Discuss Databricks Databricks Certified Data Engineer Professional Exam Topic 4 Question 47

The data engineer team has been tasked with configured connections to an external database that does not have a supported native connector with Databricks. The external database already has data security configured by group membership. These groups map directly to user group already created in Databricks that represent various teams within the company.

A new login credential has been created for each group in the external database. The Databricks Utilities Secrets module will be used to make these credentials available to Databricks users.

Assuming that all the credentials are configured correctly on the external database and group membership is properly configured on Databricks, which statement describes how teams can be granted the minimum necessary access to using these credentials?

A''Read'' permissions should be set on a secret key mapped to those credentials that will be used by a given team.

BNo additional configuration is necessary as long as all users are configured as administrators in the workspace where secrets have been added.

C''Read'' permissions should be set on a secret scope containing only those credentials that will be used by a given team.

D''Manage'' permission should be set on a secret scope containing only those credentials that will be used by a given team.

Suggested Answer: C

In Databricks, using the Secrets module allows for secure management of sensitive information such as database credentials. Granting 'Read' permissions on a secret key that maps to database credentials for a specific team ensures that only members of that team can access these credentials. This approach aligns with the principle of least privilege, granting users the minimum level of access required to perform their jobs, thus enhancing security.

Databricks Documentation on Secret Management: Secrets

Get Premium Databricks Certified Data Engineer Professional Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

20 comments · newest first

Nguyet 1 month ago

A is straightforward. Read access is safer for teams.

Rolande 1 month ago

D feels too broad. "Manage" gives too much control.

Jerilyn 2 months ago

I agree with C. It's about minimizing access.

Gerald 2 months ago

Option B seems risky. Admins shouldn't have all the power.

Glenna 2 months ago

I prefer option C. It limits exposure to only what's necessary.

Gearldine 2 months ago

I think option A makes sense. Teams need specific access.

Isadora 2 months ago

A and C are both solid choices, but I lean towards C.

Virgie 3 months ago

Surprised that D is even an option, seems too permissive!

Vannessa 3 months ago

C sounds right, but I wonder if it’s enough.

Marcelle 3 months ago

I disagree, B is way too risky!

Candra 3 months ago

Option A makes the most sense for limited access.

Kizzy 3 months ago

I thought we needed "Manage" for everything, but C) feels safer.

Mike 3 months ago

D) sounds too permissive, we need to limit access!

Celestina 4 months ago

Wait, B) says admins don’t need extra config? That seems risky.

Margurite 5 months ago

Totally agree, C) makes the most sense!

Barbra 5 months ago

A) is the way to go for minimum access.

Hubert 6 months ago

I recall that secret scopes are meant to limit access, so I lean towards option C for granting minimum necessary access. It just makes sense to restrict it to what each team needs.

Dion 6 months ago

I’m a bit confused about the admin role. I thought that if everyone is an admin, they could access everything, but does that mean no extra config is needed?

Vicki 6 months ago

I think we practiced a question similar to this where we had to decide between read and manage permissions. I feel like "read" is safer for just accessing credentials.

Ardella 6 months ago

I remember we discussed the importance of setting the right permissions for secrets, but I'm not sure if it's better to use a secret key or a secret scope for this scenario.

Databricks Certified Data Engineer Professional Exam - Topic 4 Question 47 Discussion