Exam Bundle

That observation is a valid indicator for “A secret was accidentally printed in notebook output during debugging” when using Remove the output, rotate the exposed credential and prevent logging secrets. The scenario instead tests “A developer needs to test access without gaining permission to read the underlying secret”; the relevant result is Developer can run the permitted job but cannot list protected secret values.

This signal belongs to the adjacent case “A notebook currently stores a database password in plaintext source code,” whose remedy is Move the password to a secured secret scope or governed connection. The observed result for the present requirement is Developer can run the permitted job but cannot list protected secret values.

That observation is a valid indicator for “A scheduled job must use a managed identity or service principal instead of an employee's token” when using Configure the job's supported service-principal identity and least privileges. The scenario instead tests “A developer needs to test access without gaining permission to read the underlying secret”; the relevant result is Developer can run the permitted job but cannot list protected secret values.

The alternative Review available workspace audit events for permissions and actors has a distinct purpose—Auditors require a record of changes to workspace permissions. It would not establish the required outcome (A group should be able to run a production job but not edit its definition); the necessary verification concerns The group starts permitted runs but cannot mutate job settings.

Grant minimum UC USE and SELECT privileges on the exact required objects is appropriate when “A job's service identity should read only the catalog tables it needs”; it would be verified by Job reads target tables and fails queries on unrelated restricted tables. It does not directly satisfy “A group should be able to run a production job but not edit its definition,” whose relevant acceptance evidence is The group starts permitted runs but cannot mutate job settings.

The alternative Restrict folder and notebook edit ACLs to the authorized deploy identity has a distinct purpose—A development user can accidentally modify a production workspace notebook. It would not establish the required outcome (A group should be able to run a production job but not edit its definition); the necessary verification concerns The group starts permitted runs but cannot mutate job settings.

The audit record identifies who changed the ACL and when would demonstrate the separate action Review available workspace audit events for permissions and actors, which addresses “Auditors require a record of changes to workspace permissions.” It does not verify the requirement “A group should be able to run a production job but not edit its definition” following Grant the appropriate run permission without job management rights.

Job reads target tables and fails queries on unrelated restricted tables pertains to a different control (Grant minimum UC USE and SELECT privileges on the exact required objects) and a different need (A job's service identity should read only the catalog tables it needs). It cannot establish that Grant the appropriate run permission without job management rights met the stated goal.

Unauthorized edits fail while approved deployments still work would demonstrate the separate action Restrict folder and notebook edit ACLs to the authorized deploy identity, which addresses “A development user can accidentally modify a production workspace notebook.” It does not verify the requirement “A group should be able to run a production job but not edit its definition” following Grant the appropriate run permission without job management rights.

This action solves a different issue: “A group should be able to run a production job but not edit its definition.” Its normal signal is The group starts permitted runs but cannot mutate job settings. Here the requested behavior is “A development user can accidentally modify a production workspace notebook,” so that signal is not sufficient.

Separate deployer service principal management rights from analyst view rights is appropriate when “Production deployment automation needs to modify jobs while analysts need view-only access”; it would be verified by Deployment updates work only under deployer identity. It does not directly satisfy “A development user can accidentally modify a production workspace notebook,” whose relevant acceptance evidence is Unauthorized edits fail while approved deployments still work.

Review available workspace audit events for permissions and actors belongs to the separate case “Auditors require a record of changes to workspace permissions,” where The audit record identifies who changed the ACL and when would be expected. That differs from the condition in this stem: “A development user can accidentally modify a production workspace notebook.”

This signal belongs to the adjacent case “Production deployment automation needs to modify jobs while analysts need view-only access,” whose remedy is Separate deployer service principal management rights from analyst view rights. The observed result for the present requirement is Unauthorized edits fail while approved deployments still work.

This signal belongs to the adjacent case “A job's service identity should read only the catalog tables it needs,” whose remedy is Grant minimum UC USE and SELECT privileges on the exact required objects. The observed result for the present requirement is Unauthorized edits fail while approved deployments still work.

This signal belongs to the adjacent case “Auditors require a record of changes to workspace permissions,” whose remedy is Review available workspace audit events for permissions and actors. The observed result for the present requirement is Unauthorized edits fail while approved deployments still work.

Review available workspace audit events for permissions and actors belongs to the separate case “Auditors require a record of changes to workspace permissions,” where The audit record identifies who changed the ACL and when would be expected. That differs from the condition in this stem: “A job's service identity should read only the catalog tables it needs.”

Separate deployer service principal management rights from analyst view rights belongs to the separate case “Production deployment automation needs to modify jobs while analysts need view-only access,” where Deployment updates work only under deployer identity would be expected. That differs from the condition in this stem: “A job's service identity should read only the catalog tables it needs.”

