Free DBT Architect Sample Questions

Correct answer: B — Set `method: oauth` and run `gcloud auth application-default login` to generate local credentials.

• A. Incorrect. The `service-account` method requires a physical JSON keyfile on the local machine. The security policy explicitly prohibits the creation and storage of these files on developer laptops, and pointing to the system root does not bypass the requirement for the file to exist.
• B. Correct. By setting `method: oauth`, dbt-bigquery searches for credentials using the Application Default Credentials (ADC) strategy. Running `gcloud auth application-default login` allows developers to authenticate via their browser and stores a short-lived token locally. This satisfies the security constraint because it does not require the creation or storage of permanent service account JSON keys.
• C. Incorrect. There is no `iam-user` method in dbt's BigQuery adapter that utilizes plain-text passwords. This would be a significant security risk and is not a supported authentication flow for BigQuery.
• D. Incorrect. While storing a JSON key in an environment variable avoids a physical file on the filesystem, the security team has blocked the *creation* of these keys entirely. Furthermore, storing long-lived service account secrets in environment variables still presents a credential leakage risk.

Correct answers: A, C — Client ID; Client Secret

• A. Correct. The OAuth Client ID is issued by your identity provider (IdP) when you register an OAuth application. It is required by dbt Cloud to identify the application during the OAuth handshake flow.
• B. Incorrect. A Personal Access Token (PAT) is an alternative authentication method for Databricks. It is not used when configuring OAuth, which relies on client credentials and the SSO flow instead.
• C. Correct. The OAuth Client Secret is paired with the Client ID and is required to authenticate the dbt Cloud application with the identity provider as part of the OAuth configuration.
• D. Incorrect. While connectivity to Databricks generally requires a Server Hostname and HTTP Path, the specific OAuth configuration fields in dbt Cloud require the Client ID and Secret rather than a JDBC URL string.
• E. Incorrect. An SSH Key is used for secure shell access or Git authentication and is not relevant to the Databricks OAuth authentication setup.

Correct answer: A — Yes

• A. This is a valid root cause. In Snowflake, roles are not visible to users unless they have been explicitly granted to them. If a user attempts to connect using a role that has not been granted, Snowflake typically returns an error indicating the role does not exist or was not found. This is a security feature designed to prevent unauthorized users from discovering the names of existing roles in the system.
• B. This is incorrect because a missing grant is a highly likely cause for this specific error. While other factors such as a typo in the role name or the role not having been created at all would also produce this error, the lack of a grant to the specific user remains a primary valid root cause that must be investigated during troubleshooting.

Correct answer: B — dbt Cloud IPs are static for each region; the whitelist only needs to be updated if dbt Cloud announces a rare infrastructure change.

• A. dbt Cloud IPs are not dynamic and do not rotate on a daily basis. dbt Labs publishes a list of stable outbound IP ranges for its managed service, so a daily script is unnecessary and incorrect.
• B. dbt Cloud publishes static outbound IP addresses for its managed infrastructure, categorized by deployment region (e.g., North America, EMEA). These addresses remain stable and only change during rare, announced infrastructure updates, resulting in low maintenance for the security team.
• C. Both the dbt Cloud IDE and the Scheduler run on dbt Cloud's managed infrastructure and share the same published outbound static IP ranges. There is no distinction in IP behavior between these two components within dbt Cloud.
• D. By default, dbt Cloud uses public outbound IP addresses to connect to cloud data warehouses. While private connectivity options (like Google Private Service Connect) are available in specific Enterprise configurations, they are not the exclusive or default method of connection.

Correct answer: A — env_var

• A. Correct. env_var is the built-in dbt Jinja function specifically designed to retrieve environment variables. Crucially, it accepts an optional second argument that serves as a fallback (default) value if the specified environment variable is not set.
• B. Incorrect. The var() function is used to retrieve dbt-specific variables defined in the dbt_project.yml or passed through the --vars CLI flag. It does not read system environment variables.
• C. Incorrect. get_env is not a standard, built-in dbt Jinja function. The native, portable method for this functionality is env_var.
• D. Incorrect. target.role is a property of the target object used within dbt models or macros to reference the role being used in the current execution. It is not a function that allows for environment variable lookup or fallback logic in profiles.yml.

Correct answer: D — Each developer must authenticate via OAuth during their initial IDE session setup to link their personal GitHub account.

