Free Databricks Certified Data Engineer Associate Sample Questions

Correct answer: D — An all-purpose cluster, since it stays available for multiple users to attach notebooks and share libraries across an interactive session.

• A. A job cluster is created for a single scheduled job run and terminates when that run finishes, so it does not stay available for multiple data scientists to attach notebooks throughout the day. It is not intended for shared, ongoing interactive use.
• B. SQL warehouses are built to run SQL queries against Databricks SQL and do not support attaching general-purpose notebooks or installing arbitrary Python libraries for exploratory work. This makes them unsuitable for the described shared notebook workflow.
• C. Like other SQL warehouse tiers, Classic warehouses serve SQL queries rather than hosting attached notebooks or arbitrary library installs, so they do not match the described interactive multi-user notebook workflow. Notebook attachment is a cluster capability, not a SQL warehouse one.
• D. An all-purpose cluster is designed to remain running so multiple users can attach notebooks, share installed libraries, and run interactive exploratory queries without waiting for a fresh cluster to start. This directly matches the described collaborative workflow.

Correct answer: A — Attach a single Unity Catalog metastore to all three workspaces so grants, lineage, and audit logs apply consistently across them

• A. A single Unity Catalog metastore can be attached to multiple workspaces in the same region, so permissions, lineage, and audit logs defined once apply consistently across all attached workspaces.
• B. Manually duplicating catalogs and grants across separate metastores per workspace creates ongoing maintenance overhead and drift risk, which is exactly what a shared metastore is meant to avoid.
• C. Cluster policies control compute configuration such as instance types and autoscaling limits; they do not enforce data governance features like table grants, lineage, or audit logging.
• D. SQL warehouses execute queries under whatever governance layer is attached to the workspace; they do not independently define or enforce catalog-level access control across workspaces.

Correct answer: A — Configure the `writeStream` with `Trigger.AvailableNow`, which processes all files available at the start of the run and then stops the stream automatically.

• A. `Trigger.AvailableNow` processes all files that are available when the job starts and then stops the stream once they are handled, which matches the hourly scheduled batch-style pattern the engineer wants.
• B. Leaving the trigger unspecified does not produce a one-file-and-exit batch behavior; the default streaming trigger processes micro-batches continuously rather than stopping after one file.
• C. Omitting the schema location does not turn a streaming job into a batch job; it only removes the location Auto Loader uses to persist and evolve the inferred schema, and is required for most formats to avoid errors.
• D. `Trigger.Continuous` is designed for low-latency continuous processing and does not stop automatically when a directory becomes empty, which is the opposite of the stop-on-its-own behavior needed here.

Correct answer: A — `PATTERN = 'landing/2026/09/*.csv'` so the command matches only files under that prefix whose names end with the `.csv` extension using glob-style matching.

• A. This is correct. `PATTERN` accepts glob-style expressions, so restricting it to `*.csv` under the target prefix filters the source listing down to only the matching CSV files.
• B. This is incorrect. `FILES` expects a list of explicit file names rather than a glob expression, and it cannot be combined with wildcard matching to select a subset of files by extension.
• C. This is incorrect. There is no `extension` key recognized under `FORMAT_OPTIONS`; format options configure how a given file format is parsed, not which files are selected for the load.
• D. This is incorrect. `FILEFORMAT` tells `COPY INTO` which parser to use for the selected files; it does not filter the source listing by file extension, so non-CSV files would still be attempted.

Correct answer: A — A standard connector built as a custom Lakeflow Spark Declarative Pipeline, trading some automation for the flexibility to code custom extraction logic.

• A. Building a standard connector as a custom pipeline gives the team direct control over pagination, authentication headers, and retry logic in the extraction code, which is the flexibility a niche unsupported source requires, at the cost of some of the automation a managed connector would otherwise provide.
• B. A managed connector only supports a specific, prebuilt catalog of enterprise sources, so an unsupported niche REST API would not have a managed connector available for it regardless of the UI's simplicity.
• C. This SQL command loads files that are already staged in cloud object storage and has no ability to call a live REST API directly to retrieve data from it.
• D. This direct-write API is designed for applications to push individual records into Delta tables themselves, not for Databricks to poll and paginate through an external REST API on a schedule.

