Free DBT Architect Sample Questions

Correct answer: A — The Flagged contractor Deny rule, because a narrower Deny range nested inside a broader Allow range takes precedence for the addresses it covers.

• A. This is correct: the contractor's address falls inside the narrower Flagged contractor Deny range nested within the broader Corporate VPN Allow range, and the narrower Deny rule wins for that address.
• B. This is incorrect because rule priority is based on range specificity, not rule type; a nested, more specific Deny range overrides the broader Allow range containing it.
• C. This is incorrect because a rule marked disabled in the table plays no role in evaluating the connection at all, regardless of what its CIDR range would otherwise cover.
• D. This is incorrect because dbt Cloud's IP restriction rules are defined and enforced using CIDR ranges, not single-address matching.

Correct answer: A — The empty `OAuth Client ID` and `OAuth Client Secret` fields, since Databricks OAuth requires both values from the registered OAuth app before authentication can succeed.

• A. Databricks OAuth cannot authenticate without both the Client ID and Client Secret from the registered OAuth app; leaving those fields blank is the direct, visible cause of an OAuth authentication failure on this screen.
• B. There is no requirement that OAuth connections reference a catalog named `oauth_catalog`; the catalog field selects which Databricks catalog queries target and has no bearing on OAuth authentication.
• C. The `/sql/1.0/warehouses/...` format is the standard HTTP Path for a Databricks SQL warehouse and is unrelated to how OAuth credentials are validated.
• D. OAuth is a supported and documented authentication method for Databricks connections; a personal access token is an alternative, not a requirement for testing a connection.

Correct answer: A — OAuth authenticates individual developers in the Studio IDE, while scheduled deployment jobs continue to run under separate service principal token credentials rather than OAuth.

• A. This is correct. Databricks OAuth covers user-to-machine authentication for interactive Studio IDE sessions, while deployment environments keep using separate service principal token credentials for scheduled jobs.
• B. This is incorrect. It reverses the actual split — OAuth is the developer-facing authentication method for the Studio IDE, and it is deployment jobs that rely on separate token-based service principal credentials.
• C. This is incorrect. Configuring OAuth does not eliminate the need for service principal tokens; deployment environments are deliberately kept on token-based credentials independent of the developer OAuth flow.
• D. This is incorrect. Databricks connections do support OAuth as a warehouse authentication method for developers, alongside Snowflake and BigQuery, so Databricks projects are not limited to personal access tokens.

Correct answer: A — `OAUTH_USE_SECONDARY_ROLES = 'IMPLICIT'`

• A. This parameter is required specifically to allow secondary roles to be used through the OAuth session, and its absence is what produces the `USE ROLE not allowed` error described.
• B. This parameter already appears in the statement set to `TRUE` and controls refresh token issuance, not secondary role usage, so changing it would not address the error.
• C. `OAUTH_CLIENT_TYPE` is already present and correctly set to `'CONFIDENTIAL'` for a custom OAuth client; it has no relationship to secondary role permissions.
• D. `OAUTH_REDIRECT_URI` is already present and set to the dbt callback address; it controls where the OAuth flow returns the user, not role elevation behavior.

Correct answer: A — Under the connection's Optional settings, where OAuth application credentials are attached directly to that specific Databricks connection object.

• A. This is correct because Databricks OAuth Client ID and Client Secret are entered under the Optional settings of the connection itself, tying the OAuth application to that one warehouse connection rather than to a user or project.
• B. This is incorrect because the Notifications area configures job alerting channels like email, Slack, or Teams; it has no field for OAuth application credentials and plays no role in warehouse authentication.
• C. This is incorrect because the OAuth Client ID and Secret belong to the connection object, not to any individual developer's profile; profiles only hold each developer's own personal credentials once the connection is already configured.
• D. This is incorrect because Environment Variables store project-level configuration values referenced in code and job settings, not the OAuth application credentials that authorize a specific warehouse connection.

