Exam Bundle

That observation is a valid indicator for “An ABAC policy applies to an entire schema but a new table is added” when using Tag the new table/columns appropriately under the scoped policy. The scenario instead tests “A masking policy uses hard-coded individual usernames and becomes hard to maintain”; the relevant result is Adding a user to the entitled group changes effective masking without code edits.

That observation is a valid indicator for “A national identifier must not be exposed by a general-purpose reporting view” when using Mask the protected identifier through an enforced policy or safe published view. The scenario instead tests “A masking policy uses hard-coded individual usernames and becomes hard to maintain”; the relevant result is Adding a user to the entitled group changes effective masking without code edits.

This signal belongs to the adjacent case “A migration incorrectly relies on WHERE conditions added by individual analysts,” whose remedy is Replace voluntary query filtering with an enforced UC row filter policy. The observed result for the present requirement is Adding a user to the entitled group changes effective masking without code edits.

Move the workload to supported serverless or compatible runtime/access-mode compute belongs to the separate case “A masked column is still exposed because the consumer uses unsupported older compute,” where Queries execute with the configured ABAC protection on supported compute would be expected. That differs from the condition in this stem: “All columns labeled confidential should receive consistent dynamic masking across several schemas.”

This action solves a different issue: “The team needs to prove masked columns remain protected after a new data column appears.” Its normal signal is A new sensitive column receives the required mask before consumer access. Here the requested behavior is “All columns labeled confidential should receive consistent dynamic masking across several schemas,” so that signal is not sufficient.

Return the declared column-compatible type from the mask UDF belongs to the separate case “A masking function returns the wrong data type for a protected numeric column,” where The table query succeeds and preserves the expected schema would be expected. That differs from the condition in this stem: “All columns labeled confidential should receive consistent dynamic masking across several schemas.”

That observation is a valid indicator for “The remote database credentials rotate periodically” when using Update the secured secret reference or governed connection on rotation. The scenario instead tests “All columns labeled confidential should receive consistent dynamic masking across several schemas”; the relevant result is New tagged confidential columns inherit the intended masking decision.

This signal belongs to the adjacent case “One table has several different tenant columns and the wrong field was used for enforcement,” whose remedy is Fix the row-filter mapping to the authoritative tenant column. The observed result for the present requirement is New tagged confidential columns inherit the intended masking decision.

The new matching object is protected without an individual table policy pertains to a different control (Tag the new table/columns appropriately under the scoped policy) and a different need (An ABAC policy applies to an entire schema but a new table is added). It cannot establish that Create a governed tag and ABAC column-mask policy at the appropriate hierarchy met the stated goal.

The alternative Move the workload to supported serverless or compatible runtime/access-mode compute has a distinct purpose—A masked column is still exposed because the consumer uses unsupported older compute. It would not establish the required outcome (An ungoverned free-text tag is being used for security enforcement); the necessary verification concerns Only authorized tag managers assign the attributes that drive the policy.

The alternative Implement a scheduled retention filter and controlled deletion operation has a distinct purpose—A policy requires deleting raw PII after a specified retention age. It would not establish the required outcome (An ungoverned free-text tag is being used for security enforcement); the necessary verification concerns Only authorized tag managers assign the attributes that drive the policy.

This action solves a different issue: “A patient table should return only rows for the viewer's approved tenant.” Its normal signal is Two test principals see disjoint tenant rows. Here the requested behavior is “An ungoverned free-text tag is being used for security enforcement,” so that signal is not sufficient.

Queries execute with the configured ABAC protection on supported compute would demonstrate the separate action Move the workload to supported serverless or compatible runtime/access-mode compute, which addresses “A masked column is still exposed because the consumer uses unsupported older compute.” It does not verify the requirement “An ungoverned free-text tag is being used for security enforcement” following Replace it with controlled governed tags in the supported ABAC policy.

Cross-tenant test rows are excluded according to the intended policy would demonstrate the separate action Fix the row-filter mapping to the authoritative tenant column, which addresses “One table has several different tenant columns and the wrong field was used for enforcement.” It does not verify the requirement “An ungoverned free-text tag is being used for security enforcement” following Replace it with controlled governed tags in the supported ABAC policy.

Only the trusted service role can resolve tokens to the original identifier would demonstrate the separate action Use controlled reversible tokenization with a restricted mapping vault, which addresses “Authorized internal reidentification is necessary for customer service support.” It does not verify the requirement “An ungoverned free-text tag is being used for security enforcement” following Replace it with controlled governed tags in the supported ABAC policy.

Replace voluntary query filtering with an enforced UC row filter policy is appropriate when “A migration incorrectly relies on WHERE conditions added by individual analysts”; it would be verified by A query without an explicit WHERE clause still returns only permitted rows. It does not directly satisfy “An ABAC policy applies to an entire schema but a new table is added,” whose relevant acceptance evidence is The new matching object is protected without an individual table policy.

