Architecture must choose Unity Catalog controls for a multi-agency courts data product that needs row isolation, redaction, tagged policies, and partner exchange. Which combination fits?
Select an answer to reveal the explanation.
Short Explanation
Multi-agency courts data is a toolbox job—row filters, masks, ABAC tags, and Delta Sharing each handle a different lock on the same product. You'll lose governed exchange if you've only got external locations, and you'll lose tagged, dynamic control if you're stuck with table grants, view masking, or credential vending even with Delta Sharing.
Full Explanation
Row filters, column masks, ABAC with tags, and secure Delta Sharing as needed form the correct Unity Catalog control combination for a multi-agency courts data product that requires row isolation, redaction, tagged policies, and partner exchange. Complex civic products rarely have a single knob; filters isolate rows by agency or role, masks redact sensitive columns, ABAC evaluates tags for who may access which objects, and Delta Sharing exchanges approved products with partners without opening the home metastore.
Row filters, column masks, ABAC with tags, and governed external locations as needed fail on partner exchange because governed external locations only govern storage paths inside the metastore and do not provide secure cross-metastore exchange, so partners would not receive the governed shared product. Table ACL grants, view-based masking, account groups, and Delta Sharing as needed fail because table grants with static view-based masking and account groups lack dynamic row filters, column masks, and centralized tag-based ABAC, so row isolation, redaction, and tagged policies are not enforced even though exchange uses Delta Sharing. Row filters, column masks, storage credential vending, and Delta Sharing as needed fall short because storage credential vending controls storage access, not tagged policies, so it cannot replace ABAC with tags for who may access which objects.
Exam caveat: These controls are complementary layers, not synonyms. Using only Delta Sharing without row filters may overshare rows to a partner; using only masks without ABAC may still expose objects to the wrong agencies. Exam scenarios that list multiple simultaneous needs usually expect the combined UC toolkit rather than a governed-external-location substitute, table-grant and view-masking substitute, or storage-credential-vending workaround.
Operational check: Map each requirement to a control (isolation→row filter, redaction→mask, tagged access→ABAC, partner exchange→Delta Sharing), configure them on the courts product, test cross-agency queries for correct row and column visibility, and validate partner recipients see only the shared product.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.