During a design review, an architect asks which choice best matches the IBM guidance. The team is focused on access control. Which recommendation is most appropriate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal: access control in IBM watsonx.data is the bouncer at the door — it decides who gets in, what they can touch, and what operations they can perform. Granting broad admin rights to everyone 'for convenience' is the data engineering equivalent of giving all employees a master key to the building. You will regret it the moment someone drops a table they shouldn't have touched.
Full explanation below image
Full Explanation
IBM watsonx.data implements access control through role-based access control (RBAC) integrated with IBM IAM, Apache Ranger policies, and catalog-level grants that control which users, groups, and engines can access specific schemas, tables, columns, and rows. The correct answer — setting permissions so users and engines can access only the data and operations they are allowed — reflects the principle of least privilege that underpins every enterprise data governance framework. Granting broad admin rights for convenience (Option A) violates least privilege, creates insider threat risks, and will fail regulatory compliance audits for GDPR, HIPAA, and SOC 2. Putting sensitive filters in optional dashboard notes (Option B) is security theater — notes are readable by anyone with dashboard access and provide zero enforcement; filters must be implemented as catalog policies or row-level security rules. Using object names as the only security boundary (Option C) means any user who guesses or learns a table name can query it — naming conventions are discoverability tools, not security controls. The certification expects candidates to design access control at the IAM, catalog, and engine policy layers rather than relying on naming conventions or informal notes.