Ensuring Data Security and Compliance1 / 5
A data engineer discovers that Unity Catalog audit logs show unauthorized access attempts to a sensitive production table. What steps should be taken to investigate and remediate?
CorrectIncorrect
Alex
Security investigation workflow: 1) Detect: alert on failed access attempts to sensitive tables. 2) Investigate: query audit logs for user identity, access patterns, and timing. 3) Assess: was the user's access attempt legitimate (e.g., wrong table name) or suspicious (repeated attempts on PII tables)? 4) Remediate: revoke excessive permissions (principle of least privilege), add monitoring alerts, implement row filters if data needs to be partially accessible. 5) Prevent: tag sensitive tables with classification tags, create data access policies tied to tags. 6) Report: document the incident, actions taken, and policy changes. Ongoing: schedule weekly audit log reviews for anomalous access patterns.
Sourcedocs.databricks.com
Follow-up answers are available in the app. Create a free account — no credit card required.
Question 1 of 5
Create a free account