Correct answer: A — Repository names entered during GitHub App setup must exactly match the case used in the repository's GitHub URL, and a mismatched case causes cloning to fail.

• A. dbt Cloud requires the repository name to exactly match the case shown in the GitHub URL, so entering `myrepo` instead of `MyRepo` produces a mismatch that causes cloning or job runs to fail. Correcting the casing to match the URL resolves the failure.
• B. Case sensitivity in the repository name field is a known dbt Cloud behavior independent of whether the app is installed; if the app were not installed, the repository would not be selectable at all rather than failing at clone time with this specific symptom. This misdiagnoses an installation issue instead of a naming mismatch.
• C. There is no twenty-four hour metadata caching window that causes clone failures for newly created repositories; this describes a timing mechanism that does not exist in the documented behavior. The failure is deterministic and tied to the name string, not to elapsed time.
• D. A restricted repository access list would prevent the repository from appearing as selectable during setup at all, rather than allowing setup to complete and then failing specifically at clone time due to a name string mismatch. This points to a different, unrelated failure mode.

Correct answer: A — A webhook that triggers CI/CD jobs on push and merge-request events, plus a project access token that dbt uses to post job run statuses back to GitLab.

• A. Selecting the repository causes dbt Cloud to auto-register a webhook for push and merge-request events and to create a project access token so job statuses can be posted back into GitLab.
• B. Branch protection rules and scheduled GitLab CI pipelines are not artifacts dbt Cloud creates during repository selection; the integration relies on its own webhook rather than GitLab CI scheduling.
• C. The group-level OAuth application and its Application ID/Secret pair are configured once, earlier, by an admin during account setup, not automatically per repository during selection, and there is no automatic Secret rotation policy.
• D. The native OAuth integration does not rely on an SSH deploy key at all, and its webhook fires on push and merge-request events rather than being limited to tag creation.

Correct answer: A — Rotate the token now, since tokens created before that date benefit from reduced-latency handling after rotation

• A. Tokens created before that cutoff date are specifically called out as candidates for rotation to gain reduced latency on high-frequency API calls, which matches this token's age and active use.
• B. This ignores the documented guidance that pre-cutoff tokens carry a latency-related reason to rotate, so treating age as irrelevant contradicts the specific recommendation for tokens of this vintage.
• C. Changing the permission set addresses authorization scope, not the latency characteristic tied to when the token was created, so it does not resolve the reason this particular token was flagged.
• D. Removing IP allowlisting would weaken a network-level security control and is unrelated to the age-based rotation guidance the review actually surfaced for this token.

Correct answers: A, B — Every project has exactly one development environment, and each developer authenticates to it using their own individually configured warehouse credentials.; A project can contain multiple deployment environments such as Staging and Production, sharing connection and credential settings configured at the environment level.

• A. Correct: dbt Cloud allows exactly one development environment per project, and each developer sets their own personal credentials under their profile so that IDE sessions use individually scoped warehouse access.
• B. Correct: unlike the single development environment, a project can have any number of deployment environments, and their connection and credential settings are configured once at the environment level rather than per person.
• C. Incorrect: deployment environments do not inherit a developer's personal credentials from the development environment; they are configured with their own environment-level connection settings independent of any individual's setup.
• D. Incorrect: dbt Cloud caps every project at a single development environment regardless of team size, so multiple developers share that one environment while each still uses their own personal credentials within it.

Correct answer: A — A service token's permissions are assigned directly when it is created, while a PAT inherits the permissions of the user who generated it.

• A. Service tokens belong to the account and get their own explicitly assigned permission set, while a personal access token simply carries whatever roles and license the creating user already has.
• B. This reverses the actual constraint: on Developer and Starter plans it is the service token that is limited to Semantic Layer access, while PAT scope follows the user's own permissions rather than being universally unrestricted.
• C. This swaps the two roles: a personal access token is the one that acts on behalf of the creating user, while a service token represents the account itself rather than any individual.
• D. A personal access token cannot be used to create a service token through the API and returns a client error when attempted, so this capability does not exist in either direction.

