A school-district attendance pipeline must run under a non-human identity that is granted Unity Catalog access to attendance schemas. Which pattern should they implement?
Select an answer to reveal the explanation.
Short Explanation
Enroll a service principal in Entra, then hand it the Unity Catalog keys only for attendance schemas—like a district robot account with a limited hallway pass. If you grant it Unity Catalog privileges on the share, you'll miss the schema-level grant that's required and you won't have least-privilege access. If you grant it privileges on the storage credential or the external location, you still won't unlock Unity Catalog data since those control storage access and don't grant schema privileges.
Full Explanation
A school-district attendance pipeline should use a Microsoft Entra service principal registered for the job and granted Unity Catalog privileges only on the attendance schemas it must read/write. That non-human identity pattern supports scheduled ETL, auditable runs, and credential rotation without shared personal logins. Think of a district robot account with a limited hallway pass to attendance—not master keys to the education metastore.
Granting the pipeline's service principal Unity Catalog privileges on the attendance share instead of on the attendance schemas mis-scopes the grant; shares govern Delta Sharing to external recipients, so a share-level grant does not deliver direct least-privilege read/write access to the attendance schemas. Granting the pipeline's service principal Unity Catalog privileges on the attendance storage credential mis-scopes the grant; storage credentials govern access to the cloud storage identity used for external locations, so a credential-level grant does not confer data privileges on the attendance schemas themselves. Granting the pipeline's service principal Unity Catalog privileges on the attendance external location mis-scopes the grant; external locations govern access to the underlying cloud storage path, so an external-location grant does not deliver governed read/write privileges on the attendance schemas themselves.
Exam caveat: creating the SP is insufficient until UC grants (and any storage/Key Vault roles) are applied; share, storage credential, or external location grants are not the Unity Catalog least-privilege path for ordinary pipelines. Prefer groups for humans and SPs for automation, with separate privileges. Operational check: create the Entra SP, grant USE/MODIFY as needed on attendance schemas only, configure the Databricks job to run as that SP, validate attendance loads, and confirm the SP cannot alter unrelated district catalogs.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.