Question 750
A global platform team controls a large population of confidential UC datasets. An auditor must prove the outcome of Refine the governed-tag match condition or classification for this requirement: An overly broad ABAC rule unexpectedly masks low-risk columns. Which test result is best?
Explanation
Correct Answer
Only columns with the intended classification are masked directly measures whether Refine the governed-tag match condition or classification achieved the requirement “An overly broad ABAC rule unexpectedly masks low-risk columns.” It checks the operating result rather than just a configured resource name.
Incorrect Answers
This signal belongs to the adjacent case “An ABAC policy applies to an entire schema but a new table is added,” whose remedy is Tag the new table/columns appropriately under the scoped policy. The observed result for the present requirement is Only columns with the intended classification are masked.
A new sensitive column receives the required mask before consumer access pertains to a different control (Add schema-evolution QA and governed-tag classification checks) and a different need (The team needs to prove masked columns remain protected after a new data column appears). It cannot establish that Refine the governed-tag match condition or classification met the stated goal.
Cross-tenant test rows are excluded according to the intended policy would demonstrate the separate action Fix the row-filter mapping to the authoritative tenant column, which addresses “One table has several different tenant columns and the wrong field was used for enforcement.” It does not verify the requirement “An overly broad ABAC rule unexpectedly masks low-risk columns” following Refine the governed-tag match condition or classification.