I85PREP
⌘ K
Cloudera Data Operator study materials
Cloudera Data Operator study resources

Cloudera Data Operator practice questions

One question at a time. Build your Cloudera Data Operator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloudera Platform

In Cloudera Data Platform, which component is responsible for storing the metadata that describes databases, tables, and partitions in a Hive-based data warehouse?

  1. The Hive Metastore service Correct answer.
  2. The YARN ResourceManager
  3. The ZooKeeper ensemble
  4. The HDFS NameNode

Explanation

The Hive Metastore is the central catalog that persists definitions of databases, tables, columns, and partitions, and it is queried by engines such as Hive and Impala. NameNode, ResourceManager, and ZooKeeper provide storage, scheduling, and coordination respectively, not table metadata.

Question 2Cloudera Platform

Which CDP service provides a centralized web UI for browsing, tagging, and searching metadata assets such as Hive tables and HDFS paths across the platform?

  1. Apache Knox
  2. Apache Ozone
  3. Apache Atlas Correct answer.
  4. Apache Ranger

Explanation

Apache Atlas in CDP maintains a metadata catalog with classification, lineage, and search capabilities across platform assets. Ranger enforces authorization, Knox handles edge security proxying, and Ozone is object storage.

Question 3Cloudera Platform

A CDP administrator wants to grant a group read access to a specific Hive database while denying it by default everywhere else. Which Ranger construct should be configured?

  1. A global deny-all policy applied to every Hive service
  2. A Kerberos keytab issued to every member of the group
  3. An HDFS ACL applied to the warehouse root directory
  4. A Hive service policy scoped to that database with an allow condition for the group Correct answer.

Explanation

Ranger Hive policies are resource-scoped, so an allow policy targeting one database grants access there while the default deny posture blocks other databases. HDFS ACLs do not govern Hive SQL authorization, and keytabs authenticate rather than authorize.

Question 4Cloudera Platform

Which CDP capability lets an administrator define a reusable tag such as PII and have that tag automatically drive masking and access policies across multiple services?

  1. Hue saved queries
  2. HDFS snapshots
  3. Ranger tag-based policies Correct answer.
  4. YARN queues

Explanation

Ranger supports tag-based policies where classifications defined in the tag store are matched to resources, so one tag can drive masking and access rules across Hive, HDFS, and other services. Snapshots, queues, and saved queries have no policy semantics.

Question 5Cloudera Platform

In a CDP Private Cloud Base cluster, which service must be running for Hive and Impala to resolve table locations and schemas consistently?

  1. The HBase Master
  2. The Hive Metastore Correct answer.
  3. The Solr server
  4. The Flume agent

Explanation

Both Hive and Impala consult the shared Hive Metastore so that table definitions and locations are consistent across engines. HBase, Solr, and Flume serve unrelated workloads and are not involved in SQL catalog resolution.

Question 6Cloudera Platform

Which CDP component acts as the single gateway that proxies Kerberos-authenticated access to web UIs and REST APIs for remote users?

  1. Apache Knox Correct answer.
  2. Apache Ranger
  3. Apache Atlas
  4. Apache Livy

Explanation

Knox provides a perimeter security gateway that authenticates users and proxies requests to cluster UIs and REST endpoints, hiding internal hosts. Ranger authorizes, Atlas catalogs, and Livy submits Spark jobs.

Question 7Cloudera Platform

A data engineer needs interactive, low-latency SQL over Parquet tables stored in an Ozone bucket on CDP. Which engine is the most appropriate choice?

  1. Apache Oozie
  2. Apache Impala Correct answer.
  3. Apache Flume
  4. Apache MapReduce

Explanation

Impala is the MPP SQL engine in CDP designed for interactive, low-latency queries against files such as Parquet. MapReduce is batch-oriented, Flume ingests streams, and Oozie orchestrates workflows.

Question 8Cloudera Platform

Which CDP service provides a web-based SQL editor with saved queries, notebooks, and integration with Hive and Impala for analysts?

