A team relies on obscure table names to keep sensitive data from being found. Why is this inadequate?
Select an answer to reveal the explanation.
Short Explanation
Security by obscurity isn't a control. If someone can browse the catalog or query the schema, they can find and read the object no matter what you call it. Put the control in access policy, not a weird name.
Full Explanation
Obscurity is not a control because naming is not an authorization mechanism. Catalog browsing and schema introspection reveal object names to anyone entitled to them, and entitlement—not obscurity—determines whether the data can be read. The claim that table names must follow a registered pattern, so obscure names are rejected, is incorrect because names are not constrained to a registered pattern. The claim that obscure names prevent the platform from applying lineage tracking is incorrect because lineage tracks assets and processing irrespective of naming. The claim that query engines cannot resolve names that do not describe their contents is incorrect because engines resolve identifiers as strings; descriptiveness is irrelevant to resolution. For the exam, treat security-by-obscurity as automatically wrong and put the control in the access policy.