Exam Bundle

This signal belongs to the adjacent case “An ABAC policy applies to an entire schema but a new table is added,” whose remedy is Tag the new table/columns appropriately under the scoped policy. The observed result for the present requirement is A query without an explicit WHERE clause still returns only permitted rows.

Cross-tenant test rows are excluded according to the intended policy would demonstrate the separate action Fix the row-filter mapping to the authoritative tenant column, which addresses “One table has several different tenant columns and the wrong field was used for enforcement.” It does not verify the requirement “A migration incorrectly relies on WHERE conditions added by individual analysts” following Replace voluntary query filtering with an enforced UC row filter policy.

That observation is a valid indicator for “A verified deletion request targets one customer's personal rows in an active Delta table” when using Apply a scoped transactional DELETE or supported erasure operation. The scenario instead tests “A migration incorrectly relies on WHERE conditions added by individual analysts”; the relevant result is A query without an explicit WHERE clause still returns only permitted rows.

The alternative Return the declared column-compatible type from the mask UDF has a distinct purpose—A masking function returns the wrong data type for a protected numeric column. It would not establish the required outcome (Non-privileged users must see a masked email while approved administrators see the original); the necessary verification concerns The ordinary role sees redacted addresses and the privileged role sees unmasked values.

Use UC object grants and downstream projection to separate raw and aggregate access belongs to the separate case “The original raw table must remain in restricted bronze while analysts query safe gold aggregates,” where Analysts can query safe aggregate data but are denied direct raw-table access would be expected. That differs from the condition in this stem: “Non-privileged users must see a masked email while approved administrators see the original.”

This action solves a different issue: “A privileged clinical group needs approved access to all records while ordinary users remain scoped.” Its normal signal is Privileged users see their approved global scope and others see only their tenant. Here the requested behavior is “Non-privileged users must see a masked email while approved administrators see the original,” so that signal is not sufficient.

Privileged users see their approved global scope and others see only their tenant would demonstrate the separate action Implement the identity/group condition explicitly in the row filter, which addresses “A privileged clinical group needs approved access to all records while ordinary users remain scoped.” It does not verify the requirement “Non-privileged users must see a masked email while approved administrators see the original” following Apply a UC column mask driven by approved identity rules.

That observation is a valid indicator for “A national identifier must not be exposed by a general-purpose reporting view” when using Mask the protected identifier through an enforced policy or safe published view. The scenario instead tests “Non-privileged users must see a masked email while approved administrators see the original”; the relevant result is The ordinary role sees redacted addresses and the privileged role sees unmasked values.

Joined records match on pseudonyms while raw identities remain protected pertains to a different control (Use controlled keyed tokenization or HMAC pseudonymization) and a different need (The same customer should map consistently across datasets without revealing the original ID). It cannot establish that Apply a UC column mask driven by approved identity rules met the stated goal.

This action solves a different issue: “A masking function returns the wrong data type for a protected numeric column.” Its normal signal is The table query succeeds and preserves the expected schema. Here the requested behavior is “A national identifier must not be exposed by a general-purpose reporting view,” so that signal is not sufficient.

Create a governed tag and ABAC column-mask policy at the appropriate hierarchy belongs to the separate case “All columns labeled confidential should receive consistent dynamic masking across several schemas,” where New tagged confidential columns inherit the intended masking decision would be expected. That differs from the condition in this stem: “A national identifier must not be exposed by a general-purpose reporting view.”

Replace voluntary query filtering with an enforced UC row filter policy belongs to the separate case “A migration incorrectly relies on WHERE conditions added by individual analysts,” where A query without an explicit WHERE clause still returns only permitted rows would be expected. That differs from the condition in this stem: “A national identifier must not be exposed by a general-purpose reporting view.”

Every supported authorized query surface applies the same row restriction pertains to a different control (Enforce the filter at the governed UC data object rather than notebook query text) and a different need (An analyst attempts to bypass a row filter using a different SQL tool). It cannot establish that Mask the protected identifier through an enforced policy or safe published view met the stated goal.

That observation is a valid indicator for “A masking function returns the wrong data type for a protected numeric column” when using Return the declared column-compatible type from the mask UDF. The scenario instead tests “A national identifier must not be exposed by a general-purpose reporting view”; the relevant result is A report run by the analyst role contains no raw identifier.

That observation is a valid indicator for “A streaming pipeline must not emit personal data to an external unapproved sink” when using Restrict sink selection and enforce data-classification checks before publishing. The scenario instead tests “A national identifier must not be exposed by a general-purpose reporting view”; the relevant result is A report run by the analyst role contains no raw identifier.

Create a governed tag and ABAC column-mask policy at the appropriate hierarchy is appropriate when “All columns labeled confidential should receive consistent dynamic masking across several schemas”; it would be verified by New tagged confidential columns inherit the intended masking decision. It does not directly satisfy “A masking function returns the wrong data type for a protected numeric column,” whose relevant acceptance evidence is The table query succeeds and preserves the expected schema.

