Security, Governance and Data Sovereignty
What this domain tests
Security and governance questions separate authentication from authorization, show where row and column controls are enforced, and test whether you understand data sovereignty in a federated platform. The exam expects controls at the view layer, with lineage and audit evidence.
Core rules
- Authentication verifies identity through LDAP, Active Directory, Kerberos, SAML, OAuth, or database users. Authorization grants roles and privileges such as connect, metadata access, execute, and write.
- Enforce row-level security in views using session context, user attributes, or filter conditions; enforce column-level security with column privileges, masking, or projection views. Do not rely on the BI tool alone.
- Data Catalog governance uses glossary terms, tags, classifications, owners, and lineage to document meaning and sensitivity. Tags document policy; they do not enforce it by themselves.
- Data sovereignty concerns residency, cross-border transfer, and control. Federation can keep data in place, but cache, MPP spill, exports, and data movement can create copies. Choose cache location and retention accordingly.
- Encrypt in transit with TLS and protect credentials; audit access and administrative changes.
Worked example
An EU sales manager must see only EU opportunities. The identity provider supplies a region attribute at login; a row filter in the interface view compares the opportunity region to that session value. A masking rule hides account phone numbers from non-owners. Cache is disabled for this view, or pinned to an EU cache database, because caching would copy regulated rows. Lineage shows the CRM and ERP sources. The reasoning: authentication supplies the attribute, the view enforces the row and column rules, and sovereignty limits where results may reside.
Traps that cost marks
- Confusing authentication with authorization.
- Assuming catalog tags enforce access.
- Masking only in the reporting tool while the view exposes raw columns.
- Caching or exporting data across regions without a residency check.
- Granting broad roles to service accounts for convenience.