Item Permissions and Sharing: 10 practice questions

Question 1 of 10

A warehouse is shared and no additional permission is selected, so the recipient gets Read. Which SQL Server permission or role is this Read equivalent to?

1. ACONNECT
2. Bdb_datareader
3. Cdb_owner
4. DSELECT on all tables

Question 2 of 10

Which workspace roles can share a lakehouse by default, without any extra permission?

1. AAdmin, Member, and Contributor
2. BAdmin and Member
3. COnly the Admin role
4. DAll four workspace roles

Question 3 of 10

Which permission cannot be given to a recipient by sharing a warehouse?

1. AReadAll
2. BWrite
3. CRead
4. DReadData

Question 4 of 10

A warehouse was shared with an analyst with the option Read all data using SQL. Later, an admin ran GRANT on two tables for the analyst. The analyst must read only those two tables with T-SQL, but can still read every table. What should the owner do?

1. ARemove ReadData in Manage permissions and keep the grants
2. BRemove access in Manage permissions and keep the grants
3. CRemove ReadAll in Manage permissions and keep the grants
4. DAssign the Viewer role and remove the share of the warehouse

Question 5 of 10

A lakehouse is shared with a user with the option Read all with SQL analytics endpoint. The user can query tables through the SQL analytics endpoint URL but cannot access the data through the lakehouse URL. What should the owner grant?

1. ARead all with Apache Spark as well
2. BRead on the SQL analytics endpoint
3. CReshare on the shared lakehouse
4. DBuild on the default semantic model

Question 6 of 10

An owner gave a user ReadData on a warehouse 15 minutes ago. Manage permissions shows the new permission, but the user's queries are still denied. What should the owner do first?

1. AAssign the Viewer role, because ReadData needs a role
2. BRun GRANT on every table, because ReadData does not apply
3. CRemove access and share again, because the share failed
4. DAsk the user to sign in again, and allow up to two hours

Question 7 of 10

A semantic model on a warehouse uses its default connection type. A report on this model is shared with a manager who has no other access, and the manager cannot see the data of the report. What does the manager need?

1. ANothing on the warehouse; the report must be shared again
2. BRead on the warehouse, because Read opens linked reports
3. CReadData on the warehouse, or SQL permissions on tables
4. DBuild on the report, because the default mode is Import

Question 8 of 10

A Contributor must share a lakehouse with a partner team that will read it from Spark notebooks. Today the Contributor cannot share it, and the Contributor must not be able to add users to the workspace. What should an Admin do, and which sharing option fits?

1. AGrant Reshare on the lakehouse, then share with Read all with Apache Spark
2. BGrant Reshare on the lakehouse, then share with Read all with SQL analytics endpoint
3. CAssign the Member role, then share with Read all with Apache Spark
4. DGrant Reshare on the lakehouse, then share with no additional permissions

Question 9 of 10

A security team prepares access to a warehouse for a new analyst who has no access yet. From the first connection, the analyst must be able to query three views. The analyst must never be able to read the other objects, not even for a short time. Which sequence fits?

1. AAssign the Viewer role, then run GRANT on the three views
2. BRun GRANT on the three views, then share with no additional permissions
3. CRun GRANT on the three views, and do not share the warehouse
4. DShare with Read all data using SQL, then run DENY on the other objects

Question 10 of 10

A contractor is a Viewer in a workspace and also has a direct share of one report in it. The contractor must lose access to all other items in the workspace but must keep opening that report. Which change fits?

1. AKeep both and remove Reshare
2. BRemove the role and the share
3. CRemove the direct share only
4. DRemove the Viewer role only