Correct answer: A — Check Databricks' regional feature support documentation, since managed connectors are not universally available across every region and workspace.

• A. Databricks documents that managed connectors are not available in every region, so the correct next step is checking regional feature support documentation rather than assuming the feature is universally present.
• B. Regional unavailability is a documented, standing limitation for some connectors, not a transient outage, so retrying without checking regional support docs is unlikely to resolve it.
• C. A regional limitation does not mean the source can never be ingested; the connector may be available in a supported region, or a standard connector approach may still work.
• D. Metastore location is a Unity Catalog governance concern and is not what Databricks documents as controlling managed connector regional availability.

Correct answer: A — `rescue`, which prevents schema evolution and captures unexpected columns in the rescued data column instead of failing the stream.

• A. The `rescue` mode is built exactly for this case: it blocks automatic schema evolution and instead captures unexpected column values in the rescued data column without ever failing the stream.
• B. The `none` mode avoids failure but simply ignores unexpected columns, meaning their values are not preserved anywhere, which fails the second requirement.
• C. The `addNewColumns` mode does preserve new columns by evolving the schema, but it still interrupts the stream with an exception, which fails the no-failure requirement.
• D. The `failOnNewColumns` mode does the opposite of what is needed, halting the stream indefinitely until a person manually supplies an updated schema.

Correct answer: A — Start with the most managed layer available, such as a managed connector, and drop to less-managed layers only if requirements aren't met.

• A. The recommended strategy is a layered approach: begin with the most managed option, such as a managed connector, and only move to standard, community, or custom options if that layer cannot meet the requirements.
• B. Building a custom connector before checking whether a managed or standard connector already covers the source inverts the recommended order and adds unnecessary engineering effort.
• C. Defaulting to a community connector regardless of whether a managed connector already supports the source skips the more automated, better-supported layer that should be tried first.
• D. Auto Loader is a strong fit for cloud object storage ingestion specifically, not a universal default for every source type such as SaaS applications or databases.

Correct answer: A — Increase the `fetchSize` option so each round trip to the source database returns a larger batch of rows, reducing the number of network round trips needed to pull the full result set.

• A. `fetchSize` directly controls how many rows the JDBC driver buffers per round trip, so raising it from a small default reduces the number of round trips needed and directly addresses the symptom described.
• B. Adding partitions increases the number of parallel connections used to split a scan by row range; it does not change the row batch size returned per round trip within any one connection.
• C. Choosing an unindexed `partitionColumn` affects how partition boundaries are computed and can hurt performance, but it has no direct effect on how many rows are returned per network round trip.
• D. `spark.sql.shuffle.partitions` governs shuffle behavior for wide Spark operations like joins and aggregations after data is loaded; it has no effect on JDBC round-trip batching during the read itself.

Correct answer: A — A schema hint such as `"user_info.dob DATE"` passed as a reader option to the stream

• A. Schema hints let you override the inferred type of a specific column path, including nested fields addressed with dot notation, while Auto Loader continues to infer the remaining schema automatically.
• B. Post-read casting on the full DataFrame changes the value's type only after inference has already happened for every field, so it does not target a single nested field during schema inference itself.
• C. A Lakeflow Spark Declarative Pipelines expectation validates or drops rows based on a condition at write time; it enforces a rule about the data rather than overriding the inferred column type during Auto Loader's schema inference step.
• D. `COPY INTO` is a separate batch-loading SQL command with its own `FORCE` option for reloading files, and it does not apply to an Auto Loader streaming read or provide per-field type overrides.

