DP-750 Certification Practice Question #10

Question

Contoso runs a single Azure Databricks account with one Unity Catalog metastore per region. A data platform team must design a catalog-and-isolation strategy that satisfies four governance requirements at the same time. The team has already decided to follow Databricks' recommended pattern of isolating software development lifecycle (SDLC) environments at the catalog level of the three-level namespace, and to bind catalogs to specific workspaces where work environments and data share the same isolation requirements.

For each requirement, select the option that Databricks recommends.

```mermaid
flowchart TD
    M[Unity Catalog metastore - one per region] --> C1[catalog: sales_dev]
    M --> C2[catalog: sales_prod]
    subgraph R1[Requirement 1: Separate dev from prod data]
        D1{Isolate at: metastore / catalog / schema}
    end
    subgraph R2[Requirement 2: prod data must NOT be queryable from the Dev workspace, even by users with a SELECT grant]
        D2{Mechanism: privilege revoke / workspace-catalog binding / external location}
    end
    subgraph R3[Requirement 3: Let all users discover prod catalog metadata without reading data]
        D3{Grant: SELECT / BROWSE / USE CATALOG}
    end
    subgraph R4[Requirement 4: Share a curated prod table cross-region to a partner]
        D4{Method: register external table in 2nd metastore / Delta Sharing / copy files}
    end
```

Accepted Answer

Databricks' deployment guidance places SDLC isolation at the catalog level, the highest level of the three-level namespace, so `dev` and `prod` catalogs cleanly separate data and grants. Workspace-catalog binding is the only mechanism that overrides individual privilege grants — a user holding `SELECT` on a `prod_catalog` table still cannot read it from an unbound Dev workspace. `BROWSE`, grantable only at the catalog level, exposes metadata for discovery without data access, which is why Databricks recommends granting it to the `All account users` group. Finally, because each account has one metastore per region and registering the same table as external in two metastores risks metadata drift, cross-region sharing must go through Azure Databricks-managed Delta Sharing.

More DP-750 practice questions