Governance interview questions
Governance questions a Data engineer can be asked, from first job to senior. Open one to see the strongest answer and why it works.
A raw landing includes national ids “for later.” What do you do?
The strongest answer: Minimise: drop, tokenise, or restrict that column at land — later is not a purpose, and copies multiply
Why it works: Exactly. Purpose at ingest. Cheap storage of PII is still PII. MD5 of an id is often still an id.
- Minimise at land.
- Later ≠ purpose.
- MD5 ≠ gone.
- No public buckets of ids.
What is a data catalog for, and what makes it worth keeping up to date?
The strongest answer: A searchable inventory of datasets with owner, description, schema, freshness and classification, so people find and trust the right table; it stays alive when pipelines feed it automatically and access is requested through it
Why it works: Right — discovery, ownership and classification, populated by automation and tied to access; that is a catalog people actually use.
- Find, trust, classify.
- Owner, freshness, schema, classification.
- Populate from pipelines automatically.
- Tie access to the catalog.
Someone wants a nightly prod dump in the analytics sandbox “for realism.” What do you say?
The strongest answer: No — subset, fake, or tokenise; a dump is a PII leak and a moving oracle
Why it works: Exactly. Realism is shapes, not people. Friday deletes and private buckets still copied the people.
- Subset or fake.
- No nightly people-dumps.
- Private ≠ minimise.
- Laptops are not an exception.
What must a dataset page say besides the schema?
The strongest answer: Owner, freshness SLO, and grain — a schema without those is a museum label
Why it works: Exactly. Who, when, grain. Lying live badges are a red flag.
- Owner + freshness + grain.
- Schema is not enough.
- Do not badge nightly as live.
- Do not omit the owner.
A DAG file contains the warehouse password. What do you do?
The strongest answer: Rotate, move it to the secret store, and treat the commit as a leak — a DAG is still git
Why it works: Exactly. Rotate and vault. Team-only git is still copies. Variables named password are still secrets in a UI.
- Rotate the leaked secret.
- Inject from a vault.
- DAGs are git.
- Do not store plaintext in Variables.
How do you keep PII from leaking into a “features” table for a model?
The strongest answer: A column catalogue, a deny-list test, and a separate restricted zone — I do not rely on “data scientists know”
Why it works: Exactly. Tests and zones. Wiki and god-roles are how features become a leak.
- Catalogue + deny-list test.
- Restricted zone.
- Do not rely on memory.
- Do not give the model admin.
Spark logs printed a sample row with an email. What do you do?
The strongest answer: Stop sample-printing raw, purge what policy says, and log shapes or tokens — I do not keep “just this cluster’s” stdout
Why it works: Exactly. Driver logs are copies. Ephemeral is a wish. Encrypted emails are still emails for anyone with the key.
- Do not sample-print PII.
- Purge and tokenise.
- Logs retain.
- Do not hope people skip the UI.
A user requests erasure. What must the pipeline do besides the app DB?
The strongest answer: Find derived copies — landings, models, backups in policy — and apply the same erasure or a documented exception; I do not say “the warehouse is analytics so it does not count”
Why it works: Exactly. Copies count. Vibe exemptions and annual waits are how you fail a privacy review.
- Trace derived copies.
- Erase or document the exception.
- Analytics counts.
- Do not wait for an annual rebuild.
How do you design zones so a features table cannot casually include email?
The strongest answer: Separate restricted raw, a tokenised working zone, and a test that fails unknown columns — culture follows the wall
Why it works: Exactly. Walls and tests. Talk, please, and admin are how email lands in features.
- Restricted vs tokenised zones.
- Fail unknown columns.
- No please-as-control.
- No DS admin on PII.
Analysts need the customers table for segmentation but must not see emails or phone numbers. Two teams need the clear values.
How do you serve both without two tables?
The strongest answer: Column-level policies on the one table: dynamic masking or tokenisation returns a hash or redacted value unless the querying role is authorised, with row-level policies where needed — one table, one lineage, access decided by role
Why it works: Exactly — policy on the column, not copies of the table; the same query returns what your role is allowed to see.
- Mask at the column, by role.
- One table, one lineage.
- Policies beat copies and views.
- Access logging is not control.
A director wants “data mesh” on a slide. What do you require in the room?
The strongest answer: Domain owners, contracts, and a platform that makes the paved path easier than a shadow lake — the word is not a reorg
Why it works: Exactly. Ownership plus a road. Renames, anarchy, and no-platform are how you get 40 swamps.
- Owners + contracts + paved path.
- The word is not a reorg.
- No anarchy Spark.
- Do not ban the platform.
How do you keep PII from being “everyone’s problem” and therefore nobody’s?
The strongest answer: A catalogue, zone walls, erasure runbooks, and an owner per restricted table — “be careful” is not an org chart
Why it works: Exactly. System plus owners. Videos, heroes, and encrypt-so-class-vanishes are how copies multiply.
- Catalogue + zones + erasure.
- Owner per restricted table.
- No hero-only privacy.
- Encryption ≠ classification done.
How do you govern without becoming the team people route around?
The strongest answer: Defaults that are safe, a short path for exceptions, and self-serve for the paved — I do not put a human on every create-table
Why it works: Exactly. Safe defaults plus a path. Boards, no-rules, and novels-with-queues are how you get tunnels or swamps.
- Safe defaults.
- Short exception path.
- Self-serve the paved.
- No human on every table.
Self-serve created 30 unofficial revenues. What does the platform change?
The strongest answer: Make certified the easy path and unofficial look unofficial — I do not turn off self-serve or hide the badge
Why it works: Exactly. Paved versus dirt. Off, careful, and hidden badges are how you get 31 sheets.
- Certified is easy.
- Unofficial looks unofficial.
- Do not kill self-serve.
- Do not hide the badge.