Correct answer: A — Spark raises an `AnalysisException` because `union` requires both DataFrames to have the same number of columns

• A. `union` requires both DataFrames to have the same number of columns with compatible types by position, so a 6-column DataFrame combined with a 5-column DataFrame raises an analysis error before any rows are combined.
• B. `union` does not perform schema reconciliation or fill in missing columns with null; a column count mismatch causes an error rather than an automatic null-filled merge.
• C. `union` does not silently drop columns to make schemas match; it strictly requires the same column count up front and fails when that is not the case.
• D. The operation does not complete successfully with a mismatched column count, so there is no resulting DataFrame with a column silently removed from its schema.

Correct answer: A — Write with `mode("overwrite")` and `saveAsTable` to fully replace the managed silver table on every single run

• A. `saveAsTable` with `mode("overwrite")` writes the DataFrame as a managed table under the given three-level name and replaces all existing rows on each run, matching the requirement to fully refresh the silver table.
• B. `append` mode adds the cleaned rows on top of whatever already exists in the table, which would duplicate previously written data instead of replacing it as the scenario requires.
• C. A temporary view only exists for the current Spark session and is never persisted as a table in Unity Catalog, so the cleaned data would disappear once the session ends.
• D. Writing CSV files to a local or object-store path creates plain files rather than a queryable Unity Catalog table, so it does not register `events_silver` as a table at all.

Correct answer: A — One row per distinct combination of `region` and `product_category`, each with the summed `units_sold` for that combination

• A. Correct — grouping by both `region` and `product_category` produces one output row per unique combination of those two columns, each carrying the sum of `units_sold` for that specific group.
• B. `groupBy().agg()` collapses rows within each group into a single summary row per group; it does not preserve one row per original input row or compute a running total across rows.
• C. Both `region` and `product_category` were passed to `groupBy`, so the result is grouped by their combination, not by `region` alone, and the aggregated `units_sold` column is retained in the output.
• D. Because two grouping columns were specified, the aggregation is computed separately for each combination of `region` and `product_category` rather than collapsing to one overall grand total.

Correct answer: A — Increase `spark.sql.shuffle.partitions` so each shuffle partition holds a smaller amount of data and disk spill is reduced.

• A. Raising the shuffle partition count spreads a fixed volume of data across more, smaller partitions, so each task handles less data and spills less to local disk. This directly targets the observed multi-gigabyte-per-task spill pattern.
• B. A 2 TB dataset is far larger than any practical broadcast threshold, and forcing a broadcast of that size would exhaust executor memory rather than fix the spill. The broadcast threshold governs join planning, not aggregation shuffle sizing.
• C. `spark.default.parallelism` applies to RDD-based operations and does not override the SQL-specific shuffle partition setting for DataFrame or SQL aggregations. Raising it would not change the aggregation's shuffle partition count.
• D. Shuffle spill happens on the executors that hold the shuffle data, not on the driver, so increasing driver memory has no effect on executor-side spill during this aggregation.

Correct answer: A — A streaming table applies exactly-once, append-only processing to each record, so it cannot handle logic that must reprocess aggregated historical values or update earlier results because of back-dated refund corrections.

• A. This is correct. Streaming tables assume an append-only source and process each record exactly once, which does not accommodate aggregation logic that must revisit and correct historical results when back-dated refunds arrive.
• B. This is incorrect. Streaming tables are a core dataset type supported natively within Lakeflow Spark Declarative Pipelines; the mismatch here is about processing semantics, not about whether the object type is permitted.
• C. This is incorrect. Streaming tables are Unity Catalog managed tables registered in a normal catalog and schema, and BI tools can query them directly like any other table; internal backing storage details do not block that access.
• D. This is incorrect. Streaming tables can be defined with either SQL (`CREATE OR REFRESH STREAMING TABLE`) or Python; SQL support is available and does not require rewriting the logic in PySpark.

Correct answer: A — The query fails, because Spark SQL only allows one `explode` (or other generator function) to appear in a single `SELECT` clause; the two arrays need to be exploded in separate steps.

