The governance team granted the group marketing_analysts all of its access to catalog main with one set of statements: ```sql GRANT USE CATALOG ON CATALOG main TO marketing_analysts; GRANT USE SCHEMA ON CATALOG main TO marketing_analysts; GRANT SELECT ON CATALOG main TO marketing_analysts; ``` The group's project later ends. An administrator runs REVOKE SELECT ON CATALOG main FROM marketing_analysts, and the group holds no grants other than the three shown. What happens to its members' access to tables in main.sales and main.marketing?

1. A. They lose SELECT on every table under main at once, because those reads were inherited from the catalog-level grant. ✓ A
2. B. They keep reading the tables, because the surviving USE CATALOG and USE SCHEMA privileges are what authorize data access. 💬 B
3. C. Their access persists until an administrator repeats the REVOKE on every schema and every table under main. 💬 C
4. D. The REVOKE is ignored below the catalog, because Unity Catalog copies inherited privileges into each table when granting them. 💬 D

Reveal answer

Correct answer: They lose SELECT on every table under main at once, because those reads were inherited from the catalog-level grant.

Reference: https://docs.databricks.com/aws/en/data-governance/unity-catalog/manage-privileges/