Correct answer: A — The job-level override

• A. This is correct because job-level overrides sit at the top of dbt's environment variable precedence order, above environment and project defaults.
• B. This is incorrect because environment-level values are overridden by a job-level override when one is set for that specific job.
• C. This is incorrect because the project-level value is only used when no environment-level or job-level value overrides it.
• D. This is incorrect because the in-code default in `env_var()` is the lowest-precedence fallback, used only when no other value is defined anywhere.

Correct answer: A — Name it with the `DBT_ENV_SECRET_` prefix, for example `DBT_ENV_SECRET_GIT_TOKEN`, so dbt Cloud encrypts the value at rest and scrubs it from logs and artifacts.

• A. The `DBT_ENV_SECRET_` prefix is the mechanism dbt Cloud uses to recognize a variable as sensitive, triggering encryption at rest and automatic scrubbing of its resolved value from logs, the UI, and artifacts.
• B. A plain `DBT_` prefix marks a standard variable, not a secret; its resolved value is stored and displayed like any ordinary setting and is not scrubbed from logs the way a secret-prefixed value is.
• C. The custom-environment prefix identifies a different category of variable and does not trigger the encryption or log-scrubbing behavior that only the secret prefix provides.
• D. A default argument written into Jinja code is stored in the project's source files and would appear in compiled output and version control, which is the opposite of keeping a credential hidden.

Correct answer: A — Override the `generate_schema_name` macro to check `target.name == 'prod'`, returning the custom schema unmodified for that target and concatenating elsewhere.

• A. This is correct: this is the recommended pattern for schema/alias customization, replacing the default macro so it special-cases the Production target and keeps concatenation everywhere else.
• B. This is incorrect because blanking the Production environment's default schema field affects only that one environment's default value, it does not change how the macro concatenates custom schemas anywhere.
• C. This is incorrect because setting a schema value on connection credentials changes the environment's own default, it does not alter how a model's custom schema config is combined with that default.
• D. This is incorrect because `schema` and `database` are distinct configuration keys with different meanings to dbt, and renaming one to the other does not change the macro's concatenation logic.

Correct answer: A — Self-deferral compares against the CI job's own most recent successful run, which can be a prior pull request's now-deleted schema rather than a stable production build.

• A. This is correct. Self-deferral points the CI job at its own most recent successful run rather than a stable production job, so it can pick up ephemeral schemas from a previous, already-torn-down pull request and reference tables that no longer exist.
• B. This is incorrect. dbt does not silently fall back to a local machine when no Production environment is marked; the described symptom of referencing a prior pull request's schema is a known self-deferral pitfall, not a missing Production flag.
• C. This is incorrect. Omitting `state:modified+` would cause the entire DAG to rebuild rather than produce schema-not-found errors tied to a specific prior pull request's dropped schema.
• D. This is incorrect. A duplicate webhook trigger could cause redundant runs, but it would not specifically produce errors referencing a torn-down schema from an already-merged pull request.

Correct answer: A — dbt blocks the direct commit and prompts the developer to create a new branch, because `feature/warehouse-migration` is now the protected branch in Studio IDE instead of the repository's default branch.

• A. Once a custom branch is set on a development environment, that branch becomes the one protected by Studio IDE, so direct commits are blocked and the developer is prompted to branch off instead. This matches how protection follows whichever branch is designated as the environment's custom branch.
• B. This is incorrect because custom branch settings on a development environment govern which branch Studio IDE treats as protected for editing and committing, not just which branch deployment jobs clone.
• C. This is incorrect because setting a custom branch does not get silently cleared after a blocked commit; the configuration persists until an administrator changes it.
• D. This is incorrect because branch protection in Studio IDE applies to development environments specifically, since that is where the IDE itself operates, not to deployment-type environments.

