Databricks ML Professional Practice Question 26: Execute Grant Serving
Databricks Certified Machine Learning Professional · Test 3 · question 6 of 10
A serving endpoint is created under a service principal to serve prod.ml.fraud. The service principal already holds USE CATALOG on prod and USE SCHEMA on prod.ml, but the endpoint fails to come up because it cannot read the model version.
Which grant resolves this?
Show answer and explanation
Answer:
EXECUTE is the Unity Catalog privilege that permits using a registered model: loading a version for inference, and serving it from an endpoint. It has to be accompanied by USE CATALOG and USE SCHEMA on the containing catalog and schema, which the service principal already has, so EXECUTE on the model itself is the single missing piece. Granting it is also the least-privilege answer: it confers the ability to use the model and nothing else.
Option A grants the wrong capability. MODIFY allows creating new versions and changing the model, which an inference workload should not have, and it is not what governs reading a version.
Option B addresses a securable that is not involved. A registered model is a Unity Catalog object in its own right, governed by model privileges, not by table or file grants on underlying storage.
Option C works only by making the service principal all-powerful over every object in the catalog. That is a large privilege escalation to solve a single missing model grant, and it is the opposite of least privilege.
Reference: Manage model lifecycle in Unity Catalog