DP-750 Certification Practice Question #25

Question

A Unity Catalog catalog `analytics` contains a schema `analytics.gold`. You must assign least-privilege grants to three principals so each can perform exactly its job and no more:

- `data_engineers` (group): must create and load new tables in `analytics.gold`.
- `report_readers` (group): must read all current and future tables in `analytics.gold` but never write or create.
- `All account users`: must be able to discover that objects exist and view their metadata in Catalog Explorer, without access to the underlying data.

Assume each principal already has `USE CATALOG` on `analytics` and (where relevant) `USE SCHEMA` on `analytics.gold`. For each principal, select the single grant that best matches the requirement.

```mermaid
flowchart LR
    P1["data_engineers"] --> S1["analytics.gold dropdown -> ?"]
    P2["report_readers"] --> S2["analytics.gold dropdown -> ?"]
    P3["All account users"] --> S3["analytics (catalog) dropdown -> ?"]
    subgraph Options
      G1["CREATE TABLE"]
      G2["SELECT"]
      G3["BROWSE"]
      G4["ALL PRIVILEGES"]
      G5["MODIFY"]
    end
```

Accepted Answer

Least-privilege mapping aligns each grant to one job. `CREATE TABLE` on the schema lets engineers add and load tables without read-everything power. `SELECT` on the schema uses privilege inheritance to cover all current and future tables for read-only consumers, while excluding `MODIFY`/`CREATE`. `BROWSE`, which can only be granted at the catalog level, is the documented recommendation for `All account users` to discover objects and their metadata without any data access. `ALL PRIVILEGES` and `MODIFY` would over-grant.

More DP-750 practice questions