A project lead is turning a proof of concept into a governed production workflow. For IBM Certified watsonx Data Lakehouse Engineer, the topic is access control. What should the team do?
Select an answer to reveal the explanation.
Short Explanation and Infographic
In watsonx.data, access control is enforced at the metadata catalog level, which means permissions set in the governance layer apply consistently whether a user queries through Presto, Spark, or an API client. The principle is least-privilege: scope permissions to the minimum data set each user or engine requires, and use role-based policies so changes propagate consistently. Granting blanket access across all tables trades short-term convenience for long-term compliance exposure.
Full explanation below image
Full Explanation
The correct answer is option D: Set permissions so users and engines can access only the data and operations they are allowed to use.. This aligns with IBM's Platform operations and administration guidance, which emphasizes set permissions so users and engines can access only the data and operations they are allowed to use as the recommended approach for production deployments. Option A (Grant broad admin rights for convenience) is incorrect because it either bypasses IBM's recommended architecture or introduces operational risk that the correct approach is specifically designed to avoid. Option B (Put sensitive filters in optional dashboard notes) is incorrect because it either bypasses IBM's recommended architecture or introduces operational risk that the correct approach is specifically designed to avoid. Option C (Use object names as the only security boundary) is incorrect because it either bypasses IBM's recommended architecture or introduces operational risk that the correct approach is specifically designed to avoid. Understanding this distinction is critical for the C9007300 exam: IBM watsonx.data is designed to enforce governance, performance, and operational best practices through its built-in architecture, and the correct answers consistently reflect those architectural constraints rather than shortcut alternatives.