Correct answer: A — Configure a CI job triggered by pull requests for the staging validation step, and configure a separate merge job triggered on merge to the target branch to apply changes after the PR closes.

• A. Correct: a CI job triggered by pull requests validates changes against staging before merge, while a separate merge job triggered on merge to the target branch applies those changes afterward, matching dbt Cloud's distinct job types for each stage.
• B. CI jobs use one primary automated trigger at a time; combining pull-request and on-merge triggers on a single job is not how dbt Cloud's mutually exclusive trigger options work.
• C. A cron schedule reacts on a timer, not on a merge event, so polling for merged PRs is an unreliable substitute for the dedicated on-merge trigger that merge jobs already provide.
• D. Self-deferral only changes what manifest a job compares against; it does not make a single job automatically trigger itself again after a merge event, so it cannot replace a second merge job.

Correct answer: A — Linting runs as the first step before the build command, and depending on configuration it can either halt the job on the violation or log it and continue on to `dbt build`.

• A. This is correct because linting executes as the first step ahead of the build command, and it can be configured to either stop the job on a violation or continue on to the next step.
• B. This is incorrect because linting runs before the build command, not after, so a violation would be caught prior to any modified models being built.
• C. This is incorrect because, depending on configuration, a linting violation can halt the run entirely, so it is not limited to a passive reporting panel with no effect on later steps.
• D. This is incorrect because linting is a distinct run step evaluated separately from `dbt build`'s model execution, not something interleaved into build's per-model DAG traversal.

Correct answer: A — Remove run step 3, dbt docs generate, since the enabled checkbox already appends a docs generation step after the listed commands finish.

• A. This is correct. Because the checkbox already runs dbt docs generate after the listed commands complete, keeping an identical manual step at the end just duplicates that work.
• B. This is incorrect because removing the build step would stop the models from being materialized, which breaks the job's actual purpose instead of fixing the docs duplication.
• C. This is incorrect because disabling the checkbox removes the requirement stated in the question that docs generation must remain enabled for the job.
• D. This is incorrect because documentation generation reflects the current state of built models, so running it before dbt build would document stale or missing model metadata.

Correct answers: A, B, C — Threads; Target name; dbt version override

• A. Increasing the threads setting raises how many models the job can build concurrently, directly addressing the request for faster execution.
• B. Setting a custom target name lets project logic branch on the target without introducing any new environment variables, matching the stated constraint.
• C. The dbt version override pins a single job to a specific dbt version independently of the environment's default version.
• D. Environment variable overrides were explicitly ruled out by the scenario, and none of the three stated needs require adding or changing variables.

Correct answers: A, C — Both downstream jobs are enqueued in the job scheduler queue and wait until execution slots become available.; Neither downstream job is skipped or cancelled because slots were unavailable at the moment the trigger fired.

• A. Meeting the trigger condition enqueues each downstream job in the scheduler queue, where it waits for an available run slot rather than requiring slots to be free at the moment the upstream job finishes.
• B. The scheduler queue does not guarantee execution order based on when a chain trigger was originally configured; queued runs are picked up as slots free up, not by a fixed chain-configuration timestamp ordering.
• C. Being enqueued means the run is waiting, not discarded, so a temporary lack of available slots does not cause either downstream job to be skipped or cancelled.
• D. dbt Cloud does not cancel queued chained jobs based on the number of run steps they contain; both enqueued runs remain queued until resources are available to execute them.

Correct answer: A — Add a `dbt run` or `dbt build` step before `dbt docs generate` so the models actually execute against the warehouse.