The alternative Use approved role/group or governed-tag based policy conditions has a distinct purpose—A masking policy uses hard-coded individual usernames and becomes hard to maintain. It would not establish the required outcome (A masking function returns the wrong data type for a protected numeric column); the necessary verification concerns The table query succeeds and preserves the expected schema.

The alternative Add schema-evolution QA and governed-tag classification checks has a distinct purpose—The team needs to prove masked columns remain protected after a new data column appears. It would not establish the required outcome (A masking function returns the wrong data type for a protected numeric column); the necessary verification concerns The table query succeeds and preserves the expected schema.

A report run by the analyst role contains no raw identifier would demonstrate the separate action Mask the protected identifier through an enforced policy or safe published view, which addresses “A national identifier must not be exposed by a general-purpose reporting view.” It does not verify the requirement “A masking function returns the wrong data type for a protected numeric column” following Return the declared column-compatible type from the mask UDF.

The new matching object is protected without an individual table policy pertains to a different control (Tag the new table/columns appropriately under the scoped policy) and a different need (An ABAC policy applies to an entire schema but a new table is added). It cannot establish that Return the declared column-compatible type from the mask UDF met the stated goal.

This signal belongs to the adjacent case “The team needs to prove masked columns remain protected after a new data column appears,” whose remedy is Add schema-evolution QA and governed-tag classification checks. The observed result for the present requirement is The table query succeeds and preserves the expected schema.

The alternative Apply governed masking/transformation at the silver promotion boundary has a distinct purpose—New source rows containing PII must be masked before entering the shared silver table. It would not establish the required outcome (A PII attribute flows into an intermediate silver pipeline without protection); the necessary verification concerns The downstream silver dataset does not expose raw PII to unauthorized readers.

Use controlled keyed tokenization or HMAC pseudonymization is appropriate when “The same customer should map consistently across datasets without revealing the original ID”; it would be verified by Joined records match on pseudonyms while raw identities remain protected. It does not directly satisfy “A PII attribute flows into an intermediate silver pipeline without protection,” whose relevant acceptance evidence is The downstream silver dataset does not expose raw PII to unauthorized readers.

Use approved role/group or governed-tag based policy conditions belongs to the separate case “A masking policy uses hard-coded individual usernames and becomes hard to maintain,” where Adding a user to the entitled group changes effective masking without code edits would be expected. That differs from the condition in this stem: “A PII attribute flows into an intermediate silver pipeline without protection.”

Adding a user to the entitled group changes effective masking without code edits would demonstrate the separate action Use approved role/group or governed-tag based policy conditions, which addresses “A masking policy uses hard-coded individual usernames and becomes hard to maintain.” It does not verify the requirement “A PII attribute flows into an intermediate silver pipeline without protection” following Apply identification and masking at the controlled processing stage.

The exported schema contains no sensitive field would demonstrate the separate action Suppress the sensitive column in the approved projection, which addresses “A field must be completely omitted from a downstream partner dataset.” It does not verify the requirement “A PII attribute flows into an intermediate silver pipeline without protection” following Apply identification and masking at the controlled processing stage.

An attempted unauthorized export fails under the policy would demonstrate the separate action Restrict sink selection and enforce data-classification checks before publishing, which addresses “A streaming pipeline must not emit personal data to an external unapproved sink.” It does not verify the requirement “A PII attribute flows into an intermediate silver pipeline without protection” following Apply identification and masking at the controlled processing stage.

This action solves a different issue: “A masking function returns the wrong data type for a protected numeric column.” Its normal signal is The table query succeeds and preserves the expected schema. Here the requested behavior is “A masking policy uses hard-coded individual usernames and becomes hard to maintain,” so that signal is not sufficient.

Replace voluntary query filtering with an enforced UC row filter policy belongs to the separate case “A migration incorrectly relies on WHERE conditions added by individual analysts,” where A query without an explicit WHERE clause still returns only permitted rows would be expected. That differs from the condition in this stem: “A masking policy uses hard-coded individual usernames and becomes hard to maintain.”

Create a governed tag and ABAC column-mask policy at the appropriate hierarchy belongs to the separate case “All columns labeled confidential should receive consistent dynamic masking across several schemas,” where New tagged confidential columns inherit the intended masking decision would be expected. That differs from the condition in this stem: “A masking policy uses hard-coded individual usernames and becomes hard to maintain.”

That observation is a valid indicator for “An ABAC policy applies to an entire schema but a new table is added” when using Tag the new table/columns appropriately under the scoped policy. The scenario instead tests “A masking policy uses hard-coded individual usernames and becomes hard to maintain”; the relevant result is Adding a user to the entitled group changes effective masking without code edits.

That observation is a valid indicator for “A national identifier must not be exposed by a general-purpose reporting view” when using Mask the protected identifier through an enforced policy or safe published view. The scenario instead tests “A masking policy uses hard-coded individual usernames and becomes hard to maintain”; the relevant result is Adding a user to the entitled group changes effective masking without code edits.

This signal belongs to the adjacent case “A migration incorrectly relies on WHERE conditions added by individual analysts,” whose remedy is Replace voluntary query filtering with an enforced UC row filter policy. The observed result for the present requirement is Adding a user to the entitled group changes effective masking without code edits.