OneLake Row, Column, and Folder Security: 10 practice questions

Question 1 of 10

A role hides two columns of a table. A member runs `SELECT *` on the table in a Spark notebook and gets a result. The same member runs the same query in the SQL analytics endpoint. What happens there?

1. AThe query returns only the allowed columns
2. BThe query returns the hidden columns filled with nulls
3. CThe query succeeds, and the hidden columns show their names only
4. DThe query returns an error

Question 2 of 10

After a table change, a row rule in a OneLake security role references a column that is no longer in the table. What do members of the role get when they query the table?

1. AThe rule is skipped and all rows are returned
2. BThe last result that was valid is returned from a cache
3. CThe missing column is added with null values
4. DThe query fails and returns no data

Question 3 of 10

The same group of users must see only the rows of their region in a Delta Parquet table and must not see its Salary column. How should the two rules be placed so that queries work?

1. AThe row rule in one role, the column rule in a second
2. BThe column rule in a Read role and the row rule in a ReadWrite role
3. CThe row rule and the column rule in one OneLake security role
4. DThe row rule in a role and a folder grant that leaves out Salary

Question 4 of 10

In a lakehouse, the folder `Files/Raw` contains the folder `Sales`, the folder `HR`, and the file `budget.csv`. A role grants Read on `Files/Raw/Sales` and on nothing else. What can a member of the role do?

1. ARead the files directly in `Sales`, but not the subfolders that `Sales` contains
2. BRead everything under `Raw`, because a grant on a folder extends to its parent
3. CRead nothing, until a second role also grants Read on `Raw` and on `Files`
4. DRead everything under `Sales` and traverse `Raw`, without seeing `HR` or `budget.csv`

Question 5 of 10

A workspace Viewer belongs to Role1, which allows the columns Region and Revenue of the Sales table, and to Role2, which allows Region and Target. Neither role has row rules. The Viewer reads Sales in a Spark notebook and in the SQL analytics endpoint. Which columns can the Viewer read?

1. AAll three columns in both, because roles combine as a union
2. BAll three columns in Spark, and only Region in the endpoint
3. COnly Region in both, because hidden columns work as a deny
4. DOnly Region in Spark, and all three columns in the endpoint

Question 6 of 10

A lakehouse table has a row rule in a OneLake security role. A workspace Contributor who is a member of the role sees every row of the table in a Spark notebook, but fewer rows in the SQL analytics endpoint, which uses user identity mode. How should the team read this?

1. AAs expected, because in this mode row rules are enforced for all users
2. BAs a sync error, because roles never restrict a workspace Contributor
3. CAs a SQL permission problem, because a `GRANT` on the table is missing
4. DAs a caching delay, because the notebook will show fewer rows in an hour

Question 7 of 10

A workspace Viewer belongs to one OneLake security role, which grants the tables of the `sales` schema. In the object explorer of the SQL analytics endpoint, the Viewer also sees a schema named `hr`, with no tables in it. What explains this?

1. AThe endpoint lists every schema name and hides only the unreadable tables
2. BThe role is misconfigured, because a schema without a grant must stay hidden
3. CTraversal opens `hr`, because it is a sibling of the granted schema
4. DThe `hr` tables are still synchronizing and will appear after a short wait

Question 8 of 10

A Sales table has four rows: order 1 (Amount 50000, State CA), order 2 (Amount 72000, State CA), order 3 (Amount 90000, State WA), and order 4 (Amount 30000, State CA). A OneLake security role has the row rule `SELECT * FROM Sales WHERE Amount > 50000 AND State='CA'`. A workspace Viewer is in this role and in no other. Which orders does the Viewer see?

1. AOrder 2 and no other
2. BOrders 2 and 3
3. COrders 1 and 2
4. DOrders 1, 2, 3, and 4

Question 9 of 10

A OneLake security role allows the columns CustomerID, Name, and Country of the Customers table and hides the others. Viewers in the role query the table through a SQL analytics endpoint in user identity mode. An engineer renames Country to CountryCode in the table, and the Viewers lose all access to Customers. The new column name must stay. What restores their access?

1. AWait for the security sync, which applies the new column name to the role
2. BRename the column back to Country, so the allow list matches the table again
3. CUpdate the column rule of the role, in the lakehouse where the role was created
4. DRun `GRANT SELECT` on the CountryCode column for the Viewers at the endpoint

Question 10 of 10

A Delta Parquet table has a row rule in a OneLake security role. An engineer renames the table. What is the risk?

1. AThe rule no longer applies to the table, and data can be exposed
2. BThe rule follows the table, because roles are tied to its folder
3. CThe table is blocked for all users until the old name is restored
4. DThe rule moves to the new name with the next security sync