Exam Bundle

This signal belongs to the adjacent case “A streaming pipeline must not emit personal data to an external unapproved sink,” whose remedy is Restrict sink selection and enforce data-classification checks before publishing. The observed result for the present requirement is Analysts can query safe aggregate data but are denied direct raw-table access.

Test input PII is unreadable to unauthorized silver consumers pertains to a different control (Apply governed masking/transformation at the silver promotion boundary) and a different need (New source rows containing PII must be masked before entering the shared silver table). It cannot establish that Use UC object grants and downstream projection to separate raw and aggregate access met the stated goal.

The current serving table no longer contains the erased customer would demonstrate the separate action Apply ordered CDC deletion handling to the curated target and downstream purge policy, which addresses “A deletion event arrives after a customer's record was previously emitted.” It does not verify the requirement “The original raw table must remain in restricted bronze while analysts query safe gold aggregates” following Use UC object grants and downstream projection to separate raw and aggregate access.

Scope the Delta Sharing share to the explicitly authorized object is appropriate when “An external recipient should access only one approved aggregate table”; it would be verified by The recipient can query the permitted aggregate but not raw datasets. It does not directly satisfy “Analysts need to list and access approved tables under a catalog and schema,” whose relevant acceptance evidence is The analyst can select allowed tables but not ungranted tables.

The alternative Revoke the principal or group grant at its effective securable scope has a distinct purpose—One principal's access must be revoked without removing all collaborators. It would not establish the required outcome (Analysts need to list and access approved tables under a catalog and schema); the necessary verification concerns The analyst can select allowed tables but not ungranted tables.

Record and enforce the approved retention and lifecycle metadata belongs to the separate case “An audit requires a documented retention policy for a catalog table,” where Owners can verify both documented retention and actual cleanup jobs would be expected. That differs from the condition in this stem: “Analysts need to list and access approved tables under a catalog and schema.”

That observation is a valid indicator for “Documentation differs between an old column name and current data contract” when using Update column comments and schema documentation after review. The scenario instead tests “Analysts need to list and access approved tables under a catalog and schema”; the relevant result is The analyst can select allowed tables but not ungranted tables.

The group can read new permitted objects according to inheritance pertains to a different control (Grant the appropriate supported privilege at the schema level) and a different need (New curated tables in one schema should be readable by a group under inherited grant policy). It cannot establish that Grant required USE CATALOG, USE SCHEMA and object-specific SELECT privileges met the stated goal.

That observation is a valid indicator for “An external recipient should access only one approved aggregate table” when using Scope the Delta Sharing share to the explicitly authorized object. The scenario instead tests “Analysts need to list and access approved tables under a catalog and schema”; the relevant result is The analyst can select allowed tables but not ungranted tables.

The alternative Revoke the principal or group grant at its effective securable scope has a distinct purpose—One principal's access must be revoked without removing all collaborators. It would not establish the required outcome (A team receives SELECT on a table but fails with insufficient parent object privileges); the necessary verification concerns The authorized query executes with parent-use and object-select grants.

This action solves a different issue: “An ETL transformation fails and an owner needs to identify its upstream data contract.” Its normal signal is The upstream asset and field contract associated with the transform are identified. Here the requested behavior is “A team receives SELECT on a table but fails with insufficient parent object privileges,” so that signal is not sufficient.

Update appropriate UC ownership and grants through governed change control belongs to the separate case “A source table owner changes but permissions should remain explicit and traceable,” where New ownership and effective privileges match the approved policy would be expected. That differs from the condition in this stem: “A team receives SELECT on a table but fails with insufficient parent object privileges.”

The role can administer authorized grants but cannot read ungranted data pertains to a different control (Separate MANAGE administration privilege from SELECT data privileges) and a different need (An engineer should manage permissions but not automatically read every sensitive dataset). It cannot establish that Grant the necessary USE permissions on enclosing catalog and schema met the stated goal.

This signal belongs to the adjacent case “A source table owner changes but permissions should remain explicit and traceable,” whose remedy is Update appropriate UC ownership and grants through governed change control. The observed result for the present requirement is The authorized query executes with parent-use and object-select grants.

That observation is a valid indicator for “An ETL transformation fails and an owner needs to identify its upstream data contract” when using Use lineage with source schema descriptions and pipeline metadata. The scenario instead tests “A team receives SELECT on a table but fails with insufficient parent object privileges”; the relevant result is The authorized query executes with parent-use and object-select grants.

The alternative Revoke the principal or group grant at its effective securable scope has a distinct purpose—One principal's access must be revoked without removing all collaborators. It would not establish the required outcome (New curated tables in one schema should be readable by a group under inherited grant policy); the necessary verification concerns The group can read new permitted objects according to inheritance.