• A. Incorrect. While Personal Access Tokens (PATs) can be used for authentication in manual or non-native setups, they are not the standard mechanism for the Native GitHub integration. Native integrations rely on OAuth to associate IDE actions with a user profile automatically.
• B. Incorrect. Connecting via 'Generic Git' with a shared SSH key attributes all commits to the identity associated with that single key (often a service account). This fails the requirement for granular, per-user audit trails.
• C. Incorrect. A 'Repository Deploy Key' is a repository-scoped credential intended for machine-level access, such as CI/CD jobs or automated read/write actions. It does not represent individual developers and would attribute all IDE actions to the deploy key identity.
• D. Correct. The Native GitHub integration in dbt Cloud utilizes per-user OAuth tokens. By having each developer authenticate via OAuth, dbt Cloud links their personal GitHub identity to their IDE session. This ensures that all commits generated within the IDE are performed with the user's specific credentials and attributed to their individual GitHub account, satisfying strict audit requirements.

Correct answer: B — In dbt Cloud Project Settings, generate a new SSH key, copy the public key, update the Deploy Key in the Git Provider, and then delete the old key from the Git Provider.

• A. Incorrect. Deleting the dbt Cloud project and creating a new one would cause significant downtime and disruption for IDE users, as it results in the loss of project configurations and job history. This is an extreme measure and not a standard procedure for credential rotation.
• B. Correct. This is the recommended workflow for rotating SSH keys in dbt Cloud. Generating a new SSH key in dbt Cloud Project Settings provides a new public key to register with the Git provider; updating the Deploy Key and ensuring the new key is active before deleting the old one maintains continuous access for IDE users.
• C. Incorrect. Manually replacing the private key in the dbt Cloud Repository Settings with a locally generated key is not the standard administrative path for SSH connections and is discouraged for security and stability reasons. dbt Cloud is designed to manage the key pair internally.
• D. Incorrect. Disconnecting the repository and switching to a Native Integration is an architectural change, not a credential rotation procedure. This process would require re-configuration and cause unnecessary downtime for IDE users.

Correct answer: B — If the engineer leaves the organization or their password rotates, all production scheduled jobs will fail immediately.

• A. Incorrect. Personal credentials can indeed execute `dbt build` and other dbt Cloud deployment commands if the user has the necessary permissions; there is no inherent platform restriction that prevents personal accounts from running deployments.
• B. Correct. Tying production deployments to an individual's account creates a single point of failure: if the engineer leaves the organization, is deactivated, or rotates their password/credentials, all scheduled production jobs will fail immediately. Service accounts provide stable, organizationally-managed credentials that ensure operational continuity and consistent auditing independent of personnel changes.
• C. Incorrect. dbt Cloud does not impose thread-concurrency limits based on the type of credentials used. Concurrency is controlled by the dbt project settings and the underlying data warehouse adapter; service accounts do not provide 'unlimited' threads compared to personal ones.
• D. Incorrect. While it is a violation of best practices, dbt Cloud does not technically block the assignment of personal credentials to an environment marked as 'Production'. The limitation is architectural and operational rather than a hard constraint within the UI.

Correct answer: C — Line 3

• A. Incorrect. Line 1 specifies the environment's name ('Production'), which is a descriptive label and does not govern the functionality, interface access, or permissions of the environment.
• B. Incorrect. Line 2 specifies the dbt Core version to be used for runs in this environment. It determines the features available in the dbt engine itself but does not toggle IDE or interactive development capabilities.
• C. Correct. Line 3 specifies the environment 'type' as 'deployment'. In dbt Cloud architecture, deployment environments are designed for scheduled jobs, CI, and production runs. They do not support interactive development features such as the Cloud IDE, which are restricted to 'development' type environments.
• D. Incorrect. Line 4 controls whether the environment should use a custom git branch for its runs. While this affects source control behavior, it does not determine whether the environment is available for interactive development.

Correct answer: B — PATCH /accounts/{account_id}/projects/{project_id}/repository

• A. Using the POST method on the repository endpoint typically implies creating a new resource rather than updating an existing one. In the dbt Cloud API, modifying an existing project's repository settings requires a partial update method like PATCH.
• B. Correct. The PATCH /accounts/{account_id}/projects/{project_id}/repository endpoint is specifically designed to update an existing project's repository configuration. To rotate keys, your script should send a PATCH request containing the updated private key in the request body.
• C. While this endpoint name might appear related to authentication, it is not the documented path for updating a project's repository-specific SSH key. Additionally, POST is inappropriate for updating an existing configuration.
• D. The artifacts endpoint is used for managing and uploading build outputs or documentation metadata (like manifest.json or catalog.json). It is completely unrelated to repository configuration or SSH key management.

