Question 18

A data platform team at Contoso manages a Unity Catalog metastore. A nightly ingestion job runs as an Azure Databricks **service principal** named `ingest-sp` (application ID `a1b2c3d4-1111-2222-3333-444455556666`). The job must be able to read from and write to every current and future table in the `sales` schema of the `prod` catalog, but it must not be able to create new tables or alter privileges. You connect to a SQL warehouse as the owner of the `prod` catalog and run a sequence of `GRANT` statements. Which statement set correctly gives the service principal exactly the access it needs, following the Unity Catalog privilege model? ```sql -- Option building blocks (do not run yet) GRANT USE CATALOG ON CATALOG prod TO `a1b2c3d4-1111-2222-3333-444455556666`; GRANT USE SCHEMA ON SCHEMA prod.sales TO `a1b2c3d4-1111-2222-3333-444455556666`; GRANT SELECT, MODIFY ON SCHEMA prod.sales TO `a1b2c3d4-1111-2222-3333-444455556666`; ```

• AGrant `SELECT, MODIFY` on `SCHEMA prod.sales` only. Usage privileges on the parent catalog and schema are inherited automatically when you grant a table privilege.
• BGrant `USE CATALOG` on `CATALOG prod`, `USE SCHEMA` on `SCHEMA prod.sales`, and `SELECT, MODIFY` on `SCHEMA prod.sales` to the service principal, identified by its application ID enclosed in backticks.
• CGrant `ALL PRIVILEGES` on `SCHEMA prod.sales` to the service principal so it inherits read, write, and create permissions in one statement.
• DGrant `USE CATALOG` and `SELECT, MODIFY` on `CATALOG prod`, omitting any schema-level grant, because catalog grants always supersede schema grants.