  1. Apache Kafka
  2. Apache Zeppelin
  3. Apache NiFi
  4. Apache Hue Correct answer.

Explanation

Hue is the CDP web UI that bundles SQL editors for Hive and Impala along with saved queries, notebooks, and file browsing. Zeppelin is a separate notebook tool, while NiFi and Kafka handle data flow and messaging.

Question 9Cloudera Platform

Which storage layer in CDP Private Cloud Base provides the default replicated file system that Hive warehouse tables typically reside on?

  1. Apache Ozone
  2. Apache HBase
  3. Apache Kudu
  4. HDFS Correct answer.

Explanation

HDFS is the default replicated distributed file system where the Hive warehouse directory normally lives. Ozone is an optional object store, Kudu is a columnar store for random access, and HBase is a NoSQL database.

Question 10Cloudera Platform

An administrator wants to enable fine-grained column masking on a Hive table so that only members of the fraud team see full account numbers. Which combination achieves this in CDP?

  1. A Ranger masking policy on the column with an allow condition for the fraud group Correct answer.
  2. An HDFS transparent encryption zone on the warehouse directory
  3. A Hive table property setting compression to snappy
  4. A YARN capacity scheduler queue for the fraud group

Explanation

Ranger masking policies operate at the column level and can include conditions so unmasked values are returned only for specified groups. Encryption zones, scheduler queues, and compression settings do not implement column-level masking.

Question 11Cloudera Platform

Which CDP service is used to define, schedule, and monitor recurring data pipelines as directed acyclic graphs of actions?

  1. Apache Hive
  2. Apache Ranger
  3. Apache Knox
  4. Apache Oozie Correct answer.

Explanation

Oozie is the workflow scheduler in CDP that models pipelines as DAGs of actions such as Hive, Spark, or shell steps. Hive queries data, Ranger authorizes, and Knox proxies.

Question 12Cloudera Platform

A cluster must run Spark jobs submitted by different tenants with guaranteed minimum resources. Which CDP component enforces these capacity guarantees?

  1. The Hive Metastore
  2. The Knox gateway
  3. The YARN capacity scheduler Correct answer.
  4. The Atlas lineage engine

Explanation

The YARN capacity scheduler partitions cluster resources into queues with guaranteed capacities, so tenants receive their configured minimums. The Metastore, Atlas, and Knox do not allocate compute resources.

Question 13Cloudera Platform

Which CDP feature records the flow of data between tables and jobs so analysts can trace how a downstream report was produced?

  1. HDFS snapshots
  2. Ranger audit logs
  3. YARN logs
  4. Atlas lineage Correct answer.

Explanation

Atlas lineage captures relationships between inputs and outputs of jobs and queries, enabling impact analysis and traceability. Audit logs record access events, snapshots preserve file states, and YARN logs capture container output.

Question 14Cloudera Platform

A security team must ensure that all access to Hive tables is logged with the user, resource, and policy outcome. Which CDP capability provides this?

  1. Hue query history
  2. HDFS block reports
  3. YARN node labels
  4. Ranger audit logging Correct answer.

Explanation

Ranger audit logging records each authorization decision including the requesting user, the resource, and whether access was allowed. Block reports, node labels, and query history serve unrelated purposes.

Question 15Cloudera Platform

Which protocol does CDP use by default to authenticate users and services across the cluster in a secure deployment?

  1. LDAP simple bind
  2. Kerberos Correct answer.
  3. SAML assertions
  4. OAuth 2.0 bearer tokens

Explanation

CDP secure clusters rely on Kerberos for strong authentication of users and service principals. LDAP, OAuth, and SAML may appear at the edge for identity federation but are not the cluster-internal default.

Question 16Cloudera Platform

An operator wants to move Hive tables to a new cluster while preserving their metadata definitions and partition structure. Which approach best accomplishes this on CDP?

