S06 Security & Monitoring DWH

You create a Warehouse table sales.Orders and apply a Security Policy that filters rows by the user’s region.
Which additional configuration is REQUIRED for users to successfully query the table?

• Adding users to the workspace as Viewer

• Granting SELECT on the table to the relevant database roles

• Enabling Dynamic Data Masking on sensitive columns

• Creating a Column-Level Security DENY on non-regional columns

In a Fabric Warehouse you need to prevent analysts from discovering that the table hr.EmployeeSalary even exists, while HR managers must retain full visibility.
Which TWO actions should you perform? (Choose 2.)

• Grant SELECT on hr.EmployeeSalary to the Analyst role

• DENY VIEW DEFINITION on schema hr to the Analyst role

• DENY SELECT on schema hr to the Analyst role

• Create a Row-Level Security filter that returns 0 rows for the Analyst role

You implement Column-Level Security (CLS) on sales.Orders so the column CostPrice is hidden from the Analyst role. Which statement about query results for that role is correct?

• Queries return NULL in CostPrice for every row.

• Queries fail with Msg 229 (permission denied) when CostPrice is referenced.

• CostPrice is silently omitted from SELECT * result sets.

• The column is visible only when accessed through a stored procedure.

You need to create a single Row-Level Security policy that grants full access to members of the Finance role and filters by region for all other users. Which predicate function satisfies the requirement?

• RETURN SELECT 1 WHERE IS_MEMBER('Finance') = 0

• RETURN SELECT 1 WHERE IS_MEMBER('Finance') = 1 OR @Region = USER_NAME()

• RETURN SELECT 1 WHERE IS_MEMBER('Finance') = 1 OR @Region = 'Finance'

• RETURN SELECT 1 WHERE IS_MEMBER('Finance') = 1 OR @Region = USER_NAME() OR 1=0

You plan to create a Row-Level Security predicate that relies on the user identity. Which system function is SUPPORTED in Fabric Warehouses and can be safely used inside the predicate?

• ORIGINAL_LOGIN()

• SUSER_SID()

• USER_NAME()

• EXECUTE AS USER