Correct answer: A — schema: "{{ env_var('DBT_CUSTOM_SCHEMA', target.schema) }}"

• A. Correct. The dbt `env_var` function accepts a second optional positional argument which acts as the default value. If the environment variable is not defined, dbt will return this default value (in this case, `target.schema`) instead of raising a compilation error.
• B. Incorrect. Calling `env_var` with only one argument will cause dbt to throw a compilation error immediately if the environment variable is missing. As a result, the logical `or` operation is never reached.
• C. Incorrect. While dbt's `env_var` supports a default value, it must be passed as a positional argument (the second argument in the function). Passing it as a keyword argument (`default=`) is not supported syntax for this specific dbt function.
• D. Incorrect. Similar to option B, when `env_var` is called without a second argument and the environment variable is missing, dbt raises an error during the compilation of the Jinja template. The Jinja `| default` filter is applied to the output of the function, but since the function errors out, the filter is never evaluated.

Correct answer: A — Project B must have a Service Token that is authorized to read the 'Discovery API' of Project A's account.

• A. Correct. In a cross-account dbt Mesh setup, the downstream project (Project B) must provide a service token generated from the upstream account (Project A). This token must have permissions to access the dbt Cloud Discovery API (metadata permission) for Project A so that Project B can resolve the manifest, schema, and location of the upstream public models.
• B. Incorrect. Standard RBAC roles like 'Viewer' are scoped to a single dbt Cloud account. You cannot assign an internal role to a Service Account belonging to a different dbt Cloud account. Cross-account access is managed via Service Tokens and the Discovery API.
• C. Incorrect. One of the core strengths of dbt Mesh is its ability to support cross-project and cross-account references, allowing different business units or organizations to share governed data assets.
• D. Incorrect. dbt Cloud does not use a 'Guest Access' or IP-based 'Public' environment configuration to manage project-to-project dependencies. Access is secured via API tokens and the Discovery API interface.

Correct answer: B — The Consumer project uses the metadata from the Producer project's dbt Cloud artifacts (manifest.json) to automatically resolve the correct schema and table names.

• A. Incorrect. The Consumer project does not need to duplicate the Producer's `generate_schema_name` macro. Duplicating logic across projects creates maintenance debt and risks inconsistency; dbt Mesh is designed to rely on published artifacts rather than local re-calculation of producer logic.
• B. Correct. dbt Mesh leverages dbt Cloud's discovery features or the producer's manifest artifacts to resolve cross-project references. When a consumer references a public model from a producer project, dbt uses the producer's metadata to automatically map the reference to the actual production schema and relation identifiers.
• C. Incorrect. Manually defining database and schema overrides in `dependencies.yml` for every model is unnecessary and error-prone. dbt Mesh provides an automated mechanism to resolve these locations via the producer's published state, making manual overrides for every model redundant.
• D. Incorrect. The `DBT_DEFAULT_SCHEMA` environment variable controls the default target schema for the current project's models. It does not provide a mechanism for resolving the specific schema locations of models maintained in a separate producer project.

Correct answer: A — --defer

• A. Correct. The --defer flag instructs dbt to resolve ref() calls to the artifacts in the provided --state directory for models that are not part of the current selection. This allows unmodified upstream models to resolve to their production schemas, which is the standard practice for efficient CI builds.
• B. Incorrect. There is no built-in --resolve-upstream flag in dbt. The behavior of resolving upstream models to a different state is exclusively handled by the --defer flag used in conjunction with --state.
• C. Incorrect. --use-prod-refs is not a valid dbt CLI flag. While the name describes the intended outcome, the dbt command-line interface uses --defer to achieve this.
• D. Incorrect. The --target flag specifies which connection profile target to use (defined in profiles.yml). Using --target prod would attempt to execute the current models against the production credentials/schema directly, which is generally the opposite of what a safe CI pipeline should do, and it does not enable deferral for unselected models.