  1. Recreate each table manually without copying partitions
  2. Copy only the HDFS data files without metadata
  3. Use Hive replication or export/import of metadata together with the underlying data Correct answer.
  4. Enable HDFS snapshots on the source cluster

Explanation

Preserving tables requires both the data files and the metastore definitions, so replication or export/import of metadata plus data is needed. Copying data alone leaves no table definitions, and snapshots are local to a cluster.

Question 17Cloudera Platform

Which CDP service provides a scalable object store with an S3-compatible API that can back Hive and Impala tables?

  1. Apache HBase
  2. Apache Ozone Correct answer.
  3. Apache ZooKeeper
  4. Apache Solr

Explanation

Ozone is CDP's distributed object store that exposes an S3-compatible interface and can serve as storage for SQL engines. HBase, Solr, and ZooKeeper are not object stores.

Question 18Cloudera Platform

A team observes that Impala queries fail while Hive queries on the same table succeed. Which cause is most consistent with this symptom on CDP?

  1. Impala has not refreshed its metadata for the table after a schema change Correct answer.
  2. The Atlas server is offline
  3. The YARN ResourceManager is stopped
  4. The HDFS replication factor was increased

Explanation

Impala caches table metadata, so after a Hive-side schema change it must run REFRESH or INVALIDATE METADATA before queries succeed. YARN, replication factor, and Atlas availability do not explain Hive succeeding while Impala fails.

Question 19Cloudera Platform

Which CDP component stores and serves the tag definitions used by Ranger tag-based policies?

  1. The YARN timeline server
  2. The Hive Metastore
  3. The Atlas tag store Correct answer.
  4. The Knox gateway

Explanation

Atlas maintains the classification and tag store, and Ranger consumes those tags when evaluating tag-based policies. The Metastore holds schemas, the timeline server holds application history, and Knox proxies requests.

Question 20Cloudera Platform

Which statement best describes the relationship between Ranger and HDFS ACLs in CDP?

  1. Ranger and HDFS ACLs are the same mechanism applied at different layers
  2. Ranger policies replace HDFS permissions entirely for all file operations
  3. HDFS ACLs override Ranger policies for Hive SQL queries
  4. Ranger policies are evaluated for service-level authorization while HDFS ACLs govern file system permissions Correct answer.

Explanation

Ranger authorizes service-level operations such as Hive SQL, while HDFS ACLs control native file system permissions; both layers can apply. Ranger does not eliminate HDFS permissions, and HDFS ACLs cannot govern SQL authorization.

Question 21Cloudera Platform

Which CDP service provides a distributed publish-subscribe messaging system for streaming ingestion into the platform?

  1. Apache Atlas
  2. Apache Hive
  3. Apache Kafka Correct answer.
  4. Apache Oozie

Explanation

Kafka is the distributed event streaming platform used for publish-subscribe messaging and streaming ingestion in CDP. Oozie schedules workflows, Hive queries data, and Atlas catalogs metadata.

Question 22Cloudera Platform

An administrator must ensure that queries submitted through Hue are attributed to the correct end user in Ranger audit records when Knox is in front of the cluster. Which configuration matters most?

  1. Enabling Snappy compression in Hive
  2. Setting the HDFS replication factor to three
  3. Forwarding the authenticated user identity through Knox so downstream services receive the real principal Correct answer.
  4. Disabling Kerberos on the Hue server

Explanation

When Knox proxies requests, identity must be forwarded so downstream services such as Hive and Ranger see the actual end user rather than the proxy principal. Disabling Kerberos, replication, and compression do not affect user attribution.

Question 23Cloudera Platform

Which CDP capability enables administrators to define row filter policies so that users only see rows matching a condition such as their region?

  1. Hive table statistics
  2. HDFS quotas
  3. Ranger row-level filter policies Correct answer.
  4. YARN preemption

Explanation

Ranger supports row-level filter policies that append predicates to queries so users see only permitted rows. Quotas limit storage, preemption reclaims containers, and statistics inform the optimizer.

