Security, authentication, authorization, and governance (SDX)
Domain 2 tests how CDP Public Cloud authenticates users and services, how access to data is decided, and how metadata and lineage support governance. Expect scenario questions that mix identity provider, Kerberos, Ranger, Atlas, and cloud IAM in one stem.
Authentication
FreeIPA runs in the Data Lake and provides the Kerberos realm and KDC; every Data Hub cluster joins that realm. Corporate identities are synchronised from Active Directory or LDAP, and end users typically reach services through SSO/SAML at the Knox gateway, which issues tokens for REST and UI access. TLS protects gateway and service traffic.
Authorization
Ranger is the central policy engine. Plugins enforce policies on Hive, Impala, HBase, Kafka, YARN, Kudu, Atlas, and object storage (Ranger Raz for cloud storage). Policies can be resource-based or tag-based, and can include row filters and column masking. Cloud IAM roles govern infrastructure and storage reachability only; they are not the mechanism for granting analysts table access. IDBroker maps the authenticated Kerberos identity to a scoped cloud role session.
Governance
Atlas stores technical and business metadata, classifications, and lineage captured from Hive, Spark, and Impala. Ranger can evaluate policies against Atlas classifications, so a tag such as PII added once can drive masking across many tables. Ranger audit records show allowed and denied decisions per user and resource.
Worked example
An analyst may see only EMEA rows of a Hive table and must not see full card numbers. Reasoning: create a Ranger policy for the analyst's AD group on that table with a row filter region='EMEA' and a column mask (hash or nullify) on the card column. Test as the actual user, because Ranger evaluates the authenticated identity and group membership, not the policy author. If the same rule must cover dozens of tables, classify the columns in Atlas and write one tag-based policy instead.
Traps
Granting data access through cloud IAM policies; assuming an Atlas tag blocks access by itself without a Ranger tag policy; testing with an admin account; forgetting that FreeIPA group sync lags AD changes; ignoring deny policies and exclusion conditions that override allow rules.