Correct answer: A — Custom Branch

• A. Correct. In dbt Cloud, within the Deployment Setup section of an environment's settings, the 'Custom Branch' field allows you to pin that environment to a specific Git branch. This ensures all jobs triggered in that environment pull code from the specified branch rather than the repository's default branch.
• B. Incorrect. While 'Target Branch' is a valid concept in Git and is used in dbt Cloud's CI job settings (to define which branch a pull request is compared against), it is not the name of the field used to pin a deployment environment to a specific branch.
• C. Incorrect. 'Git Override' is not a valid configuration field name within the dbt Cloud environment settings UI.
• D. Incorrect. 'Environment Branch' is a descriptive term but is not the actual name of the configuration field in dbt Cloud. The correct UI label is 'Custom Branch'.

Correct answer: C — This is handled automatically; dbt Cloud will skip the next scheduled run if the previous run is still executing.

• A. Incorrect. Enabling 'Run Timeout' would forcibly terminate the job. This violates the business requirement for data consistency, as killing a run mid-execution can lead to partial data loads or inconsistent states in the target warehouse.
• B. Incorrect. While scaling to a larger warehouse might reduce runtime, it is a resource management strategy rather than a job configuration that guarantees serial execution. It does not provide a hard guarantee that runs will never overlap if data volume continues to grow.
• C. Correct. dbt Cloud's scheduler is built to prevent overlapping runs of the same job. If a job is already in progress when its next scheduled time arrives, dbt Cloud automatically skips the new run. This ensures that only one instance of the job is writing to the warehouse at any given time, maintaining data consistency without requiring additional configuration.
• D. Incorrect. 'Generate docs on run' is a setting that triggers the generation of the dbt project's documentation website after a run; it does not implement database-level locks or manage job concurrency.

Correct answer: C — The 'Triggers' section, enabling 'Run when another job finishes'.

• A. Incorrect. Environment variables are used to pass configuration values (like schema names or flags) into the dbt project at runtime. They are not used to orchestrate job execution order or define dependencies between separate dbt Cloud jobs.
• B. Incorrect. The 'Commands' section defines the specific dbt CLI commands to be executed within the job. There is no '--upstream' flag that allows one job to trigger another; job chaining is an orchestration feature of the dbt Cloud platform, not the dbt Core CLI.
• C. Correct. In the dbt Cloud UI, job chaining is configured within the 'Triggers' section of the job settings. By enabling 'Run when another job finishes', you can select a specific upstream job that must complete successfully before the current job starts.
• D. Incorrect. Aligning cron schedules is a legacy practice that is brittle and prone to failure. If the upstream job takes longer than expected, the downstream job might start before the data is ready. Job chaining via the Triggers section is the architecturally sound method to ensure immediate, success-dependent execution.

Correct answer: B — Environment: Select a 'Deployment' environment; Commands: dbt build --select state:modified+; Deferral: 'Defer to a previous run state' pointing to the Production Job

• A. Incorrect. A 'Development' environment is used for personal development in the IDE. For CI, a Deployment environment (specifically of type CI) is required. Additionally, 'dbt run' does not include tests, and 'Defer to self' does not provide the production manifest required to identify modified resources compared to the master branch.
• B. Correct. This is the classic Slim CI pattern. Choosing a Deployment environment ensures the job runs in a production-like infrastructure. The command 'dbt build --select state:modified+' ensures that only modified models and their downstream dependencies are built and tested. Deferring to a previous production run state allows dbt to compare the current code against the production manifest.json and reference upstream production tables without rebuilding them.
• C. Incorrect. Running only 'dbt test --select source:*' would only test sources and ignore all model logic changes. It does not utilize state comparison or deferral, which are the fundamental requirements for Slim CI.
• D. Incorrect. 'state:new' only selects nodes that do not exist in the comparison manifest, missing modifications to existing code. Using a Development environment is incorrect for CI jobs, and deferring to a Staging Job is less reliable than deferring to the Production state for ensuring code quality before merge.

Correct answer: B — dbt source freshness dbt test dbt docs generate

• A. This sequence is incorrect because dbt docs generate is executed first. Since the documentation artifacts are generated before the tests and freshness checks occur, the documentation site will not reflect the results of those operations.
• B. This is the correct sequence. Running dbt source freshness and dbt test first ensures that the metadata for freshness and test results is captured. When dbt docs generate is then executed, it incorporates this existing metadata into the catalog.json and manifest.json files, ensuring the documentation site displays the most up-to-date status.
• C. This sequence only builds models and then generates documentation. It does not include the execution of tests or source freshness checks, so the documentation will be missing the specific metadata requested.
• D. The dbt docs generate command (with or without the --compile flag) creates the documentation site based on existing project state but does not execute tests or source freshness checks itself. Without running those commands prior, the metadata will not be present.