• A. Spark SQL restricts a `SELECT` clause to a single generator function such as `explode`; including two `explode` calls in the same clause raises an analysis error, and the two array expansions must instead be done through separate, chained `SELECT` statements or lateral views.
• B. A single `explode` call does not perform a cross product between two different array columns; more importantly, the statement does not even run successfully because two generator functions cannot coexist in one `SELECT` clause.
• C. Spark SQL does not silently drop one of two `explode` calls in the same clause; the presence of two generator functions in a single `SELECT` causes the query to fail validation rather than quietly ignoring one of them.
• D. There is no positional zip behavior built into having two `explode` calls in one `SELECT` clause; the query does not reach execution at all because Spark SQL rejects multiple generator functions in the same clause.

Correct answer: A — `@dp.expect_or_drop("valid_total", "order_total >= 0")` removes rows that fail the condition before the write and lets the update finish normally.

• A. The `expect_or_drop` decorator drops records that fail its constraint before the data is written to the target, and the constraint `order_total >= 0` describes a valid record. Negative totals are therefore discarded while the update still completes.
• B. The plain `expect` decorator only tracks violations for reporting; rows that fail the check are still written to the target table, so negative totals would remain in the silver table, which does not meet the requirement.
• C. The `expect_or_fail` decorator makes invalid records prevent the update from succeeding, which is the opposite of the 'without failing the update' requirement in this scenario. It suits critical checks where any bad row should stop the run.
• D. The right decorator, but the constraint is inverted: an expectation constraint states what a valid record looks like, so `order_total < 0` treats negative totals as valid and drops every non-negative order. The silver table would keep exactly the rows the team wants to discard.

Correct answer: A — ==, !=, >, >=, <, <=

• A. The If/else task type supports equality, inequality, and the four relational operators for comparing a dynamic value or job parameter against a literal. This is the complete operator set documented for condition tasks.
• B. Pattern-matching operators like `LIKE` and set-membership operators like `IN` are not part of the If/else task's supported comparison operators. These are SQL-style operators rather than condition-task operators.
• C. String-matching helpers such as `CONTAINS`, `STARTSWITH`, and `ENDSWITH` are not operators the If/else task evaluates. The task is limited to simple equality and relational comparisons, not substring matching.
• D. `AND` and `OR` are logical operators for combining multiple conditions, not comparison operators for a single value check, and the If/else task does not expose them as selectable operators. Each If/else task evaluates one comparison at a time.

Correct answer: C — Set `min_time_between_triggers_seconds` to enforce a minimum cooldown before the next run can start after a run completes.

• A. The `wait_after_last_change_seconds` setting debounces individual writes rather than enforcing a hard cooldown between completed runs, so it solves a different problem than limiting run frequency.
• B. The `ALL_UPDATED` condition changes which tables must change to fire a trigger with multiple monitored tables, but it does not throttle how often runs occur for a single table.
• C. The `min_time_between_triggers_seconds` setting caps run frequency by enforcing a minimum wait after the previous run completes before the next one can start, matching the cooldown requirement.
• D. Monitoring the underlying storage path with a file arrival trigger would react to file-level writes instead of table state, and it does not offer the run-cooldown behavior being requested.

Correct answer: B — File arrival triggers only fire when genuinely new files appear in the location, so overwriting an existing file name does not start a run.

• A. File arrival triggers support both Unity Catalog volumes and external locations, so using a volume is not the reason the trigger fails to fire here.
• B. File arrival triggers detect new files landing in the monitored location, and overwriting an existing file does not count as a new arrival, so no run is started.
• C. File arrival triggers explicitly do not allow wildcard patterns in the monitored path, so this claim describes the opposite of how the feature actually works.
• D. File arrival triggers make a best-effort check for new files roughly every minute rather than once a day, so check frequency is not the cause of the missing run.

Correct answer: B — A scheduled trigger using a Quartz cron expression with the time zone set to America/New_York, since the requirement is a fixed wall-clock time rather than a data event.

