Public works wants attribute-based access so sensitivity and department attributes decide who can read utility datasets. What should they configure in Unity Catalog?
Select an answer to reveal the explanation.
Short Explanation
ABAC is like badge rules on a public-works gate—tags for sensitivity and department drive the policy instead of rewriting every lock by hand. You'll still miss attribute-based control if you tag but let the policy check only group membership or you just grant SELECT to department groups. You'll also miss it if you rely on column masks that evaluate user groups, because you're shaping columns after access while the tags never drive who can read.
Full Explanation
Tagging utility datasets with sensitivity and department attributes and applying ABAC policies that evaluate those tags is the correct Unity Catalog approach when public works wants attribute-based access. ABAC binds access decisions to object and principal attributes rather than endless per-user ACL edits; sensitivity and department tags become the policy inputs that decide who can read which utility datasets as civic staffing and classification change.
Tagging datasets with sensitivity and department attributes but applying ABAC policies that evaluate only group membership misses attribute-based access because the policy ignores the sensitivity and department tags and falls back to group-scoped decisions. Tagging datasets with sensitivity and department attributes but granting SELECT on tables to department groups leaves those tags unused for decisions and relies on static table ACLs rather than dynamic ABAC policies that evaluate the attributes. Tagging datasets with sensitivity and department attributes but applying column masks that evaluate user groups is still group-scoped masking that reshapes column visibility after access is granted and does not let sensitivity and department tags drive who can read which objects.
Exam caveat: ABAC complements—not replaces—base privileges. Tags without policies do nothing; policies without consistent tagging on datasets and principals yield gaps or over-permits. ABAC is also distinct from column masks that evaluate user groups: tags drive who may access which objects under policy, while masks reshape column visibility after access is granted.
Operational check: Confirm utility tables carry sensitivity and department tags, verify the ABAC policy references those attributes, test a principal whose attributes should allow read versus one that should deny, and ensure new datasets inherit the same tagging convention before they are published to public-works consumers.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.