Correct answers: B, D — The CI job must execute a command that includes the `--defer` flag.; The CI job command must use the `--state` flag to point to the production `manifest.json` artifacts of the downstream projects (`marts` and `finance_specific`).

• A. Incorrect. In a dbt Mesh architecture, downstream projects (marts) depend on upstream projects (staging). The upstream project does not list its consumers in its `dependencies.yml` file.
• B. Correct. The `--defer` flag is required to enable deferral behavior. This tells dbt to resolve references (refs) to models not included in the current run by looking at the provided state artifacts instead of the local target schema.
• C. Incorrect. While `catalog.json` contains useful metadata about the physical columns in the warehouse, the `manifest.json` is the primary artifact required by dbt to resolve the project graph and handle deferral logic.
• D. Correct. The `--state` flag is used to specify the directory containing the production `manifest.json` artifacts. In dbt Mesh, providing the state of downstream projects allows the CI job to correctly resolve and test the impact of upstream changes on those downstream models without rebuilding them locally.
• E. Incorrect. Cross-project deferral is a fundamental feature of dbt Mesh, specifically designed to allow independent projects to interact and test against each other's production states without requiring a monolithic rebuild.

Correct answers: A, C — The job must have the 'Defer to a previous run state?' option enabled in its settings.; The job must have at least one prior successful run for the same pull request to establish a baseline state.

• A. Correct. The job must have the 'Defer to a previous run state?' option enabled in its settings for dbt Cloud to apply the prior run's state when deciding which models to skip or defer. Without this toggle enabled, the job will not attempt to use any previous state artifacts.
• B. Incorrect. While specific plan levels may govern access to advanced features, being on an Enterprise plan is not a functional runtime prerequisite for self-deferral to operate on a given pull request.
• C. Correct. Self-deferral requires a baseline state (artifacts like manifest.json and run_results.json) from a previous run within the context of the same pull request. If no successful run has occurred yet for that PR, there is no state to defer to.
• D. Incorrect. Standard deferral typically points to a production environment. However, self-deferral specifically utilizes previous runs of the same CI job for the same PR. The state of the production environment is not a prerequisite for self-deferral logic.
• E. Incorrect. Self-deferral functions by comparing state and artifacts; it is not dependent on specific materializations like incremental. All model types can be managed via state and deferral logic.

Correct answer: B — No, because deleted models are not considered 'modified' by dbt state comparison.

• A. Incorrect. state:modified+ only selects nodes that the state comparison labels as modified. Because a deleted upstream model is no longer present in the project, it is classified as removed rather than modified. Since the upstream model is not selected, its downstream dependents won't be pulled in by this specific selector unless they themselves were modified.
• B. Correct. dbt's state:modified selector only includes nodes that exist in the current project but differ from the reference manifest. Since a deleted model is entirely absent from the current project, it is not flagged as 'modified'. Consequently, using state:modified+ will not automatically include downstream models that depend on the deleted model, meaning broken references will not be caught by this selection logic.
• C. Incorrect. While dbt compile would surface missing references if the affected models were included in the run, switching from dbt build to dbt compile does not solve the fundamental issue of the state:modified selector excluding downstream children of deleted models.
• D. Incorrect. The --full-refresh flag determines how incremental models are processed (dropping and recreating tables) but does not influence dbt's state comparison logic or how it identifies modified versus deleted nodes.

Correct answers: B, C, E — The list of columns in a database object, including their data types.; The owner of a database object as defined in the database.; The table or view statistics, such as row count and size in bytes.

• A. Incorrect. The raw SQL and compiled SQL of a model definition are captured in the `manifest.json` artifact. The `catalog.json` focuses on physical database objects and their metadata.
• B. Correct. `catalog.json` includes a detailed inventory of the columns for each discovered relation, including their specific database-level data types.
• C. Correct. The `catalog.json` metadata block includes the 'owner' attribute, which reflects the database-level ownership of the object (e.g., a Snowflake role or BigQuery user).
• D. Incorrect. Performance metrics and execution timing for specific model runs are recorded in the `run_results.json` artifact, not in the catalog.
• E. Correct. `catalog.json` captures relation-level statistics (such as row counts and size in bytes) provided by the database adapter during the discovery process.

