Plan and Prepare Data Connections22% of the exam
Entitlement tables for row-level security
Model entitlement tables for row-level security: deepest-granularity versus sparse entitlements, roles mapped to users, cross joins for NULL means all, the All Access group override, join-then-filter row explosion, two-object extracts, and the published data source filter that keeps it secure.
Implement RLS and an entitlement table.
~7 min read · 10 practice questions ·
What the exam expects
- Design an entitlement table: username column, one row per most granular entitlement, roles mapped to users, denormalized into one view.
- Choose between full mapping to the deepest granularity and sparse entitlements, and join each correctly.
- Explain row explosion in live queries and single-table extracts, and recommend the two-object Physical Tables extract.
- Secure the result with a published data source filter and the capabilities that must be denied.
- Match entitlement usernames to the site, including email-address usernames on Tableau Cloud.
Key terms:
- Entitlement: any unique combination of attributes the data can be filtered on.
- Entitlements view: entitlements mapped to users or roles, denormalized into one table, view or query.
- Sparse entitlements: entitlements defined per hierarchy level, with NULL meaning "all".
- Data source filter: a filter stored on the data source, acting as a WHERE clause for every query.
- Multi-table extract: an extract stored as Physical Tables, keeping the join out of the stored rows.
Key facts
Embedded data source with RLS
- Detail
- Filters can be removed by web editing or downloading
Deny on workbooks
- Detail
- Web Edit, Download/Save a copy, Set Permissions
Deny on data sources
- Detail
- Save, Download, Set Permissions
Full mapping
- Detail
- One row per possible entitlement; fewer join clauses
Sparse entitlements
- Detail
- NULL means "all"; more complex joins and filters
Join then filter
- Detail
- Rows processed up to entitled users × data rows
Multi-table extracts
- Detail
- Since 2018.3; two objects; extract filters disabled
RLS with extracts
- Detail
- Requires multiple physical tables
Tableau Cloud username
- Detail
- A unique email address
Filter as User preview
- Detail
- Not available with a published data source
- What does the RLS workflow require so that each signed-in user can be identified?
- Why is the initial "blowup" of a denormalized entitlements view acceptable?
- Why does Tableau recommend limiting an RLS extract to a data table and a reference table?
- Which Tableau version first let the data engine build multi-table extracts for RLS?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Tableau Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Tableau Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both