CoursesFree Quizzes
DatabricksMulti-Agent and Long-Horizon Context

Unity Catalog & Least Privilege — Databricks Context Associate Practice Question

A representative Databricks Certified Context Engineer Associate (Databricks Context Associate) exam question on Unity Catalog & Least Privilege. Work through it below, then read why each option is right or wrong.

This question is part of the free Databricks Certified Context Engineer Associate practice test.

Short answer

The correct answer is C. Configure Unity Catalog dynamic views that filter patient records based on the agent's service principal identity; each agent's principal is pre-mapped to its department.

Unity Catalog dynamic views apply row-level security based on the caller's identity (service principal), automatically filtering records without manual per-agent role assignment. This scales to many agents and enforces least-privilege at query time. Separate tables (distractor) require manual table grants and don't scale well. Encryption keys (distractor) add operational complexity and don't integrate with Databricks governance. MLflow policies (distractor) manage model versions, not data access control. Dynamic views are the standard least-privilege mechanism in Unity Catalog.

The Question

A regional hospital network operates a Databricks agent system that accesses patient records across cardiology, oncology, and pediatrics departments. Each department must operate under strict least-privilege access: cardiology agents see only cardiac patients, oncology agents see only oncology patients, and pediatrics agents see only pediatric patients. Patient names, MRNs, and diagnoses are considered sensitive. What is the most effective governance mechanism to enforce this least-privilege constraint without requiring manual role assignment per agent?

AUse MLflow model registry to version access policies per agent and reload policies before each agent execution
BStore patient data in separate tables per department and grant each agent table-level read permissions only to its assigned table
CConfigure Unity Catalog dynamic views that filter patient records based on the agent's service principal identity; each agent's principal is pre-mapped to its departmentCorrect
DEncrypt patient identifiers with department-specific keys and have agents decrypt only records matching their department key

Why C is correct

Unity Catalog dynamic views apply row-level security based on the caller's identity (service principal), automatically filtering records without manual per-agent role assignment. This scales to many agents and enforces least-privilege at query time. Separate tables (distractor) require manual table grants and don't scale well. Encryption keys (distractor) add operational complexity and don't integrate with Databricks governance. MLflow policies (distractor) manage model versions, not data access control. Dynamic views are the standard least-privilege mechanism in Unity Catalog.

Why the other options are wrong

Option A: Use MLflow model registry to version access policies per agent and reload policies before each agent execution

Option A does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (C) is the only one that fully meets every constraint stated in the question.

Option B: Store patient data in separate tables per department and grant each agent table-level read permissions only to its assigned table

Option B does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (C) is the only one that fully meets every constraint stated in the question.

Option D: Encrypt patient identifiers with department-specific keys and have agents decrypt only records matching their department key

Option D does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (C) is the only one that fully meets every constraint stated in the question.

Key idea: Unity Catalog & Least Privilege

Unity Catalog dynamic views apply row-level security based on the caller's identity (service principal), automatically filtering records without manual per-agent role assignment. This scales to many agents and enforces least-privilege at query time. Separate tables (distractor) require manual table grants and don't scale well. Encryption keys (distractor) add operational complexity and don't integrate with Databricks governance. MLflow policies (distractor) manage model versions, not data access control. Dynamic views are the standard least-privilege mechanism in Unity Catalog. On the Databricks Context Associate exam, questions in the "Multi-Agent and Long-Horizon Context" domain test whether you can map a scenario's constraints to the right choice. Read the requirement carefully, eliminate options that violate any single constraint, and pick the one that satisfies all of them with the least operational overhead.

Ready to see how you'd score?

Take the free practice quiz and find out which Databricks Certified Context Engineer Associate domains you need to focus on. No signup required.

Take the free quizSee all 215+ practice questions

Practice 5 similar questions

Same cert, same or adjacent domain. Use these after reviewing the explanation.

1Mlflow & Evaluation — Databricks Context Associate Practice QuestionFoundations of Context Engineering2Instruction Testing & Vector Search — Databricks Context Associate Practice QuestionSystem Prompt and Instruction Design3Genie & Semantic Metadata — Databricks Context Associate Practice QuestionKnowledge Retrieval and Genie Configuration4Memory Architecture & Canary Deployment — Databricks Context Associate Practice QuestionMemory Architecture with Lakebase and MLflow5Tool Design & Least Privilege — Databricks Context Associate Practice QuestionTool Design, MCP, and Agent Context

Related Databricks Certified Context Engineer Associate Practice Questions

Mlflow & Evaluation — Databricks Context Associate Practice Question→Instruction Testing & Vector Search — Databricks Context Associate Practice Question→Genie & Semantic Metadata — Databricks Context Associate Practice Question→

Official sources used

Verify program and exam details at the source before scheduling.

docs.databricks.comEN: Agentsdocs.databricks.comMlflow3: GenAI