Correct answers: B, C — Use GitHub Encrypted Secrets to store sensitive values and reference them as environment variables in the workflow YAML for both Snowflake and S3 access.; Configure an OIDC provider between GitHub Actions and AWS, allowing the CI runner to assume an IAM Role with temporary, short-lived credentials to access S3.

• A. Incorrect. Storing credentials in a `.env` file and committing it to the Git repository is a major security risk, as it exposes secrets to anyone with repository access and retains them permanently in the Git history.
• B. Correct. GitHub Encrypted Secrets are a standard security practice for CI/CD. They allow sensitive values to be stored securely at the repository or organization level and injected into the workflow environment at runtime without being exposed in the source code.
• C. Correct. Configuring an OIDC provider between GitHub Actions and AWS is a modern, high-security approach that eliminates the need for long-lived, static AWS access keys. It allows the CI runner to assume an IAM role with temporary, short-lived credentials, significantly reducing the security blast radius.
• D. Incorrect. Hardcoding credentials in `profiles.yml` is insecure even if the file is added to `.gitignore`. It is fragile, prone to accidental commits, and lacks the centralized management and auditing provided by dedicated secret managers.
• E. Incorrect. Storing credentials in a private wiki and relying on manual copy-pasting is not auditable, is prone to human error, and does not support automated CI/CD pipelines, violating core DevOps and security principles.

Correct answer: C — The Authorization header prefix for dbt Cloud API is 'Token', not 'Bearer'.

• A. The Content-Type header controls the format of the request/response body. While 'application/json' is correct for dbt Cloud API interactions, changing it to 'text/html' would be inappropriate for JSON artifacts and does not address the authentication failure.
• B. Service Tokens are specifically designed for programmatic and automated access to the dbt Cloud API, including retrieving artifacts. As long as the token has the 'Job Viewer' or 'Admin' permissions, it is valid for this task.
• C. The dbt Cloud API documentation specifies that the Authorization header must use the prefix 'Token' (e.g., 'Authorization: Token <your_token>'). Although 'Bearer' is a common standard for many OAuth2 implementations, using it with dbt Cloud will result in a 401 Unauthorized response.
• D. Passing sensitive credentials as query parameters in a URL is considered a poor security practice and is not the standard method for dbt Cloud authentication. The script correctly attempts to use a header, but fails due to the incorrect prefix.

Correct answer: B — She will be assigned a Developer license because dbt Cloud grants the most permissive license type when a user maps to multiple groups with conflicting licenses.

• A. Incorrect. dbt Cloud does not default to the most restrictive license. In conflict scenarios, the system prioritizes granting the access necessary for the higher-tier role.
• B. Correct. dbt Cloud resolves multiple group mappings by granting the most permissive license type available across all groups the user belongs to. Since a Developer license provides more permissions than a Read-Only license, Alice will be assigned the Developer license.
• C. Incorrect. Alice will not be denied access. dbt Cloud is designed to deterministically resolve license conflicts automatically through its hierarchy of permissions.
• D. Incorrect. Users are not prompted to choose their license type at login. Mappings are applied automatically by dbt Cloud based on the groups asserted by the Identity Provider (IdP) during the SSO handshake.

Correct answers: A, C, D — Enable 'Just-In-Time Provisioning' in the dbt Cloud account settings.; Configure a default 'Developer' license type for new users created via SSO.; Create a dbt Cloud group named 'Analytics Engineering' and configure an 'SSO Group Mapping' to link it to the corresponding group name sent by the IdP.

• A. Enabling Just-In-Time (JIT) Provisioning in dbt Cloud allows user accounts to be automatically created upon their first successful SSO login. This is the core mechanism for meeting the requirement of automated user creation without manual pre-provisioning.
• B. Manually pre-creating accounts is not required when JIT is enabled and directly contradicts the requirement for a fully automated onboarding process.
• C. dbt Cloud allows administrators to specify a default license type for users provisioned via SSO. Configuring this as 'Developer' ensures that new users are automatically allocated the correct seat type upon account creation.
• D. SSO Group Mapping links attributes (groups) sent by the Identity Provider in the SAML assertion to specific groups in dbt Cloud. By mapping the IdP's group to the 'Analytics Engineering' group in dbt Cloud, users automatically receive the project permissions associated with that group.
• E. Assigning the 'Account Admin' role by default is a security risk and violates the principle of least privilege. It is not necessary for standard analytics engineering work and is not part of the stated requirements.
• F. Manual support tickets introduce human intervention and delays, which defeats the goal of a fully automated onboarding process.

