Databricks Certified Data Analyst Associate free question 10 / 10 · Domain 9: Securing Data
A data owner grants SELECT on the schema sales.reporting to the group analysts, who already have USE CATALOG and USE SCHEMA. Next week a new table is created in that schema. Can the analysts read it?
- No; schema grants cover only the tables that existed at grant time.
- Yes, but not until the owner of the new table runs GRANT once more.
- Yes; a privilege on a schema applies to current and future child objects.
- No; SELECT has to be granted on each table, since grants are per table.
Show the answer and explanation
Answer: C
Why this is correct
Privilege inheritance is a key feature of the Unity Catalog permissions model. When you grant a privilege on a parent object, it automatically applies to all current and future child objects; a privilege on a schema applies to all tables, views, volumes and functions in it. With USE CATALOG and USE SCHEMA in place, the analysts can read the new table without another grant.
Why the other options are wrong
"No; schema grants cover only the tables that existed at grant time." … Inheritance is not limited to existing objects. The page says a privilege on a parent applies to all current and future child objects.
"No; SELECT has to be granted on each table, since grants are per table." … Grants can be made on a container. A privilege granted on a schema applies to the tables, views, volumes and functions in it.
"Yes, but not until the owner of the new table runs GRANT once more." … No new grant is needed. The schema grant reaches the new table through inheritance as soon as it exists.
Denials inherit too
The page adds that denials inherit downward the same way, whether set with GRANT or through ABAC policies. Privileges granted on the metastore itself, by contrast, do not inherit to child objects.