• A. Even though the job reads transaction files, the actual requirement is a guaranteed fixed start time regardless of data timing, and a file arrival trigger would instead run whenever files land, which could be well before or after 2 AM.
• B. A cron-based scheduled trigger with the correct time zone directly guarantees the job starts at 2 AM local time every night, matching a requirement that is explicitly about a fixed wall-clock time rather than about reacting to any particular data event.
• C. Relying on the transaction table's update timing is an approximation at best, since the table could update earlier or later than expected on a given night, which does not guarantee the fixed 2 AM start the analysts require.
• D. A continuous trigger reruns the job back-to-back with no fixed schedule at all, so it cannot guarantee output is ready at any specific wall-clock time like 2 AM.

Correct answer: A — The downstream task does not run; it is marked disabled for that run, because a disabled parent does not satisfy `All succeeded`.

• A. This matches Databricks' documentation: a disabled parent task does not satisfy the `All succeeded` requirement, so the downstream task does not run, and Lakeflow Jobs also marks that downstream task disabled for the run rather than executing or failing it.
• B. This confuses two distinct, separately documented result states. Databricks documents that upstream tasks in the `Excluded` result state are treated as successful for run-if evaluation, but a task that has been explicitly disabled is documented separately, and a disabled parent does not satisfy the succeeded requirement — so the downstream task does not run.
• C. Lakeflow Jobs does evaluate run-if conditions against disabled upstream tasks automatically during the same run; it does not leave a downstream task pending indefinitely, so this option misstates how the disablement rule is applied.
• D. There is no manual approval workflow for disabled tasks in Lakeflow Jobs. Run-if evaluation, and any resulting disablement of the downstream task, happens automatically without any operator action.

Correct answer: A — Databricks blocks the commit because a commit message is required before changes can be pushed to the remote branch.

• A. The Git dialog requires a non-empty commit message before Commit & Push will proceed, so an empty message stops the operation.
• B. There is no feature that auto-generates a commit message from the list of changed file paths; the developer must supply one.
• C. Databricks does not defer message entry to a later session; the requirement is enforced at the moment Commit & Push is attempted.
• D. A push with a blank message is not permitted, so the change is not sent to the remote repository until a message is entered.

Correct answer: A — A `databricks.yml` file declares the job and pipeline as code, and named targets override settings like the workspace host so the same definitions deploy consistently across environments.

• A. This describes the core mechanism of a bundle: resources are declared once in `databricks.yml`, and targets override host, variables, and other settings per environment so the same source deploys consistently across dev, test, and prod.
• B. There is no UI feature that auto-detects and replicates resource changes between workspaces through an audit-log approval flow; promotion across environments is driven by deploying bundle configuration, not by UI diffing.
• C. Jobs and pipelines do not natively synchronize configuration across workspaces based on shared catalog or schema names; each workspace's resources are independent unless a bundle deploys the same definitions to both.
• D. A cluster policy constrains compute settings for a single job run and has no mechanism for propagating or synchronizing configuration between separate workspaces.

Correct answer: A — The command-line `--var` value wins, because CLI flags take precedence over target overrides, environment variables, and top-level defaults.

• A. The Databricks CLI resolves variable values in a fixed priority order, and a command-line `--var` flag sits at the top of that order, overriding target-level overrides, `BUNDLE_VAR_` environment variables, and top-level defaults.
• B. Target-level overrides are lower priority than a command-line `--var` flag; they only take effect when no higher-priority source, such as a CLI flag or environment variable, supplies a value for that variable.
• C. Having multiple potential sources for the same variable is expected and handled through a defined precedence order rather than treated as a conflict, so the CLI does not raise a validation error in this situation.
• D. Bundle variables resolve to a single scalar or complex value per deployment; the CLI does not merge values from multiple sources into a list or apply one as a runtime fallback for the other.