Question 24Cloudera Platform

Which Cloudera Manager role is responsible for coordinating the cluster's configuration, monitoring, and service management?

  1. The HDFS DataNode
  2. The Kafka Broker
  3. The Cloudera Manager Server Correct answer.
  4. The Impala Daemon

Explanation

The Cloudera Manager Server is the central management service that stores configuration, monitors health, and orchestrates service lifecycle actions. DataNodes, Impala daemons, and Kafka brokers are managed worker roles.

Question 25Cloudera Platform

A governance team wants to block access to any Hive column tagged as confidential unless the requester holds a specific role, regardless of which table the column belongs to. Which design achieves this most maintainably?

  1. A separate table-level allow policy for every table containing such a column
  2. A manual review process before each query
  3. A tag-based Ranger policy on the confidential tag with an allow condition for the required role Correct answer.
  4. An HDFS ACL on each underlying file

Explanation

Tag-based policies attach to classifications rather than individual resources, so new tables inheriting the confidential tag are covered automatically. Per-table policies, file ACLs, and manual review do not scale or apply at column level.

Question 26Cloudera Platform

Which Cloudera Manager role serves as the primary management server that coordinates configuration, monitoring, and service lifecycle operations for a CDP cluster?

  1. The Service Monitor role
  2. The Activity Monitor role
  3. The Cloudera Manager Server role Correct answer.
  4. The Host Monitor agent role

Explanation

The Cloudera Manager Server is the central management process that stores cluster configuration, orchestrates service commands, and presents the admin console. Agents and monitors report to it rather than performing cluster-wide coordination themselves.

Question 27Cloudera Platform

In a CDP deployment, which component is responsible for storing the metadata that HiveServer and Impala use to resolve table names, schemas, and partitions?

  1. The YARN ResourceManager state store
  2. The Hive Metastore service backed by a relational database Correct answer.
  3. The Ranger Admin audit store
  4. The NameNode edit log

Explanation

The Hive Metastore persists table and partition metadata in a relational database and exposes a Thrift interface that Hive and Impala query. The NameNode and YARN stores hold file system and scheduling state, not table definitions.

Question 28Cloudera Platform

Which CDP capability lets an administrator restrict which rows a user can retrieve from a Hive table based on the user's group membership?

  1. Hive ACID transactional tables
  2. Ranger row filter policies Correct answer.
  3. HDFS transparent encryption zones
  4. Sentry role grants

Explanation

Ranger row filter policies attach a SQL predicate to a table for specified users or groups, so queries return only matching rows. Encryption zones and ACID tables address confidentiality at rest and mutation semantics, not row-level visibility.

Question 29Cloudera Platform

A platform team wants to run a stateless stream processing job that reads from Kafka and writes aggregated results to HDFS with exactly-once state consistency. Which CDP engine is designed for this workload?

  1. Apache Solr
  2. Apache Oozie
  3. Apache Sqoop
  4. Apache Flink Correct answer.

Explanation

Flink provides stateful stream processing with checkpointing that supports exactly-once semantics for Kafka sources and HDFS sinks. Oozie, Sqoop, and Solr serve workflow, batch transfer, and search roles respectively.

Question 30Cloudera Platform

An operator needs to grant a group read access to a directory in HDFS while ensuring Ranger policies still apply to the path. Which statement describes how HDFS ACLs and Ranger HDFS policies interact in CDP?

  1. HDFS ACLs override Ranger policies because POSIX permissions are checked first
  2. Ranger policies are evaluated as an additional authorization layer, and a deny or lack of allow can block access even if the ACL grants it Correct answer.
  3. HDFS ACLs and Ranger policies are evaluated independently and access is granted if either permits it
  4. Ranger policies replace HDFS ACLs entirely, so ACL entries are ignored once Ranger is enabled

Explanation

When Ranger HDFS authorization is enabled, its policies are consulted in addition to native permissions and ACLs, and a restrictive policy outcome can deny access that the ACL would otherwise allow. The two layers are not independent grants.

