DP-750 Certification Practice Question #19

Question

An analyst group named `bi_readers` must be able to run `SELECT * FROM finance.reporting.gl_summary` on a SQL warehouse in a Unity Catalog metastore. The table owner has already granted `SELECT` on the table `finance.reporting.gl_summary` to `bi_readers`, but the query still fails with a permission error. You must determine the complete set of grants required for each level of the three-level namespace so that the read succeeds. For each securable level shown, select the **minimum** privilege that `bi_readers` must hold. ```mermaid flowchart TD A["CATALOG: finance
dropdown -> ?"] --> B["SCHEMA: finance.reporting
dropdown -> ?"] B --> C["TABLE: finance.reporting.gl_summary
dropdown -> ?"] subgraph Options O1["USE CATALOG"] O2["USE SCHEMA"] O3["SELECT"] O4["BROWSE"] O5["MODIFY"] end ```

Accepted Answer

Unity Catalog enforces an access-control boundary at each container level. A `SELECT` grant on the table is necessary but insufficient — the principal must also hold `USE CATALOG` on `finance` and `USE SCHEMA` on `finance.reporting`. These usage privileges grant the right to traverse into the container but do not by themselves expose data, which is why the documentation lists all three privileges together as the requirement to read a table.

More DP-750 practice questions