• A. Column-level statistics come from querying the warehouse tables that models actually build; without a run or build step, no model tables exist for `dbt docs generate` to describe in detail.
• B. Reordering `dbt seed` relative to `dbt docs generate` changes when seed tables load but does nothing to create the model tables that column-level statistics depend on.
• C. A longer timeout gives the step more time to run, but it cannot produce statistics for tables that were never built in the first place, so the missing data would persist.
• D. Adding the checkbox on top of an existing `dbt docs generate` command just duplicates documentation generation; it still doesn't cause any models to be built against the warehouse.

Correct answer: A — In the automatic comment that dbt Cloud posts directly on the pull request in the git provider, summarizing the comparison results alongside the rest of the PR discussion.

• A. dbt Cloud automatically posts a summary of the comparison results as a comment on the pull request itself, so anyone with access to the git provider's PR view can read it without ever logging into dbt Cloud.
• B. A local `dbt compare` run uses the reviewer's own working copy and local target, which is a different, single-model, on-demand comparison mode than the deployment-side Advanced CI run tied to the actual PR branch and production state.
• C. Status checks can show that a CI job passed or failed, but they are not the mechanism dbt Cloud uses to publish comparison detail; the row-level summary is posted as a PR comment, not embedded in the status check itself.
• D. dbt Cloud's audit log tracks account activity such as user and permission changes, not per-run data comparison detail, and it would still require dbt Cloud account access to view, which the reviewer lacks.

Correct answer: A — No deferral, since there is no prior successful run anywhere in the project yet for any environment or job to supply comparison artifacts.

• A. Deferral needs a manifest from a prior successful run, and none exists yet anywhere in a brand-new project, so this first job must build everything without deferring to any target until a successful run produces one.
• B. Self-deferral compares against the job's own previous successful run, but on a job's very first execution no previous run exists yet, so there is nothing for self-deferral to reference during that first run.
• C. Marking an environment Production only labels it as the fallback deferral source; it does not retroactively create the successful run and manifest that deferral actually requires to compare against.
• D. CI jobs are excluded from counting as the successful run that seeds deferral artifacts, and CI jobs themselves need a deferred environment configured, so they cannot bootstrap the very first manifest either.

Correct answer: A — The scheduler cancels unnecessary queued runs because the job's duration now exceeds its schedule frequency, keeping only one run queued at a time; the team should lengthen the interval or split the job so it fits within the schedule.

• A. When a job's actual run duration exceeds its scheduled frequency, the scheduler prevents an unbounded backlog by canceling extra queued runs and keeping only one run queued at a time. The correct fix is to widen the interval or reduce the job's run time so it fits comfortably within the schedule.
• B. This behavior is an intentional over-scheduling safeguard, not a malfunction, so there are no missing runs to restore. Filing a support ticket would not change the documented behavior of canceling redundant queued runs.
• C. Deployment jobs execute serially rather than concurrently, so this describes CI job behavior, not deploy jobs. The missing runs here are explained by queue cancellation due to overrun, not by run slot exhaustion.
• D. CI jobs run on separate triggers and do not consume the same queue as a scheduled deploy job, so disabling CI triggers would not address a deploy job outrunning its own schedule. The root cause is the deploy job's run time exceeding its interval.

Correct answer: D — The masked one-time token string, because dbt Cloud never displays or re-issues that exact value again once the modal is dismissed.

• A. dbt Cloud does not email token values, and the permission row is metadata describing the scope, not a credential needed for authentication.
• B. The token name is only a human-readable label for identifying the token in the account settings list; it cannot be used by itself to authenticate API requests.
• C. Re-entering the same project and permission combination creates a brand-new, different secret value; it does not reproduce the original token string.
• D. This is correct: the secret token value is shown only once at creation time, so the admin must copy and store it immediately before the modal closes.

Correct answer: B — Click the delete or remove action on the contractor's user record in Account Settings → Users to permanently remove them, knowing that restoring access later means inviting them again as a new record.

