Exam Bundle

This signal belongs to the adjacent case “The job is spending most time waiting for a cold warehouse to start,” whose remedy is Measure startup separately and change supported warehouse readiness settings. The observed result for the present requirement is The final optimized output agrees with the validated baseline.

Scan/file metrics identify the additional read volume would demonstrate the separate action Inspect file pruning, statistics and changed data layout, which addresses “The report reads more files than before despite unchanged filter semantics.” It does not verify the requirement “A rewrite made the job faster but changes the number of output records” following Run result-equivalence and data-quality regression before accepting the optimization.

This signal belongs to the adjacent case “Repeated recomputation of an intermediate DataFrame dominates a notebook,” whose remedy is Persist the justified reused intermediate and release after use. The observed result for the present requirement is The final optimized output agrees with the validated baseline.

Replace it with controlled governed tags in the supported ABAC policy is appropriate when “An ungoverned free-text tag is being used for security enforcement”; it would be verified by Only authorized tag managers assign the attributes that drive the policy. It does not directly satisfy “A patient table should return only rows for the viewer's approved tenant,” whose relevant acceptance evidence is Two test principals see disjoint tenant rows.

Implement the identity/group condition explicitly in the row filter is appropriate when “A privileged clinical group needs approved access to all records while ordinary users remain scoped”; it would be verified by Privileged users see their approved global scope and others see only their tenant. It does not directly satisfy “A patient table should return only rows for the viewer's approved tenant,” whose relevant acceptance evidence is Two test principals see disjoint tenant rows.

Use approved role/group or governed-tag based policy conditions is appropriate when “A masking policy uses hard-coded individual usernames and becomes hard to maintain”; it would be verified by Adding a user to the entitled group changes effective masking without code edits. It does not directly satisfy “A patient table should return only rows for the viewer's approved tenant,” whose relevant acceptance evidence is Two test principals see disjoint tenant rows.

Test input PII is unreadable to unauthorized silver consumers pertains to a different control (Apply governed masking/transformation at the silver promotion boundary) and a different need (New source rows containing PII must be masked before entering the shared silver table). It cannot establish that Attach a governed row filter policy or row-filter function using an authenticated tenant mapping met the stated goal.

The ordinary role sees redacted addresses and the privileged role sees unmasked values would demonstrate the separate action Apply a UC column mask driven by approved identity rules, which addresses “Non-privileged users must see a masked email while approved administrators see the original.” It does not verify the requirement “A patient table should return only rows for the viewer's approved tenant” following Attach a governed row filter policy or row-filter function using an authenticated tenant mapping.

A query without an explicit WHERE clause still returns only permitted rows pertains to a different control (Replace voluntary query filtering with an enforced UC row filter policy) and a different need (A migration incorrectly relies on WHERE conditions added by individual analysts). It cannot establish that Attach a governed row filter policy or row-filter function using an authenticated tenant mapping met the stated goal.

Use UC object grants and downstream projection to separate raw and aggregate access belongs to the separate case “The original raw table must remain in restricted bronze while analysts query safe gold aggregates,” where Analysts can query safe aggregate data but are denied direct raw-table access would be expected. That differs from the condition in this stem: “A privileged clinical group needs approved access to all records while ordinary users remain scoped.”

This action solves a different issue: “Non-privileged users must see a masked email while approved administrators see the original.” Its normal signal is The ordinary role sees redacted addresses and the privileged role sees unmasked values. Here the requested behavior is “A privileged clinical group needs approved access to all records while ordinary users remain scoped,” so that signal is not sufficient.

This action solves a different issue: “A patient table should return only rows for the viewer's approved tenant.” Its normal signal is Two test principals see disjoint tenant rows. Here the requested behavior is “A privileged clinical group needs approved access to all records while ordinary users remain scoped,” so that signal is not sufficient.

This signal belongs to the adjacent case “A source must keep anonymized trends after personal records are deleted,” whose remedy is Aggregate or irreversibly anonymize allowed measurements before erasure. The observed result for the present requirement is Privileged users see their approved global scope and others see only their tenant.

The ordinary role sees redacted addresses and the privileged role sees unmasked values pertains to a different control (Apply a UC column mask driven by approved identity rules) and a different need (Non-privileged users must see a masked email while approved administrators see the original). It cannot establish that Implement the identity/group condition explicitly in the row filter met the stated goal.

This signal belongs to the adjacent case “One table has several different tenant columns and the wrong field was used for enforcement,” whose remedy is Fix the row-filter mapping to the authoritative tenant column. The observed result for the present requirement is Privileged users see their approved global scope and others see only their tenant.

Implement the identity/group condition explicitly in the row filter belongs to the separate case “A privileged clinical group needs approved access to all records while ordinary users remain scoped,” where Privileged users see their approved global scope and others see only their tenant would be expected. That differs from the condition in this stem: “One table has several different tenant columns and the wrong field was used for enforcement.”