Question 31Cloudera Platform

A data engineer wants to query the same Hive-managed Parquet table from both Hive and Impala and needs both engines to see newly added partitions promptly. Which action best ensures Impala sees the new partitions?

  1. Run INVALIDATE METADATA or REFRESH on the table in Impala after the partitions are added Correct answer.
  2. Restart the HiveServer2 instance
  3. Recreate the table using CREATE TABLE AS SELECT
  4. Disable the Hive Metastore notification events

Explanation

Impala caches table and partition metadata, so after external changes such as adding partitions in Hive, it must be told to reload via REFRESH or INVALIDATE METADATA. Restarting HiveServer2 or recreating the table does not address Impala's metadata cache.

Question 32Cloudera Platform

A security administrator must ensure that every Hive query is audited with the requesting user, the accessed resource, and the policy decision. Which CDP configuration is required?

  1. Enable Kerberos cross-realm trusts between clusters
  2. Enable Ranger Hive authorization with audit logging configured to a supported audit destination Correct answer.
  3. Enable HDFS transparent encryption on the warehouse directory
  4. Enable Hive ACID transactions on all managed tables

Explanation

Ranger Hive policies produce audit records containing the user, resource, and access result when audit logging is enabled and a destination such as Solr or HDFS is configured. Encryption, ACID, and trusts do not generate per-query authorization audit events.

Question 33Cloudera Platform

An administrator wants requests made through Hue to be attributed to the individual end user in Ranger audit logs rather than to a shared service account. Which configuration supports this?

  1. Configure Hue to authenticate users directly and pass the end-user identity to Hive or Impala using delegation Correct answer.
  2. Set the Hive warehouse directory to a world-readable path
  3. Enable HDFS ACLs on the Hue configuration directory
  4. Configure Hue to run all queries as the hue service principal

Explanation

When Hue authenticates the user and forwards that identity through a proxy or delegation mechanism, downstream services and Ranger attribute the query to the real user. Running everything as the hue principal collapses attribution to that single account.

Question 34Cloudera Platform

A cluster must enforce minimum resource guarantees for Spark jobs submitted by different tenants while still allowing idle capacity to be shared. Which CDP mechanism provides this?

  1. YARN Capacity Scheduler queues with guaranteed capacity and elastic maximum limits Correct answer.
  2. HDFS storage policies with hot and cold tiers
  3. YARN FIFO scheduler with a single default queue
  4. Ranger resource policies on YARN queues

Explanation

The Capacity Scheduler assigns each queue a guaranteed share and an elastic maximum, so tenants receive minimum resources while unused capacity can be borrowed. The FIFO scheduler and storage policies do not provide per-tenant guarantees.

Question 35Cloudera Platform

A governance team wants to prevent access to any Hive column tagged as confidential unless the requester holds a specific role. Which CDP combination implements this?

  1. HDFS snapshots combined with NameNode HA
  2. YARN node labels combined with cgroups
  3. Atlas classification tags combined with Ranger tag-based policies Correct answer.
  4. Hive ACID tables combined with compactions

Explanation

Atlas stores classification tags, and Ranger tag-based policies evaluate those tags at access time so a confidential column can be restricted to a role. Snapshots, node labels, and ACID compactions do not implement tag-driven authorization.

Question 36Cloudera Platform

A team needs to ingest change data capture events from a relational database into Kafka on CDP with minimal impact on the source system. Which approach is most appropriate?

  1. Query the source database every second with SELECT * from a custom script
  2. Use a CDC connector that reads the database transaction log and publishes changes to Kafka Correct answer.
  3. Run periodic full-table Sqoop exports into HDFS and copy files into Kafka
  4. Use Oozie to schedule nightly mysqldump files into an Ozone bucket

Explanation

Log-based CDC connectors read the database transaction log, capturing inserts, updates, and deletes with low load on the source. Full exports and repeated SELECT queries impose heavier load and do not capture changes efficiently.

