Question 120
A regulated Lakehouse uses OneLake security for confidential engineering data. The current environment exhibits the following problem: a policy designer attempts to define a deny role to override an earlier allow. What is the most defensible next action?
Explanation
Correct Answer
Reconcile all grant roles and remove the excessive grant. OneLake security uses grant roles and does not provide general deny overrides.
Incorrect Answers
Two roles independently grant sales for distinct regions and users see both. OneLake combines multiple permitted role views rather than intersecting all roles.
A user can browse a parent folder but should not read neighboring confidential files. Path traversal visibility does not entail permission to read sibling data.
Analysts can read table metadata that should remain undiscoverable. Metadata visibility is part of data security and not just UI presentation.