A finance team asks to control who can read a sensitive table in the lakehouse. Where should that control be applied?
Select an answer to reveal the explanation.
Short Explanation
Put the control where every engine has to pass through it. Anything applied further out—a dashboard, a bucket key, a promise—protects one path and leaves the others wide open.
Full Explanation
Access control belongs in the platform's access control layer, expressed as a policy on the catalog, schema or table. Because every engine resolves data through that layer, the policy is enforced regardless of whether the user arrives through a query workspace, a BI tool or an API.
Hiding columns in a BI dashboard is presentation, not protection. Anyone with query access to the underlying table reads it directly.
Bucket-level keys operate on files rather than tables, cannot express column or row conditions, and hand out credentials that bypass the table abstraction entirely.
An agreement with analysts that they will not query the table is an unenforced convention, not a control, and it produces no audit evidence when someone asks who could see the data.
For the exam, put access control in the governance layer where all engines are subject to it.