Question
You have a Fabric workspace named Workspace1 that contains a lakehouse named Lakehouse1. Lakehouse1 contains these tables:
- Orders
- Customer
- Employee
The Employee table contains Personally Identifiable Information (PII).
A data engineer is building a workflow that requires writing data to the Customer table, however, the user does NOT have the elevated permissions required to view the contents of the Employee table.
You need to ensure that the data engineer can write data to the Customer table without reading data from the Employee table.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Share Lakehouse1 with the data engineer.
- B. Assign the data engineer the Contributor role for Workspace2.
- C. Assign the data engineer the Viewer role for Workspace2.
- D. Assign the data engineer the Contributor role for Workspace1. Correct
- E. Migrate the Employee table from Lakehouse1 to Lakehouse2. Correct
- F. Create a new workspace named Workspace2 that contains a new lakehouse named Lakehouse2. Correct
- G. Assign the data engineer the Viewer role for Workspace1.
Explanation
Writing to a lakehouse table requires a workspace role that can write, such as Contributor, and a Contributor in Workspace1 can read every item in that workspace, including the Employee table. To keep the PII out of reach, create Workspace2 with Lakehouse2, move the Employee table there, and give the data engineer the Contributor role on Workspace1 only. Sharing Lakehouse1 or assigning Viewer grants read access only, so the engineer still could not write to Customer, and any role on Workspace2 would expose the Employee data again.