This action solves a different issue: “One column must be traced through a masked transformation into an aggregate.” Its normal signal is The provenance chain shows the input and governed output dependency. Here the requested behavior is “New curated tables in one schema should be readable by a group under inherited grant policy,” so that signal is not sufficient.

Apply appropriate business-domain naming, descriptions and tags belongs to the separate case “New data assets must appear in searches for a recognized business domain,” where A search returns the asset with relevant metadata would be expected. That differs from the condition in this stem: “New curated tables in one schema should be readable by a group under inherited grant policy.”

That observation is a valid indicator for “An external recipient should access only one approved aggregate table” when using Scope the Delta Sharing share to the explicitly authorized object. The scenario instead tests “New curated tables in one schema should be readable by a group under inherited grant policy”; the relevant result is The group can read new permitted objects according to inheritance.

The revoked identity loses access while other authorized readers remain would demonstrate the separate action Revoke the principal or group grant at its effective securable scope, which addresses “One principal's access must be revoked without removing all collaborators.” It does not verify the requirement “New curated tables in one schema should be readable by a group under inherited grant policy” following Grant the appropriate supported privilege at the schema level.

Owners can verify both documented retention and actual cleanup jobs pertains to a different control (Record and enforce the approved retention and lifecycle metadata) and a different need (An audit requires a documented retention policy for a catalog table). It cannot establish that Grant the appropriate supported privilege at the schema level met the stated goal.

Grant the necessary USE permissions on enclosing catalog and schema is appropriate when “A team receives SELECT on a table but fails with insufficient parent object privileges”; it would be verified by The authorized query executes with parent-use and object-select grants. It does not directly satisfy “An engineer should manage permissions but not automatically read every sensitive dataset,” whose relevant acceptance evidence is The role can administer authorized grants but cannot read ungranted data.

This action solves a different issue: “A shared dataset contains a newly added sensitive column.” Its normal signal is The recipient-visible schema excludes the restricted attribute. Here the requested behavior is “An engineer should manage permissions but not automatically read every sensitive dataset,” so that signal is not sufficient.

Assign controlled governed tags with approved tag values belongs to the separate case “Columns with sensitive classifications need consistent discoverable labels,” where Catalog metadata shows the intended classification tags would be expected. That differs from the condition in this stem: “An engineer should manage permissions but not automatically read every sensitive dataset.”

This signal belongs to the adjacent case “Columns with sensitive classifications need consistent discoverable labels,” whose remedy is Assign controlled governed tags with approved tag values. The observed result for the present requirement is The role can administer authorized grants but cannot read ungranted data.

The partner's previous credential cannot read the dataset would demonstrate the separate action Revoke its share recipient credentials or share permissions, which addresses “A former partner's sharing authorization expires.” It does not verify the requirement “An engineer should manage permissions but not automatically read every sensitive dataset” following Separate MANAGE administration privilege from SELECT data privileges.

The authorized query executes with parent-use and object-select grants pertains to a different control (Grant the necessary USE permissions on enclosing catalog and schema) and a different need (A team receives SELECT on a table but fails with insufficient parent object privileges). It cannot establish that Separate MANAGE administration privilege from SELECT data privileges met the stated goal.

The alternative Scope the Delta Sharing share to the explicitly authorized object has a distinct purpose—An external recipient should access only one approved aggregate table. It would not establish the required outcome (One principal's access must be revoked without removing all collaborators); the necessary verification concerns The revoked identity loses access while other authorized readers remain.

Use lineage with source schema descriptions and pipeline metadata is appropriate when “An ETL transformation fails and an owner needs to identify its upstream data contract”; it would be verified by The upstream asset and field contract associated with the transform are identified. It does not directly satisfy “One principal's access must be revoked without removing all collaborators,” whose relevant acceptance evidence is The revoked identity loses access while other authorized readers remain.

Grant the necessary USE permissions on enclosing catalog and schema is appropriate when “A team receives SELECT on a table but fails with insufficient parent object privileges”; it would be verified by The authorized query executes with parent-use and object-select grants. It does not directly satisfy “One principal's access must be revoked without removing all collaborators,” whose relevant acceptance evidence is The revoked identity loses access while other authorized readers remain.

This signal belongs to the adjacent case “An external recipient should access only one approved aggregate table,” whose remedy is Scope the Delta Sharing share to the explicitly authorized object. The observed result for the present requirement is The revoked identity loses access while other authorized readers remain.

The provenance chain shows the input and governed output dependency pertains to a different control (Inspect supported column-level lineage and associated policy metadata) and a different need (One column must be traced through a masked transformation into an aggregate). It cannot establish that Revoke the principal or group grant at its effective securable scope met the stated goal.

The authorized query executes with parent-use and object-select grants pertains to a different control (Grant the necessary USE permissions on enclosing catalog and schema) and a different need (A team receives SELECT on a table but fails with insufficient parent object privileges). It cannot establish that Revoke the principal or group grant at its effective securable scope met the stated goal.