A retail company stores all of its sales transactions in main.sales.transactions, with records from every sales region. The governance team protects the table with the following row filter: ```sql CREATE FUNCTION main.sec.emea_filter(region STRING) RETURN IF(is_account_group_member('sales_admins'), true, region = 'EMEA'); ALTER TABLE main.sales.transactions SET ROW FILTER main.sec.emea_filter ON (region); ``` Members of sales_admins and analysts who are not members of the group both query main.sales.transactions. What does each user see?

1. A. All users see all rows; the function only records which non-admin users queried the table. 💬 A
2. B. The query fails for users outside sales_admins, because they lack permission to evaluate the filter function. 💬 B
3. C. Members of sales_admins see all rows; everyone else sees only the rows where region = 'EMEA'. ✓ C
4. D. All users see only EMEA rows in SQL, but members of sales_admins can bypass the filter by exporting the table from Catalog Explorer. 💬 D

Reveal answer

Correct answer: Members of sales_admins see all rows; everyone else sees only the rows where region = 'EMEA'.

Reference: https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks/