Exam DP-700 topic 1 question 9 discussion

Assign the data engineer the Contributor role for Workspace1 ( D) - This will provide the necessary permissions to write to the Customer table. Migrate the Employee table from Lakehouse1 to Lakehouse2 (E) - This will isolate the table with PII in a different lakehouse. Create a new workspace named Workspace2 that contains a new lakehouse named Lakehouse2 (Option F) - This is necessary to separate the Employee table into a different workspace to restrict access.

First we need to do F and E to separate the Employee table from the other tables. Then they need contributor access to be able to write to the Customer table which is in Workspace1 A is incorrect as sharing only gives read access. https://learn.microsoft.com/en-us/fabric/data-engineering/lakehouse-sharing B is incorrect as Workspace2 has the Employee table which the data engineer shouldn’t access. C is incorrect as viewer won’t allow them to write and the Customer table isn’t even in that workspace E is incorrect as viewer won’t allow them to write

Solution Steps: Isolate sensitive data: Create a new workspace (Workspace2) with a new lakehouse (Lakehouse2) to host the PII data separately. → F. Create a new workspace named Workspace2 that contains a new lakehouse named Lakehouse2. Move PII data: Migrate the Employee table (PII) from Lakehouse1 to Lakehouse2 to remove it from the original environment. → E. Migrate the Employee table from Lakehouse1 to Lakehouse2. Grant minimal write permissions: Assign the Contributor role for Workspace1 to the data engineer. This role allows writing to objects (like the Customer table) but does not grant access to Workspace2 (where PII resides). → D. Assign the data engineer the Contributor role for Workspace1.

✅ D. Assign the data engineer the Contributor role for Workspace1 Contributor role is required to write data to tables in the workspace, including Customer. This role allows adding or editing content but not managing access or seeing hidden data like Employee if it’s secured separately. ✅ E. Migrate the Employee table from Lakehouse1 to Lakehouse2 Since the Employee table contains PII, and the engineer should not have access to it, moving it to a separate lakehouse ensures isolation of sensitive data, while still allowing access to Customer in Lakehouse1. F. Create a new workspace named Workspace2 that contains a new lakehouse named Lakehouse2

Correct DEF

FED: Create a new workspace and lakehouse (Workspace2 and Lakehouse2). Migrate the Employee table to the new lakehouse. Assign the data engineer the Contributor role in the original workspace. con esto los ingenieros no pueden ver ni escribir los datos PII

The order is F---E---D.

A. Share Lakehouse1 with the data engineer This gives the data engineer access to the lakehouse so they can interact with its tables. Sharing is required before any role-based permissions can be applied. D. Assign the data engineer the Contributor role for Workspace1 The Contributor role allows users to read and write data to lakehouse tables. However, table-level security can still restrict access to specific tables like Employee. E. Migrate the Employee table from Lakehouse1 to Lakehouse2 This isolates the PII data in a separate lakehouse. Since the data engineer won’t have access to Lakehouse2, they won’t be able to read the Employee table, even if they have Contributor access to Lakehouse1.

The three correct actions to take are: E. Migrate the Employee table from Lakehouse1 to Lakehouse2 — This isolates sensitive data (Employee table) from the data engineer’s access. D. Assign the data engineer the Contributor role for Workspace1 — This allows the data engineer to write to the Customer table in Lakehouse1. F. Create a new workspace named Workspace2 that contains a new lakehouse named Lakehouse2 — This action is a result of migrating the Employee table to Lakehouse2 in a separate workspace (Workspace2) to ensure restricted access to sensitive data (PII). Why Option A is Incorrect: A. Share Lakehouse1 with the data engineer: Sharing only gives read access to the lakehouse, which is not sufficient for the data engineer to write data to the Customer table in Lakehouse1. They need write permissions to modify the table, so Contributor role for Workspace1 is the correct option.

Since only 3 answers needed to be selected ADE

belive me..

C. Assign the Viewer role for Workspace2: This ensures the data engineer can see the structure and metadata of the workspace without accessing sensitive Employee table data. They can still write to the Customer table without elevated permissions. E. Migrate the Employee table from Lakehouse1 to Lakehouse2: This separates Personally Identifiable Information (PII) from the original lakehouse, ensuring the data engineer does not have access to sensitive data while working with non-PII data. F. Create Workspace2 with Lakehouse2: This creates an isolated environment specifically for sensitive data like the Employee table. It ensures workspace-level access control and adheres to privacy and security best practices.

The steps are F, E, D

So, in this case, your answer DEF makes sense as it covers the necessary steps: Create a new workspace and lakehouse (Workspace2 and Lakehouse2). Migrate the Employee table to the new lakehouse. Assign the data engineer the Contributor role in the original workspace.

If we are migrating the Employee table to Lakehouse 2 in the workspace 2 , what is wrong in sharing the Lakehouse 1 with the data engineer ? My answer would be A, E, F

I think D, E, and F are the working solution.

Why A is incorrect: A. Share Lakehouse1 with the data engineer. Sharing Lakehouse1 directly grants access to all its contents, including the Employee table, which violates the requirement.