Plan and Prepare Data Connections22% of the exam
User filters, data policies and database RLS compared
Choose a row-level security approach from Tableau's decision flow: manual and dynamic user filters, data policies on virtual connections, and RLS already built into the database through impersonation, Kerberos delegation or Initial SQL, with the licence, permission and connection trade-offs of each.
Compare RLS approaches.
~8 min read · 8 practice questions ·
What the exam expects
- Walk Tableau's row-level security decision flow: existing database RLS, then Data Management, then proof of concept or static audience, otherwise a dynamic user filter.
- Compare manual and dynamic user filters on maintenance, data requirements and the permissions that keep them secure.
- Explain how data policies on virtual connections centralize RLS, how they interact with permissions and the Connect capability, and where they stop applying (flow output, extracts built downstream).
- Weigh database RLS (impersonation, Kerberos delegation, Initial SQL) against its requirements: live connections, database users for every viewer, dedicated connections, Active Directory.
- Pick the approach for OLAP cubes and for external audiences who have no database or domain account.
Key terms:
- Manual user filter: a set that maps named users or groups to field values, created with Server > Create User Filter.
- Dynamic user filter: a calculated field that compares a security column in the data with a user function.
- Data policy: a policy on virtual connection tables whose policy condition is evaluated for every row at query time.
- Connect capability: the virtual connection permission that lets a user query it and build content on its tables.
- Database RLS: security already enforced by the database, which Tableau reuses by querying as the viewer.
Key facts
Decision flow order
- Detail
- Database RLS, Data Management, POC or static, then dynamic filter
Data policy scope
- Detail
- Workbooks, data sources and flows using the connection; live and extract
Flow output
- Detail
- Not filtered by the data policy
Querying a virtual connection
- Detail
- Requires the Connect capability; policies don't override permissions
Database RLS
- Detail
- Live connections only; likely unavailable on Tableau Cloud
Impersonation
- Detail
- SQL Server 2005 or newer; individual accounts, not AD groups
Kerberos delegation
- Detail
- AD identity store, domain-joined server, viewer credentials
OLAP cubes
- Detail
- No data source filter, no USERNAME()
Bridge
- Detail
- Doesn't support SQL impersonation using Initial SQL
Sources for this section (5)
- Why might a data policy's entitlement table live in a different database from the tables it secures?
- When does Kerberos delegation fall back to the Run As account during web authoring?
- Why should an Initial SQL RLS data source be published rather than embedded?
- Which function categories can a data policy condition use?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Tableau Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Tableau Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both