Correct answer: A — SSO group

• A. Correct. In the dbt Cloud Group settings UI, under the 'SSO Mapping' section, the specific field where you enter the name of the group from your Identity Provider (like Okta) is explicitly labeled 'SSO group'. Entering the exact name of the Okta group here allows dbt Cloud to automatically assign users to that dbt group upon login.
• B. Incorrect. While you are mapping based on an attribute from your IdP, the 'IdP attribute' (or 'Groups Attribute') refers to the name of the claim (like 'groups' or 'memberOf') which is configured at the dbt Cloud Account level in the SSO configuration. The specific value/name of the group itself is entered into the 'SSO group' field at the Group level.
• C. Incorrect. A SAML assertion is the XML document or protocol payload sent by the IdP during the authentication process. It contains the attributes used for mapping, but it is not the name of the configuration field in the dbt Cloud Group settings.
• D. Incorrect. 'Role mapping' is the general term for the process of associating identity provider groups with application roles, but it is not the specific field label used in the dbt Cloud interface for this setting.

Correct answers: B, D — Alex has navigated to their personal Profile Settings in dbt Cloud and unsubscribed from 'Job failed' notifications.; Alex has configured a personal email filter that moved the dbt Cloud notification to a spam or trash folder.

• A. This is not plausible in this context because the prompt explicitly states the job 'failed'. In dbt Cloud, 'Cancelled' and 'Failed' are distinct terminal states. If a job is cancelled, it does not transition to a failure state and therefore would not trigger a 'Job Failed' notification. Additionally, a cancellation would prevent notifications for the entire group, not just Alex.
• B. This is a plausible reason. dbt Cloud allows individual users to manage their own notification preferences in their personal Profile Settings. A user can choose to unsubscribe from specific notification types, such as 'Job failed' alerts, which would override the job-level configuration for that specific individual.
• C. This is not plausible. The 'cause' field in the dbt Cloud API is metadata used to identify how a run was initiated (e.g., API, schedule, or manual). It does not affect the notification logic; a job that fails will trigger the configured failure notifications regardless of whether it was started by a schedule or an API call.
• D. This is a plausible reason for a user reporting they did not 'receive' a notification. While it is an external factor relative to dbt Cloud's settings, personal email filters or spam/junk folders are common causes for individuals missing automated system alerts that were otherwise sent correctly.

Correct answers: B, C — To ensure the integrity of the payload, confirming it has not been tampered with in transit.; To authenticate the sender, verifying that the request originated from dbt Cloud and not a malicious actor.

• A. HMAC-SHA256 is a message authentication code, not an encryption algorithm. While it uses a cryptographic hash, it does not hide the contents of the payload (encryption); that is the role of HTTPS/TLS at the transport layer.
• B. One of the primary uses of an HMAC is to ensure data integrity. The receiver recalculates the hash using the shared secret and the received payload; if the result matches the signature in the header, it proves the payload has not been modified in transit.
• C. HMAC provides sender authentication. Because the signature can only be generated by a party in possession of the shared secret key (dbt Cloud), a valid signature allows the receiver to verify that the request truly originated from dbt Cloud and not a malicious actor.
• D. Idempotency (the ability to handle duplicate requests without side effects) is typically managed using unique event identifiers, such as the `X-dbt-Event-Id` header, rather than the cryptographic signature of the payload.

Correct answer: B — The name of the project must be defined, as this is used as the first argument in a cross-project ref call.

• A. The version property is optional and is primarily used for package versioning or model versioning. While helpful for semantic versioning, it is not the mechanism that allows other projects to identify this project during a cross-project ref call.
• B. The name of the project is a required field in dbt_project.yml. In a dbt mesh or cross-project reference scenario, the syntax ref('project_name', 'model_name') specifically uses this declared project name as the first argument to identify and resolve the correct upstream project.
• C. The profile property determines how a project connects to the data warehouse. Each project in a dbt mesh can have its own distinct profile; they do not need to share a profile name for cross-project references to work.
• D. The packages-install-path property controls the local directory where dbt installs dependency packages. It is specific to the environment where dbt runs and has no effect on the project identifier used in cross-project ref calls.

