Question 29

A data engineer must secure a Unity Catalog table `hr.people.employees` using table-level row filters and column masks (UDF-based). The table has columns including `region`, `email`, `ssn`, and `salary`. For each business requirement, you must choose whether to implement it as a **Row filter** function or a **Column mask** function applied to the table. The two enforcement mechanisms behave as follows: ```mermaid flowchart LR subgraph T["hr.people.employees"] direction TB R1["row: region=EU ..."] R2["row: region=US ..."] R3["row: region=APAC ..."] end RF["Row filter UDF\n(predicate per row → keep/hide row)"] --> T CM["Column mask UDF\n(transform a column's value in returned rows)"] --> T ``` For each requirement, select **Row filter** or **Column mask**: ```mermaid flowchart TB Q1["Req 1: A US-based analyst group must NOT see any rows where region = 'EU'."] Q1 --> O1{"Row filter / Column mask"} Q2["Req 2: Non-privileged users must see ssn as '***-**-****' but the rows must still be returned."] Q2 --> O2{"Row filter / Column mask"} Q3["Req 3: Only members of 'payroll' may see the real salary value; everyone else sees NULL, but all employee rows remain visible."] Q3 --> O3{"Row filter / Column mask"} Q4["Req 4: A regional manager may only retrieve the subset of employee records whose region matches their own assigned region."] Q4 --> O4{"Row filter / Column mask"} ```