Microsoft Certified: Fabric Analytics Engineer AssociateGovern and administer Fabric (10-15%)Hard
A data engineering team is developing a critical data pipeline in a Microsoft Fabric workspace. They want to ensure that only authorized users can access the underlying data in the Lakehouse, and that specific columns containing personally identifiable information (PII) are completely hidden from certain roles, even if those roles have access to the table. Which security mechanism should be implemented for the PII columns?
- AObject-Level Security (OLS)
- BWorkspace item permissions
- CDynamic Data Masking (DDM)
- DRow-Level Security (RLS)
Show answer & explanationAnswer & explanation
Correct answer: A. Object-Level Security (OLS)
Object-Level Security (OLS) is the appropriate mechanism to completely hide specific columns (or even tables) from unauthorized users or roles. Unlike RLS, which filters rows, OLS restricts access to entire objects, ensuring that PII columns are not even visible to those without the necessary permissions.
Why the other options are wrong
- B. Workspace item permissions control access to the Lakehouse item as a whole but do not provide granular control to hide specific columns within it.
- C. Dynamic Data Masking (DDM) obscures sensitive data in query results (e.g., showing only the last four digits of a credit card number) but does not completely hide the column itself.
- D. Row-Level Security (RLS) filters rows based on user context but does not hide entire columns.
Object-Level Security (OLS)
Object-Level Security (OLS) is a data security feature that controls access to database objects like tables, columns, or views, restricting who can even see or reference these objects.
- Restricts access to entire columns or tables.
- Users without permission cannot see the protected object.
- Complements RLS for comprehensive data security.
Memory trick: OLS is like having a 'Secret Drawer' for columns; if you don't have the key, you can't even see it's there.