Correct answers: B, D, E — In the `proj_finance` project, add `proj_staging` and `proj_marts` as dependencies in the `dependencies.yml` file.; Ensure the dbt Cloud job for `proj_finance` has the 'Install Dependencies' step enabled in its execution settings.; Set `access: public` for every model in the `proj_staging` and `proj_marts` projects.

• A. This is incorrect. The 'Defer to a previous run state' setting in dbt Cloud is used to resolve references to models within the same project (usually for slim CI or incremental logic). While dbt Mesh uses a form of deferral to resolve cross-project references, it is configured at the environment level, not via this specific job toggle.
• B. Correct. In a dbt Mesh architecture, you must define upstream project dependencies in a `dependencies.yml` file (not `packages.yml`). This file allows dbt to identify and pull metadata for the external projects.
• C. Incorrect. dbt Mesh is designed to eliminate the need for manual variable mapping of databases and schemas. References are resolved automatically using the metadata (manifests) provided by the upstream projects' production environments.
• D. Correct. Just as with packages, dbt Mesh requires the `dbt deps` command to be run. This command fetches the manifests and metadata for the projects listed in `dependencies.yml`. Enabling 'Install Dependencies' in the dbt Cloud job settings ensures this step occurs.
• E. Correct. By default, dbt models have `protected` or `private` access, meaning they can only be referenced within their own project. To allow a model to be referenced by a downstream project in a dbt Mesh, the `access` property must be explicitly set to `public`.

Correct answer: B — It prevents the model from being materialized if the transformed data does not conform to the specified column data types and constraints.

• A. Incorrect. Enforcing a model contract does not automatically version the model when a column's data type changes. Model versioning is a separate feature managed through configuration and source control, while contracts only validate that the model's output matches its declared schema at runtime.
• B. Correct. When a contract is enforced, dbt validates the model's materialized output against the specified column data types and constraints. If the transformed data does not conform, dbt fails the materialization, preventing breaking schema changes from reaching downstream consumers.
• C. Incorrect. Model contracts provide metadata like data types and constraints, but they do not guarantee faster execution. Query performance depends on factors such as the data platform's optimizer, warehouse configuration, and data volume, not on contract enforcement.
• D. Incorrect. Access control is managed through the `access` property (e.g., `public`, `protected`, `private`) or the data platform's permissions, not by model contracts. A contract is solely for schema enforcement and data quality, not for restricting which users can query the model.

Correct answer: B — The `dim_accounts` model in the `core_models` project has not been configured with `access: public`.

• A. Running `dbt deps` is necessary to install dependencies and resolve packages locally, but it does not control the visibility of models within the dbt Cloud Catalog or Explorer for dbt Mesh. Visibility across projects is primarily governed by the Discovery API and the model's access property.
• B. In dbt Mesh, for a model to be discoverable and referenceable by downstream projects, it must be explicitly configured with `access: public`. If the model is left as the default (private) or set to protected, it will not appear as an available resource for other projects in the dbt Catalog.
• C. While a successful job run is required to populate specific metadata like column types and statistics in the catalog, the fundamental visibility of the model as a public interface in dbt Mesh is determined by the `access` configuration in the YAML files, not the current run status.
• D. Viewer permissions allow users to see documentation in the dbt Cloud UI, but they do not define the architectural resource sharing between projects. Even if a user has permissions, the model itself must be marked public to be utilized as a cross-project dependency.

Correct answer: B — Exposures

• A. Incorrect. Tags in dbt are used to categorize and organize resources such as models or sources for selection and governance purposes. They do not provide a direct, first-class linkage between dbt models and specific downstream BI reports or dashboards.
• B. Correct. Exposures are the dbt feature specifically designed to represent downstream consumers of dbt artifacts. They define links to BI reports, dashboards, or ML models, allowing developers to visualize the full lineage from raw data through models to the final business asset. This is essential for impact analysis and documentation.
• C. Incorrect. Sources define and describe the raw data origins (upstream) that dbt models depend on. They are used to document and test incoming data rather than representing downstream BI consumption.
• D. Incorrect. While Metrics help standardize calculations consumed by BI tools, they represent semantic definitions of business logic. Exposures remain the specific mechanism for linking models to the actual BI reports or dashboards where those metrics or models are visualized.