Security, Governance, and Metadata (Ranger, Atlas, SDX)
This domain tests how CDP enforces authorization consistently across engines and how metadata and lineage are captured. Questions usually describe a user, a group, and a table, then ask what the user actually sees.
Apache Ranger
- Policies attach to resources (database, table, column, URL, HDFS path) or to tags managed in Atlas, and are assigned to users/groups/roles.
- Each policy yields allow, deny, or no decision. Deny overrides allow, and an explicit deny on a column beats a table-level allow.
- Column masking options include redaction, partial masking (show last four), hashing, nullify, and date truncation. Masking is applied at query time; base data is untouched.
- Row filters append a predicate to every query, e.g.
region = 'APAC'. - Ranger audits every access decision; audit logs are the first place to look when access is denied unexpectedly.
- Ranger policies apply per component - a Hive/Impala table policy does not automatically grant the underlying HDFS path; HDFS policies still govern file access.
Apache Atlas and SDX
- Atlas holds entities (tables, columns, processes), classifications/tags, a glossary with business terms, and lineage captured asynchronously by hooks from Hive, Impala, Spark, and others.
- Lineage is not instant: a new table appears after the hook fires, so an “invisible” table is usually a timing issue.
- SDX (Shared Data Experience) is Cloudera's shared security, governance, and metadata layer: one Ranger/Atlas/HMS service set enforcing consistent policy across Impala, Hive, Spark, HBase, and Kafka, and carried through replication.
Worked example
Group analyst_apac queries sales, which contains region and email. Requirement: they see only APAC rows, and email is partially masked. Create a Ranger row-filter policy region = 'APAC' and a column-mask policy on email using partial mask showing the last four characters, both scoped to the group. In Impala the query returns only APAC rows, and email shows ****@domain. Aggregate counts differ from an unpoliced query, which is expected.
Traps
- Assuming the table-level allow wins over a column-level deny - deny wins.
- Expecting a Hive grant alone to let a user read the HDFS files behind an external table.
- Treating Atlas lineage as real-time.
- Tag-based policies silently failing because the classification was never attached to the table.
- Forgetting that masking changes query output, so BI totals can differ per user.