Correct answer: A — Add a step that runs `databricks bundle validate`, since it only parses and checks the local configuration and does not require deploying or authenticating against a live workspace target

• A. This is correct: `databricks bundle validate` checks configuration files for errors and prints a resource summary using only local parsing, so it can catch typos and bad references in CI before any deployment or workspace call is needed.
• B. Deploying to a dev target requires valid workspace credentials and actually creates or updates resources, which is unnecessary overhead and risk just to catch a configuration typo early in the pipeline.
• C. `--validate-only` is a flag scoped to `databricks bundle run` for pipeline resources specifically, not a general bundle-wide configuration check, and `bundle run` still requires the bundle to already be deployed.
• D. `databricks bundle destroy` deletes deployed resources and is unrelated to catching configuration typos; using it as a pull-request check would also be destructive and require existing deployed state.

Correct answer: A — Open the job's run history and compare the total duration bars across recent runs against the historical baseline shown in the Matrix or Runs list view.

• A. The run history views display each run's total duration alongside prior runs, so lining up recent bars against the historical pattern is the direct way to confirm a 12-minute job is now consistently taking 40 minutes. This does not require leaving the Jobs UI at all.
• B. Stage-level shuffle metrics can help explain why a run is slow, but they are not needed just to confirm that a duration trend exists, and reading only the most recent run would miss the comparison against the historical baseline entirely.
• C. The Jobs UI does report run duration for every run, so this understates what the UI provides and sends the engineer to a source that does not track run-over-run trends the way the run history view does.
• D. Repair run reruns only the tasks that failed in a specific past run, and since every recent run already succeeded there is nothing to repair; it also would not establish a historical duration baseline.

Correct answer: A — Salting the skewed key with a random suffix before grouping, then re-aggregating to spread its rows across partitions.

• A. This is correct. Salting appends a random suffix to the overrepresented key, splitting its rows across several synthetic sub-keys during the first aggregation pass, then a second pass aggregates the partial results back together, distributing the heavy key's workload across many tasks.
• B. Reducing the shuffle partition count consolidates data into fewer partitions, which would make the imbalance worse, not better, since the already-heavy key's partition would absorb even more of the remaining data.
• C. An aggregation is not a join between two tables, so there is no join side to broadcast; this option does not apply to reducing skew within a single `groupBy` on one DataFrame.
• D. Repartitioning by an unrelated surrogate column changes how rows are physically distributed for storage but does not affect how Spark shuffles data by the grouping key during the aggregation itself, so the skew on that key remains.

Correct answer: B — `OPTIMIZE`, `VACUUM`, and `ANALYZE`, covering file compaction, stale file cleanup, and statistics collection respectively

• A. `ZORDER` is a manual clustering technique that is actually incompatible with liquid clustering; it is not one of the three operations predictive optimization automates.
• B. Predictive optimization automatically runs `OPTIMIZE` for file compaction and incremental clustering, `VACUUM` for removing unreferenced files, and `ANALYZE` for refreshing table statistics.
• C. `REORG TABLE` and `REPAIR TABLE` are manually invoked commands for specific maintenance tasks; neither is part of the automated set predictive optimization manages.
• D. `REORG TABLE` is a manually run command used for tasks like type widening, not one of the operations predictive optimization schedules automatically.

Correct answer: A — Databricks aggregates query-level performance metrics for only the first 100 queries in a run, so later queries are excluded.

• A. This is correct because Databricks aggregates query-level performance metrics across only the first 100 queries within a run, so a task issuing 150 queries will have its later queries fall outside that aggregation window and therefore lack insight badges.
• B. This is incorrect because performance insight badges are not gated on whether a table is Unity Catalog managed versus external; the limiting factor described for this feature is the count of queries per run, not the storage type queried.
• C. This is incorrect because the expected completion time is a separate duration-threshold warning on the overall run and has no effect on whether individual queries receive performance insight badges.
• D. This is incorrect because performance insight badges, the Timeline view, and per-query aggregation are serverless-specific capabilities in the first place; the scenario already states the task ran on serverless compute, so cluster type is not the explanation.

Correct answer: A — The driver logs for stack traces mentioning the failing process, combined with the Spark UI Executors tab for per-node memory and garbage-collection metrics.

