Granting, revoking, and denying access with SQL and the UI

Unity Catalog secures data using standard SQL GRANT/REVOKE syntax applied across a hierarchy: metastore, catalog, schema, table/view, and column/row levels. Privileges can be assigned to users, groups, or service principals, and access can also be managed visually through the Catalog Explorer UI. Effective access is determined by combining grants inherited from higher levels with grants at the specific object level.

Must-know

• Privileges granted at a catalog or schema level are inherited by all objects nested beneath them, so granting USE CATALOG and USE SCHEMA plus SELECT at the catalog level cascades down to all schemas/tables within it.
• GRANT SELECT ON TABLE catalog.schema.table TO group_name is the standard syntax; REVOKE removes a previously granted privilege using the same object path.
• Common privileges include USE CATALOG, USE SCHEMA, SELECT, MODIFY, CREATE TABLE, and ALL PRIVILEGES, and the correct privilege must exist at every level of the hierarchy (catalog, then schema, then table) for a query to succeed.
• Unity Catalog does not support DENY; access control is additive only through GRANT and REVOKE, so restricting access means revoking or simply never granting a privilege rather than explicitly denying it.
• The Catalog Explorer UI's Permissions tab lets admins grant/revoke the same privileges as SQL commands, making it interchangeable with running GRANT/REVOKE statements in a notebook or SQL editor.
• Service principals are treated as principals just like users and groups, and are the recommended identity type for granting access to automated jobs and pipelines rather than granting access to individual user accounts.

Coverage checked against the published exam guide on Jul 27, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.