Question 810
An enterprise defines UC catalog and schema governance for finance and marketing teams. An auditor must prove the outcome of Revoke the principal or group grant at its effective securable scope for this requirement: One principal's access must be revoked without removing all collaborators. Which test result is best?
Explanation
Correct Answer
The team used Revoke the principal or group grant at its effective securable scope to fulfill “One principal's access must be revoked without removing all collaborators.” Observing The revoked identity loses access while other authorized readers remain confirms the intended effect in the resulting workload.
Incorrect Answers
This signal belongs to the adjacent case “An external recipient should access only one approved aggregate table,” whose remedy is Scope the Delta Sharing share to the explicitly authorized object. The observed result for the present requirement is The revoked identity loses access while other authorized readers remain.
The provenance chain shows the input and governed output dependency pertains to a different control (Inspect supported column-level lineage and associated policy metadata) and a different need (One column must be traced through a masked transformation into an aggregate). It cannot establish that Revoke the principal or group grant at its effective securable scope met the stated goal.
The authorized query executes with parent-use and object-select grants pertains to a different control (Grant the necessary USE permissions on enclosing catalog and schema) and a different need (A team receives SELECT on a table but fails with insufficient parent object privileges). It cannot establish that Revoke the principal or group grant at its effective securable scope met the stated goal.