• A. This is incorrect because downgrading the license reduces capability but leaves the user record active and still consuming a seat; it does not constitute the complete revocation the scenario requires.
• B. This is correct because removing the user record from Account Settings → Users is the action that permanently revokes access, matching dbt Cloud's documented behavior that removal cannot be undone as the same record.
• C. This is incorrect because the default Everyone group still grants baseline account access, so removing only custom groups would not fully revoke the contractor's ability to reach the account.
• D. This is incorrect because disabling only the IdP-side mapping leaves the dbt Cloud user record and any non-SSO access path active until something inside dbt Cloud itself removes the user.

Correct answer: A — The edit is blocked, because the Read Only license applies fixed, non-inheriting permissions across the account regardless of which permission-set groups the user belongs to.

• A. Read Only is one of the license types with fixed permissions that do not inherit from any permission set, so group membership such as Account Admin cannot grant additional editing rights, and the connection edit remains blocked.
• B. License type always overrides permission-set membership in dbt Cloud's access model, so belonging to an admin group cannot unlock actions that the assigned license itself does not allow.
• C. The read-only restriction is not scoped narrowly to jobs and runs; it applies to all resources in the account, including account-level configuration screens like connections.
• D. There is no sync mechanism that upgrades a user's effective access after login; the license type set on the user record governs their permissions at all times, not a delayed group sync.

Correct answer: A — The IT-licensed user is excluded from the seat total, so only the Developer user needs to match the Billing count

• A. IT licenses are explicitly excluded from developer seat usage, so adding an IT-licensed user does not change the developer seat total that needs to match between Users and Billing. Only the Developer-licensed user needs to be reflected in both counts.
• B. IT licenses do not count toward developer seat usage, so treating both users as equal contributors to the seat total would overstate what Billing actually needs to charge for. The two license types are billed differently by design.
• C. There is no double-billing rule tied to the Security Admin and Billing Admin permissions bundled into an IT license. IT licenses simply sit outside the developer seat count rather than counting extra.
• D. Read-Only licenses are a separate, non-seat-billed license type, but the exclusion described in this scenario applies specifically to the IT license, not Read-Only. Swapping which license type is excluded misstates the billing rule being tested here.

Correct answer: A — Job Admin access, because when a user belongs to multiple groups scoped to one project, the permission set with the higher access level takes precedence.

• A. This is correct because a Developer license inherits group permission sets, and when multiple groups grant different levels of access to the same project, the more permissive permission set applies.
• B. Join order has no effect on which permission set applies. dbt Cloud resolves overlapping group access by access level, not by chronology of group membership.
• C. Overlapping group memberships do not create a blocking conflict. dbt Cloud is designed to resolve multiple permission sets on the same project rather than lock the user out.
• D. There is no averaging mechanism, and the resolution does not default to the more restrictive set; the higher-access permission set is the one that applies.

Correct answer: A — Okta's SAML group attribute statement returns at most 100 groups per user, so the filter needs to be narrowed, for example matching only group names with a `DBT_CLOUD_` prefix, so the relevant groups fit within that cap.

• A. Okta caps the groups returned in a SAML group attribute statement at 100 per user, so a broad `.*` filter silently drops groups past that limit; narrowing the filter to a relevant prefix keeps the needed groups within the cap.
• B. This is incorrect because the 100-group cap is specific to how Okta evaluates SAML group attribute statements, not a limit dbt imposes on incoming SAML assertions from any provider.
• C. This is incorrect because enabling SCIM is a separate, optional provisioning path; it does not change how Okta's SAML group attribute statement evaluates or caps groups for existing SAML-based logins.
• D. This is incorrect because NameID format controls how the user's unique identifier is represented, not how many groups Okta includes in the groups attribute statement.

Correct answer: A — Configure Slack notifications on the Fails trigger for visibility, and separately configure a webhook on the job-run-failed event so the tracker's API can build a ticket from the JSON payload.