• A. Driver logs surface the actual stack trace and error message that identify which process ran out of memory, while the Spark UI's Executors tab shows per-node memory usage and garbage-collection time that reveal whether individual executors were under memory pressure. Together these two sources give the most direct, process-level evidence needed to localize an out-of-memory failure.
• B. Compute cost reflects how much a node ran and what instance type it used, not how much memory it consumed or whether it failed, so a billing dashboard cannot distinguish a driver failure from an executor failure. Cost data is unrelated to memory diagnostics.
• C. The audit log is built for tracking user actions and commands for governance purposes and does not record memory allocation or process-level errors, so it cannot help localize an out-of-memory failure to the driver or an executor.
• D. An autoscaling history graph shows how many executors were attached at a given time, which is useful for capacity planning but does not report memory usage on any individual node, so it cannot show which process exhausted its memory.

Correct answer: A — Under the managed storage location resolved from the containing schema, catalog, or metastore, whichever level has a managed location configured, since no path was given.

• A. Correct. Omitting `LOCATION` creates a managed table, and Unity Catalog resolves its storage path from the nearest configured managed location on the schema, catalog, or metastore.
• B. Incorrect. Managed tables are not placed in a temporary DBFS root requiring manual migration; Unity Catalog resolves a permanent managed location automatically.
• C. Incorrect. Omitting `LOCATION` creates a managed table, not one placed in a default external location, and there is no such automatic external-location provisioning behavior.
• D. Incorrect. Unity Catalog does not reuse the storage path of another table; each managed table resolves its own path from the schema, catalog, or metastore managed location.

Correct answer: A — Add an `EXCEPT compliance_team` clause to the policy's principal list, so the masking function is skipped whenever a member of that group runs the query.

• A. This is correct: the `EXCEPT` clause in a policy's principal list exempts named principals from the masking or filtering behavior, so the compliance team sees the unmodified column value while everyone else still sees the masked one.
• B. This is incorrect. Stacking a second masking policy for every group does not create a targeted exception for one team, and relying on implicit override behavior between overlapping policies is not how exceptions are expressed.
• C. This is incorrect. Write privileges like `MODIFY` govern the ability to change data, not whether a read-time column mask policy is applied; masking exceptions are controlled through the policy's principal clause, not table privileges.
• D. This is incorrect. A `WHEN` clause in `CREATE POLICY` scopes which tagged tables the policy applies to, not which principals are exempt; principal exceptions belong in the `TO`/`EXCEPT` clause instead.

Correct answer: A — Time travel is unsupported on tables with row filters or column masks attached, so this `VERSION AS OF` query is expected to fail outright

• A. Unity Catalog documents time travel as one of the operations unsupported on tables with row filters or column masks attached, so a `VERSION AS OF` query against such a table is expected to be rejected rather than succeed.
• B. Because time travel itself is unsupported once these policies are present, the engineer cannot retrieve the historical version at all, regardless of whether the older data predates the policy's creation.
• C. The restriction causes the query to fail rather than quietly substitute the current table state for the requested historical version, so no result set is silently returned.
• D. The unsupported-operation restriction is not bypassed by admin group membership; row filter and column mask logic controls row and column visibility, but the time-travel limitation applies at the table level regardless of who is querying.

Correct answer: A — No, because privileges granted on a catalog also apply to schemas and tables created in it later, not only to objects that existed at grant time.

• A. Correct. Unity Catalog documents that when you grant a privilege on a parent object, it applies to all current and future child objects. The statement already covers the three privileges needed to read a table (USE CATALOG, USE SCHEMA and SELECT), so the new schemas and tables are readable without any further grant.
• B. Incorrect. Catalog-level grants are not limited to objects that existed at grant time; they apply to all current and future schemas and tables in the catalog, so a per-schema grant is redundant.
• C. Incorrect. USE SCHEMA was granted at the catalog level in the same statement, and a USE SCHEMA grant on a catalog automatically applies to all current and future schemas in it. Container privileges do inherit downward, so nothing needs to be re-granted.
• D. Incorrect. There is no nightly re-application job; inheritance is a property of how the original grant is evaluated against child objects, not a scheduled re-grant process.