DP-750 Certification Practice Question #32

Question

A security team must monitor account activity across all workspaces attached to a Unity Catalog metastore. They want to query audit events with SQL (including which user ran each notebook command text), retain the data for analytics, and they specifically need account-level events such as Unity Catalog lineage tracking that are NOT delivered through Azure Monitor diagnostic settings.

```mermaid
flowchart TB
  subgraph CFG["Audit logging configuration choices"]
    A1["Where do queryable audit events live?"]
    A2["What must be enabled so command_text appears for notebook/SQL commands?"]
    A3["What is the table path for the audit log system table?"]
    A4["How long is the free retention of the audit log system table?"]
  end
```

For each requirement, select the correct option from the dropdown.

Accepted Answer

The security team needs SQL-queryable audit data that includes account-level services such as Unity Catalog `lineageTracking`, which Azure Monitor diagnostic settings do not deliver. The audit log system table at `system.access.audit` records all audit services and events, with a free retention of 365 days. Notebook and Databricks SQL command text (the `commandText` request parameter) only appears when verbose audit logs are enabled, which adds events like `notebook.runCommand` and `databrickssql.commandSubmit`. The distractor options point to billing/compute system tables, unrelated optimization features, a non-existent table path, and incorrect retention windows.

More DP-750 practice questions