City security must determine who queried resident address tables last quarter. What should the team enable for Unity Catalog access?

Configuring audit logging so security can review who accessed municipal PII tables is the correct action when city security must determine who queried resident address tables last quarter. Azure Databricks audit logs capture principal, action, and object context for Unity Catalog access, enabling retrospective investigations over a quarterly window without trusting memory or informal notes. Configuring table change feeds so security can review who accessed municipal PII tables misses the point because change feeds track row-level inserts, updates, and deletes for downstream processing, not which principal queried resident address tables last quarter, so it cannot supply the access evidence security needs. Configuring data masking rules so security can review who accessed municipal PII tables is the wrong tool because masking rules redact sensitive column values going forward, they do not create an auditable record of who queried resident address tables last quarter. Configuring Delta Sharing feeds so security can review who accessed municipal PII tables does not answer the question, because Delta Sharing feeds distribute data to external recipients rather than recording table-level access events for resident address tables.

Exam caveat: Audit logging answers who did what when; it does not by itself prevent access. Prevention still requires privileges, ABAC, filters, and masks. Retention of audit logs should cover at least the review period (here, last quarter) plus investigation buffer. Logs may need export to a SIEM for long-term municipal security operations.

Operational check: Confirm audit logging is enabled for Unity Catalog access events, query or export logs for the prior quarter filtered to resident address tables, identify distinct principals and actions, and reconcile unexpected accessors against approved civic roles before closing the quarterly review.