The alternative Add schema-evolution QA and governed-tag classification checks has a distinct purpose—The team needs to prove masked columns remain protected after a new data column appears. It would not establish the required outcome (An ABAC policy applies to an entire schema but a new table is added); the necessary verification concerns The new matching object is protected without an individual table policy.

Move the workload to supported serverless or compatible runtime/access-mode compute is appropriate when “A masked column is still exposed because the consumer uses unsupported older compute”; it would be verified by Queries execute with the configured ABAC protection on supported compute. It does not directly satisfy “An ABAC policy applies to an entire schema but a new table is added,” whose relevant acceptance evidence is The new matching object is protected without an individual table policy.

That observation is a valid indicator for “A masking policy uses hard-coded individual usernames and becomes hard to maintain” when using Use approved role/group or governed-tag based policy conditions. The scenario instead tests “An ABAC policy applies to an entire schema but a new table is added”; the relevant result is The new matching object is protected without an individual table policy.

A query without an explicit WHERE clause still returns only permitted rows pertains to a different control (Replace voluntary query filtering with an enforced UC row filter policy) and a different need (A migration incorrectly relies on WHERE conditions added by individual analysts). It cannot establish that Tag the new table/columns appropriately under the scoped policy met the stated goal.

That observation is a valid indicator for “All columns labeled confidential should receive consistent dynamic masking across several schemas” when using Create a governed tag and ABAC column-mask policy at the appropriate hierarchy. The scenario instead tests “An ABAC policy applies to an entire schema but a new table is added”; the relevant result is The new matching object is protected without an individual table policy.

This action solves a different issue: “An ABAC policy applies to an entire schema but a new table is added.” Its normal signal is The new matching object is protected without an individual table policy. Here the requested behavior is “A masked column is still exposed because the consumer uses unsupported older compute,” so that signal is not sufficient.

The alternative Add schema-evolution QA and governed-tag classification checks has a distinct purpose—The team needs to prove masked columns remain protected after a new data column appears. It would not establish the required outcome (A masked column is still exposed because the consumer uses unsupported older compute); the necessary verification concerns Queries execute with the configured ABAC protection on supported compute.

Return the declared column-compatible type from the mask UDF belongs to the separate case “A masking function returns the wrong data type for a protected numeric column,” where The table query succeeds and preserves the expected schema would be expected. That differs from the condition in this stem: “A masked column is still exposed because the consumer uses unsupported older compute.”

Only authorized tag managers assign the attributes that drive the policy pertains to a different control (Replace it with controlled governed tags in the supported ABAC policy) and a different need (An ungoverned free-text tag is being used for security enforcement). It cannot establish that Move the workload to supported serverless or compatible runtime/access-mode compute met the stated goal.

A new sensitive column receives the required mask before consumer access would demonstrate the separate action Add schema-evolution QA and governed-tag classification checks, which addresses “The team needs to prove masked columns remain protected after a new data column appears.” It does not verify the requirement “A masked column is still exposed because the consumer uses unsupported older compute” following Move the workload to supported serverless or compatible runtime/access-mode compute.

This signal belongs to the adjacent case “A job's service identity should read only the catalog tables it needs,” whose remedy is Grant minimum UC USE and SELECT privileges on the exact required objects. The observed result for the present requirement is Queries execute with the configured ABAC protection on supported compute.

This action solves a different issue: “A birth date should be coarsened to an age band to reduce identification risk.” Its normal signal is The partner sees only the allowed age band rather than full date. Here the requested behavior is “An overly broad ABAC rule unexpectedly masks low-risk columns,” so that signal is not sufficient.

This action solves a different issue: “The team needs to prove masked columns remain protected after a new data column appears.” Its normal signal is A new sensitive column receives the required mask before consumer access. Here the requested behavior is “An overly broad ABAC rule unexpectedly masks low-risk columns,” so that signal is not sufficient.

This action solves a different issue: “An ABAC policy applies to an entire schema but a new table is added.” Its normal signal is The new matching object is protected without an individual table policy. Here the requested behavior is “An overly broad ABAC rule unexpectedly masks low-risk columns,” so that signal is not sufficient.

This signal belongs to the adjacent case “An ABAC policy applies to an entire schema but a new table is added,” whose remedy is Tag the new table/columns appropriately under the scoped policy. The observed result for the present requirement is Only columns with the intended classification are masked.

A new sensitive column receives the required mask before consumer access pertains to a different control (Add schema-evolution QA and governed-tag classification checks) and a different need (The team needs to prove masked columns remain protected after a new data column appears). It cannot establish that Refine the governed-tag match condition or classification met the stated goal.

Cross-tenant test rows are excluded according to the intended policy would demonstrate the separate action Fix the row-filter mapping to the authoritative tenant column, which addresses “One table has several different tenant columns and the wrong field was used for enforcement.” It does not verify the requirement “An overly broad ABAC rule unexpectedly masks low-risk columns” following Refine the governed-tag match condition or classification.