Suppress the sensitive column in the approved projection belongs to the separate case “A field must be completely omitted from a downstream partner dataset,” where The exported schema contains no sensitive field would be expected. That differs from the condition in this stem: “One table has several different tenant columns and the wrong field was used for enforcement.”

This action solves a different issue: “All columns labeled confidential should receive consistent dynamic masking across several schemas.” Its normal signal is New tagged confidential columns inherit the intended masking decision. Here the requested behavior is “One table has several different tenant columns and the wrong field was used for enforcement,” so that signal is not sufficient.

That observation is a valid indicator for “A policy requires deleting raw PII after a specified retention age” when using Implement a scheduled retention filter and controlled deletion operation. The scenario instead tests “One table has several different tenant columns and the wrong field was used for enforcement”; the relevant result is Cross-tenant test rows are excluded according to the intended policy.

Privileged users see their approved global scope and others see only their tenant pertains to a different control (Implement the identity/group condition explicitly in the row filter) and a different need (A privileged clinical group needs approved access to all records while ordinary users remain scoped). It cannot establish that Fix the row-filter mapping to the authoritative tenant column met the stated goal.

Only columns with the intended classification are masked would demonstrate the separate action Refine the governed-tag match condition or classification, which addresses “An overly broad ABAC rule unexpectedly masks low-risk columns.” It does not verify the requirement “One table has several different tenant columns and the wrong field was used for enforcement” following Fix the row-filter mapping to the authoritative tenant column.

Move the password to a secured secret scope or governed connection belongs to the separate case “A notebook currently stores a database password in plaintext source code,” where Source code and deployment manifests no longer contain the secret would be expected. That differs from the condition in this stem: “An analyst attempts to bypass a row filter using a different SQL tool.”

Implement the identity/group condition explicitly in the row filter is appropriate when “A privileged clinical group needs approved access to all records while ordinary users remain scoped”; it would be verified by Privileged users see their approved global scope and others see only their tenant. It does not directly satisfy “An analyst attempts to bypass a row filter using a different SQL tool,” whose relevant acceptance evidence is Every supported authorized query surface applies the same row restriction.

Replace it with controlled governed tags in the supported ABAC policy belongs to the separate case “An ungoverned free-text tag is being used for security enforcement,” where Only authorized tag managers assign the attributes that drive the policy would be expected. That differs from the condition in this stem: “An analyst attempts to bypass a row filter using a different SQL tool.”

The Delta log remains consistent and erasure is reflected in queries pertains to a different control (Use Delta-supported transactional deletion and verified physical cleanup) and a different need (An analyst suggests overwriting Parquet files directly to purge Delta rows). It cannot establish that Enforce the filter at the governed UC data object rather than notebook query text met the stated goal.

The new matching object is protected without an individual table policy pertains to a different control (Tag the new table/columns appropriately under the scoped policy) and a different need (An ABAC policy applies to an entire schema but a new table is added). It cannot establish that Enforce the filter at the governed UC data object rather than notebook query text met the stated goal.

Two test principals see disjoint tenant rows pertains to a different control (Attach a governed row filter policy or row-filter function using an authenticated tenant mapping) and a different need (A patient table should return only rows for the viewer's approved tenant). It cannot establish that Enforce the filter at the governed UC data object rather than notebook query text met the stated goal.

This action solves a different issue: “A masking policy uses hard-coded individual usernames and becomes hard to maintain.” Its normal signal is Adding a user to the entitled group changes effective masking without code edits. Here the requested behavior is “A migration incorrectly relies on WHERE conditions added by individual analysts,” so that signal is not sufficient.

The alternative Implement a scheduled retention filter and controlled deletion operation has a distinct purpose—A policy requires deleting raw PII after a specified retention age. It would not establish the required outcome (A migration incorrectly relies on WHERE conditions added by individual analysts); the necessary verification concerns A query without an explicit WHERE clause still returns only permitted rows.

The alternative Enforce the filter at the governed UC data object rather than notebook query text has a distinct purpose—An analyst attempts to bypass a row filter using a different SQL tool. It would not establish the required outcome (A migration incorrectly relies on WHERE conditions added by individual analysts); the necessary verification concerns A query without an explicit WHERE clause still returns only permitted rows.

This signal belongs to the adjacent case “An ABAC policy applies to an entire schema but a new table is added,” whose remedy is Tag the new table/columns appropriately under the scoped policy. The observed result for the present requirement is A query without an explicit WHERE clause still returns only permitted rows.

Cross-tenant test rows are excluded according to the intended policy would demonstrate the separate action Fix the row-filter mapping to the authoritative tenant column, which addresses “One table has several different tenant columns and the wrong field was used for enforcement.” It does not verify the requirement “A migration incorrectly relies on WHERE conditions added by individual analysts” following Replace voluntary query filtering with an enforced UC row filter policy.

That observation is a valid indicator for “A verified deletion request targets one customer's personal rows in an active Delta table” when using Apply a scoped transactional DELETE or supported erasure operation. The scenario instead tests “A migration incorrectly relies on WHERE conditions added by individual analysts”; the relevant result is A query without an explicit WHERE clause still returns only permitted rows.