Catalog, Schema, or Table (Table1) where the policy will look for attributes.The Tag Condition: A rule mapping to your governed tag (e.g., matching a tag key/value like Data_Sensitivity = High) using built-in evaluation functions.The Function: Select the UDF you created in Step 1 to execute the filtering or masking.
HOTSPOT (Drag and Drop is not supported)You have an Azure Databricks workspace that is enabled for Unity Catalog.You need to implement a data lifecycle and expiration solution that meets the following requirements:-Transaction logs and deleted data files that are older than 90 days must be removed from Delta tables to reclaim storage.-All the tables must remain available for querying during the cleanup process.-Administrative effort must be minimized.What should you do for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Set deletedFileRetentionDuration to 90. The most important property to set to 90 is deletedFileRetentionDuration.The delta.deletedFileRetentionDuration table property explicitly dictates the safety threshold used by the VACUUM command. Setting this to 90 days ensures that VACUUM will physically remove data files that have been logically deleted or unreferenced in the transaction log for more than 90 days to reclaim storage.Incorrect: UntilArchived This is not a Delta table retention property. It is a conceptual flag or cloud lifecycle strategy but does not directly govern the behavior of the VACUUM command.logRetentionDuration The delta.logRetentionDuration property controls how long the table history and transaction log entries are kept, which defaults to 30 days.While you should ideally keep it equal to or greater than the deleted file retention (e.g., matching it at 90 days), it governs metadata cleanup rather than the physical removal of unreferenced data files targeted by the VACUUM command.Box 2: Run the VACUUM command. Execute the VACUUM table_name command. This deletes the actual physical files from your cloud storage to reclaim space. Tables remain online and fully queryable during this process.
You have an Azure Databricks workspace that is enabled for Unity Catalog and contains a managed Delta table named Table1. Table1 stores customer data.You need to implement a data retention solution that meets the following requirements:-Deleted data must be retained for 30 days to support audits.-Deleted data that is older than 30 days must be removed permanently.-The solution must minimize administrative effortWhich two properties should you configure? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): B,C
To configure an Azure Databricks managed Delta table to retain deleted data for 30 days and minimize administrative overhead, you must set the following table properties:delta.logRetentionDuration: Set this to interval 30 days. This property controls how long the transaction log history is kept, which is essential for audit trails and time travel.delta.deletedFileRetentionDuration: Set this to interval 30 days. This property determines the threshold for when deleted data files become eligible for permanent removal by the VACUUM command.
You have an Azure Databricks workspace that is enabled for Unity Catalog and contains two catalogs named Catalog1 and Catalog2.An external application uses a service principal named SP1 to connect to a SQL warehouse.You need to ensure that SP1 can query the data in Catalog1 and Catalog2. The solution must follow the principle of least privilege.Which permissions should you grant to SP1 for the catalogs?
Answer(s): C
To ensure a service principal can query data in two specific catalogs while maintaining the principle of least privilege, you must assign the following permissions for each catalog:Unified Catalog Permissions USE CATALOG on the specific catalog: This is a prerequisite that allows the principal to see the catalog and its child objects.USE SCHEMA on the schemas containing the data: This allows the principal to interact with the schemas within that catalog.SELECT on the specific tables or views: This provides the actual read access required to query the data.
You have an Azure Databricks workspace that is enabled for Unity Catalog and contains a catalog named Catalog1. Catalog1 contains a table named Transactions. Transactions contains the following columns:-transaction_id customer_name email_address credit_card_number transaction_amountYou need to ensure that business analysts can query all the rows in the Transactions table. The solution must meet the following requirements:-Prevent the analysts from seeing the full values in the email_address and credit_card_number columns.-Ensure that the analysts can see only the values after the @ character in each email address.-Ensure that the analysts can see only the last four digits of each credit card number.-Enable the analysts to query the table without errors.-Follow the principle of least privilege.What should you do?
Answer(s): D
To protect sensitive customer information while allowing a specific group to run queries, use Unity Catalog's Dynamic Column Masking. This grants the group table access while applying User-Defined Functions (UDFs) to redact the email addresses and credit card numbers dynamically.Here is the exact SQL implementation to apply:1. Create the masking SQL UDFs Define functions to apply the exact partial masking rules requested.2. Apply the column masks to the tableAlter the transaction table to attach these UDFs to the respective columns.3. Grant least privilege permissionsGrant the group the SELECT permission on the table, along with the foundational permissions to access the catalog and schema.
HOTSPOT (Drag and Drop is not supported)You have an Azure Databricks workspace that is enabled for Unity Catalog and contains a catalog named catalog1.You have a group named group1.You plan to create a schema named schema1 in catalog1.You need to ensure that group1 meets the following requirements:-Can create tables in schema1-Can modify and query tables-Cannot grant permissions for the schema and its objectsHow should you complete the SQL statements? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: USAGE, CREATE TABLE USAGE, CREATE TABLE allows entering the schema and creating new tables.Box 2: TO ROLE group1
HOTSPOT (Drag and Drop is not supported)You have an Azure Databricks workspace that is enabled for Unity Catalog.You need to create an external volume named Volume1 in an existing schema. Volume1 must expose files from an Azure Storage container. The solution must meet the following requirements:-Ensure that authentication does NOT require storing credentials in Databricks.-Ensure that users can access the files, but NOT modify the files.-Follow the principle of least privilege.Which type of authentication should you configure, and which permission should you grant to the users? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: A Databricks access connector The correct authentication type to use is the Databricks access connector.To comply with the requirements, you should use an Azure managed identity associated with a Databricks Access Connector. This approach is recommended by Databricks because it avoids the need to store and rotate long-term credentials (like service principal secrets or SAS tokens) within the workspace.Authentication Mechanism: The Databricks access connector acts as a container for a managed identity. This identity is granted the necessary Azure RBAC permissions (such as Storage Blob Data Reader) on the Azure Storage container.Unity Catalog Setup: Create a Storage Credential in Unity Catalog that references the Access Connector's resource ID.Create an External Location that links the cloud storage path (the container URL) to that Storage Credential.Box 2: READ VOLUME Determine the Databricks Permission To allow users to view and interact with files inside the external volume but prevent them from making any edits, you must grant them specific Unity Catalog object permissions.Permission to grant: READ VOLUMEScope: This allows the designated users or groups to list, read, and process files within that volume. Because you are omitting the WRITE VOLUME permission, users will be structurally blocked from uploading, altering, or removing files inside the volume.
Post your Comments and Discuss Microsoft DP-750 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the DP-750 content, but please register or login to continue.