DP-750 Certification Practice Question #26

Question

A compliance requirement states that the `national_id` column in the table `hr.people.employees` must be masked so that only members of the `hr_privileged` group can see the raw value; everyone else must see `***-**-****`. A junior engineer proposes the following solution:

> "Grant `SELECT` on the schema `hr.people` to the `analysts` group. Because the grant is scoped to the schema, analysts can read the tables but the sensitive `national_id` column will automatically be masked for them by Unity Catalog's privilege inheritance."

The team then runs:

```sql
GRANT USE CATALOG ON CATALOG hr TO `analysts`;
GRANT USE SCHEMA  ON SCHEMA  hr.people TO `analysts`;
GRANT SELECT      ON SCHEMA  hr.people TO `analysts`;
```

**Does this solution meet the goal of masking the `national_id` column for non-privileged users?**

Accepted Answer

Granting `SELECT` at the schema level uses privilege inheritance to give the `analysts` group read access to every table in `hr.people`, including the full, unmasked `national_id` values. Privilege inheritance propagates the `SELECT` privilege downward; it does not apply any masking. To satisfy a column-masking requirement, you must attach a column mask UDF with `ALTER TABLE hr.people.employees ALTER COLUMN national_id SET MASK <fn>` (or use a dynamic view / ABAC policy) that conditionally returns the value based on `is_account_group_member('hr_privileged')`. Therefore the proposed `GRANT`-only solution does not meet the goal.

More DP-750 practice questions