Question 37Cloudera Platform

An operator must move Hive tables to a new CDP cluster while preserving table definitions and partition metadata. Which approach best meets this requirement?

  1. Copy only the HDFS data files and let Hive discover the tables automatically
  2. Recreate the tables with CREATE TABLE AS SELECT from the old cluster's HiveServer
  3. Copy the Ranger policy database to the target cluster
  4. Export the Hive metastore metadata and copy the underlying HDFS or Ozone data to the target, then import the metadata Correct answer.

Explanation

Preserving tables requires both the metastore definitions and the underlying data, so exporting metadata and copying data before import retains schemas and partitions. Copying data alone leaves the target metastore unaware of the tables.

Question 38Cloudera Platform

A cluster uses Kerberos, and a client reports that a service fails to authenticate to HDFS after a password change on its keytab. Which troubleshooting step is most appropriate?

  1. Increase the NameNode heap size
  2. Disable Kerberos for the affected service to restore access
  3. Regenerate the service principal keytab from the KDC and redeploy it to the host, then restart the affected role Correct answer.
  4. Reformat the affected DataNode disks

Explanation

A stale keytab after a password change prevents the service from obtaining valid tickets, so the keytab must be regenerated from the KDC and redeployed. Disabling Kerberos, resizing heaps, or reformatting disks do not address credential mismatch.

Question 39Cloudera Platform

A data engineer notices that an Impala query on a large partitioned Parquet table is slow while the same query in Hive is fast. Impala's query plan shows it is scanning all partitions. Which cause is most consistent with this behavior?

  1. The YARN ResourceManager is in safe mode
  2. The NameNode is in standby state
  3. The HiveServer2 heap is undersized
  4. Impala has stale table metadata and has not been refreshed after new partitions were added Correct answer.

Explanation

If Impala's cached metadata is stale, it may not know about partitions or statistics and can fall back to broader scans, so REFRESH or INVALIDATE METADATA is needed. HiveServer2 heap, ResourceManager safe mode, and NameNode standby affect other components and would not selectively slow Impala partition pruning.

Question 40Cloudera Platform

A security architect must ensure that data written to an HDFS directory is encrypted at rest and that only a specific group can read the encryption key. Which CDP mechanism provides this?

  1. HDFS transparent encryption zones with a key management server and Ranger KMS key policies Correct answer.
  2. YARN node labels applied to the hosts
  3. Ranger row filter policies on the directory
  4. HDFS replication factor set to three

Explanation

Transparent encryption zones encrypt data at rest, and access to the encryption keys is controlled through Ranger KMS policies so only authorized groups can decrypt. Replication, row filters, and node labels do not provide key-level access control.

Question 41Enterprise AI

In Cloudera's enterprise AI stack, which component is primarily responsible for serving trained models to applications through a REST API with low latency?

  1. Cloudera Data Warehouse virtual warehouse
  2. Apache Hive metastore
  3. Cloudera Machine Learning model endpoint Correct answer.
  4. Cloudera Manager agent

Explanation

Cloudera Machine Learning (CML) provides model endpoints that deploy a trained model as a REST service, managing container scaling and authentication. The other components handle SQL analytics, metadata, and cluster management rather than real-time model inference.

Question 42Enterprise AI

A data science team wants to reproduce a model training run months later with identical library versions. Which Cloudera Machine Learning feature best addresses this requirement?

  1. Kerberos keytab rotation
  2. Runtime catalog engine images pinned per project Correct answer.
  3. YARN queue placement
  4. Project-level Git history only

Explanation

CML uses containerized runtime engines drawn from a catalog, and a project can be pinned to a specific engine image so dependency versions stay fixed. Git history tracks code but not the underlying library environment, so it alone cannot guarantee reproducibility.

Question 43Enterprise AI

Which Cloudera capability is designed to let analysts query data across an object store and a relational database using a single SQL engine without copying data?

  1. Cloudera Streams Messaging replication
  2. Cloudera Machine Learning experiments
  3. Cloudera Data Visualization dashboards
  4. Cloudera Data Warehouse with shared data experience Correct answer.