The alternative Grant the appropriate run permission without job management rights has a distinct purpose—A group should be able to run a production job but not edit its definition. It would not establish the required outcome (A job's service identity should read only the catalog tables it needs); the necessary verification concerns Job reads target tables and fails queries on unrelated restricted tables.

Deployment updates work only under deployer identity pertains to a different control (Separate deployer service principal management rights from analyst view rights) and a different need (Production deployment automation needs to modify jobs while analysts need view-only access). It cannot establish that Grant minimum UC USE and SELECT privileges on the exact required objects met the stated goal.

The audit record identifies who changed the ACL and when would demonstrate the separate action Review available workspace audit events for permissions and actors, which addresses “Auditors require a record of changes to workspace permissions.” It does not verify the requirement “A job's service identity should read only the catalog tables it needs” following Grant minimum UC USE and SELECT privileges on the exact required objects.

That observation is a valid indicator for “A development user can accidentally modify a production workspace notebook” when using Restrict folder and notebook edit ACLs to the authorized deploy identity. The scenario instead tests “A job's service identity should read only the catalog tables it needs”; the relevant result is Job reads target tables and fails queries on unrelated restricted tables.

The alternative Grant minimum UC USE and SELECT privileges on the exact required objects has a distinct purpose—A job's service identity should read only the catalog tables it needs. It would not establish the required outcome (Production deployment automation needs to modify jobs while analysts need view-only access); the necessary verification concerns Deployment updates work only under deployer identity.

This action solves a different issue: “A development user can accidentally modify a production workspace notebook.” Its normal signal is Unauthorized edits fail while approved deployments still work. Here the requested behavior is “Production deployment automation needs to modify jobs while analysts need view-only access,” so that signal is not sufficient.

Review available workspace audit events for permissions and actors is appropriate when “Auditors require a record of changes to workspace permissions”; it would be verified by The audit record identifies who changed the ACL and when. It does not directly satisfy “Production deployment automation needs to modify jobs while analysts need view-only access,” whose relevant acceptance evidence is Deployment updates work only under deployer identity.

This signal belongs to the adjacent case “Auditors require a record of changes to workspace permissions,” whose remedy is Review available workspace audit events for permissions and actors. The observed result for the present requirement is Deployment updates work only under deployer identity.

This signal belongs to the adjacent case “A group should be able to run a production job but not edit its definition,” whose remedy is Grant the appropriate run permission without job management rights. The observed result for the present requirement is Deployment updates work only under deployer identity.

Job reads target tables and fails queries on unrelated restricted tables would demonstrate the separate action Grant minimum UC USE and SELECT privileges on the exact required objects, which addresses “A job's service identity should read only the catalog tables it needs.” It does not verify the requirement “Production deployment automation needs to modify jobs while analysts need view-only access” following Separate deployer service principal management rights from analyst view rights.

This action solves a different issue: “A development user can accidentally modify a production workspace notebook.” Its normal signal is Unauthorized edits fail while approved deployments still work. Here the requested behavior is “Auditors require a record of changes to workspace permissions,” so that signal is not sufficient.

Grant minimum UC USE and SELECT privileges on the exact required objects belongs to the separate case “A job's service identity should read only the catalog tables it needs,” where Job reads target tables and fails queries on unrelated restricted tables would be expected. That differs from the condition in this stem: “Auditors require a record of changes to workspace permissions.”

The alternative Separate deployer service principal management rights from analyst view rights has a distinct purpose—Production deployment automation needs to modify jobs while analysts need view-only access. It would not establish the required outcome (Auditors require a record of changes to workspace permissions); the necessary verification concerns The audit record identifies who changed the ACL and when.

That observation is a valid indicator for “Production deployment automation needs to modify jobs while analysts need view-only access” when using Separate deployer service principal management rights from analyst view rights. The scenario instead tests “Auditors require a record of changes to workspace permissions”; the relevant result is The audit record identifies who changed the ACL and when.

The group starts permitted runs but cannot mutate job settings would demonstrate the separate action Grant the appropriate run permission without job management rights, which addresses “A group should be able to run a production job but not edit its definition.” It does not verify the requirement “Auditors require a record of changes to workspace permissions” following Review available workspace audit events for permissions and actors.

That observation is a valid indicator for “A job's service identity should read only the catalog tables it needs” when using Grant minimum UC USE and SELECT privileges on the exact required objects. The scenario instead tests “Auditors require a record of changes to workspace permissions”; the relevant result is The audit record identifies who changed the ACL and when.