• A. Slack notifications and webhooks are separate, composable features - email or Slack alerts are for human visibility, while a webhook's JSON payload on the same trigger event is what an external system's API consumes to create a ticket automatically.
• B. Notification emails are formatted for people to read, not structured JSON for a tracker's API to parse, so this does not give the issue tracker the structured data it needs.
• C. Slack does not automatically forward received messages into arbitrary linked issue trackers; that kind of automated ticket creation requires its own integration, not a side effect of Slack notifications.
• D. Webhooks post JSON to a configured HTTPS endpoint, not directly into a Slack channel, so this conflates two separate delivery mechanisms that are each configured on their own.

Correct answer: A — Azure Logic Apps does not accept the custom Authorization header dbt Cloud attaches to every request, so it rejects the delivery before reaching the workflow trigger.

• A. dbt Cloud always attaches a custom Authorization header carrying the HMAC signature to every webhook request, and Azure Logic Apps and Power Automate are documented as being unable to accept custom headers on their HTTP triggers, which causes deliveries to be rejected outright.
• B. Scoping a webhook to specific job IDs simply narrows which jobs generate events; it would prevent delivery for other jobs' runs, but it would not explain zero successful deliveries for the scoped job's own runs, and the log shows failed attempts, meaning requests are being sent.
• C. Choosing `job.run.started` over `job.run.completed` changes when the event fires and what data it carries, but it would still produce a deliverable request; it does not explain why every delivery attempt fails at the endpoint.
• D. Webhook secret tokens in dbt Cloud do not automatically expire after a fixed period, so a thirty-day expiration is not a real failure mode for signed deliveries.

Correct answer: A — The core_finance project has never completed a successful job run in its designated deployment environment, so no manifest metadata has been published for Team B to resolve against.

• A. Cross-project resolution depends on manifest metadata published by a successful job run in the producer project's designated deployment environment. Without that run, the metadata service has nothing to resolve the reference against, even though the model is correctly marked public.
• B. An enforced contract is a recommended companion to public access, not a hard requirement for cross-project resolution. A public model without a contract can still be referenced across projects.
• C. The project name in dependencies.yml must exactly match the name declared in the upstream project's dbt_project.yml, so a mismatch there is a real failure mode, and license tier is not the described symptom here.
• D. A version argument is only required when referencing a specific pinned version of a versioned model. Unversioned public models resolve correctly with the standard two-argument ref.

Correct answer: A — No — marking Staging routes eligible consumer references there immediately, and with no successful job run yet, those references fail until a job succeeds there.

• A. This is correct. As soon as an environment is designated Staging, eligible consumer jobs begin resolving against it with no automatic fail-over to Production, so an unpublished Staging environment breaks those references until a job succeeds there.
• B. This is incorrect. The deployment type takes effect as soon as it is set, not after a first successful run; there is no grace period that keeps consumers pointed at Production while Staging is unpublished.
• C. This is incorrect. There is no manual approval workflow gating a newly designated Staging environment; the deployment type setting applies directly without an administrator sign-off step.
• D. This is incorrect. Mesh does not always prefer Production once a Staging environment exists; Staging-eligible consumers are routed to Staging immediately, which is exactly the behavior that causes the outage risk.

Correct answer: A — Open the upstream public model's detail page in Catalog and review its run history and timing information to see whether its execution time has increased recently.

• A. Correct. Catalog's model detail views include run history and timing, so opening the upstream public model directly shows whether its execution time has grown, which is the direct way to confirm a bottleneck.
• B. Incorrect. Recreating the project dependency changes how the mesh relationship is declared, not how fast the upstream model executes; it does not surface any timing information to diagnose slowness.
• C. Incorrect. Downgrading the plan removes Catalog features like column-level lineage entirely; it does not target or diagnose a specific model's runtime and would only reduce visibility, not improve it.
• D. Incorrect. Account lineage arrows represent dependency relationships between projects, not runtime or arrow thickness encoding; there is no timing signal to read from that graph's visual style.