Explanation

Cloudera Data Warehouse, combined with the shared data experience (SDX) catalog and metadata, supports federated and external table access so analysts can query data in place. Dashboards, experiments, and replication are not SQL query engines over external sources.

Question 44Enterprise AI

In Cloudera Machine Learning, what is the primary purpose of a session in a project?

  1. To store the project's Git remote credentials permanently
  2. To schedule recurring production jobs
  3. To provide an interactive containerized environment for running code and notebooks Correct answer.
  4. To define the cluster's Kerberos realm

Explanation

A session launches a containerized runtime where users run notebooks, scripts, and interactive code within a project. Persistent scheduling is handled by jobs, and credentials or Kerberos settings are managed elsewhere.

Question 45Enterprise AI

A team needs a scheduled pipeline that retrains a model nightly and writes metrics to an experiment tracker. Which Cloudera Machine Learning construct should they use?

  1. An interactive session kept open indefinitely
  2. A job with a defined schedule and runtime engine Correct answer.
  3. A model endpoint replica set
  4. A Data Visualization dashboard refresh

Explanation

CML jobs run scripts or notebooks on a defined schedule inside a chosen runtime engine, which fits recurring retraining and metric logging. Interactive sessions are for ad hoc work, endpoints serve models, and dashboards only refresh visualizations.

Question 46Enterprise AI

Which statement best describes how Cloudera Machine Learning model endpoints handle increased inference traffic?

  1. They require manual creation of a new cluster for each request burst
  2. They route inference requests to the Hive metastore
  3. They scale replicas of the deployed model container based on configured settings Correct answer.
  4. They convert the model to SQL for execution in a virtual warehouse

Explanation

Model endpoints run the model inside containers and can increase the number of replicas to serve more concurrent requests. They do not spin up new clusters per burst, involve the metastore, or translate models into SQL.

Question 47Enterprise AI

What role does the shared data experience (SDX) play in a Cloudera enterprise AI deployment?

  1. It replaces the need for any authentication protocol
  2. It provides centralized metadata, governance, and security context across workloads Correct answer.
  3. It compiles Python code into native binaries
  4. It stores only the raw training data in HDFS

Explanation

SDX delivers a shared catalog, metadata, and consistent security and governance policies across Cloudera workloads such as data warehouse and machine learning. It complements rather than replaces authentication, and it does not store data or compile code.

Question 48Enterprise AI

An administrator wants to restrict which columns of a customer table a data science group can read, even when they query through Cloudera Machine Learning. Which Cloudera component enforces this?

  1. The Git server hosting the project
  2. Apache Ranger policies integrated with the SDX catalog Correct answer.
  3. The model endpoint's replica count
  4. The YARN capacity scheduler

Explanation

Apache Ranger provides fine-grained authorization, including column masking and row filtering, and integrates with the shared catalog so policies apply across engines. Git, endpoint replicas, and the scheduler do not enforce data access rules.

Question 49Enterprise AI

Which Cloudera Machine Learning feature helps data scientists compare multiple training runs by tracking parameters and metrics?

  1. Experiments Correct answer.
  2. Model endpoints
  3. Sessions
  4. Project collaborators

Explanation

CML experiments record parameters, metrics, and artifacts across runs so teams can compare and select the best model. Endpoints serve models, sessions are interactive environments, and collaborators are user-management settings.

Question 50Enterprise AI

A model endpoint in Cloudera Machine Learning must authenticate callers. Which mechanism is most appropriate for programmatic access from an external application?

  1. Sharing a data scientist's interactive session cookie
  2. Issuing an API key tied to a service account Correct answer.
  3. Disabling authentication on the endpoint
  4. Using the Hive metastore's Thrift port

Explanation

Programmatic clients should authenticate with an API key associated with a dedicated service account, which supports auditing and least privilege. Session cookies are for interactive users, disabling auth is insecure, and the metastore port is unrelated to endpoint access.