Databricks-DE-Assoc Implementing CI/CD Practice Question
When integrating Databricks with a CI/CD tool like GitHub Actions, how should you securely manage the authentication token used for deployments?
⚠ Common exam trap
Candidates often suggest hardcoding tokens in the repo or using insecure plain-text files, failing to recognize that CI/CD providers offer dedicated encrypted secret stores for this exact purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the token as an encrypted secret in the CI/CD provider's secret store.
Managing secrets securely is vital for CI/CD. Storing tokens directly in code or pipeline definitions exposes them to unauthorized access. By using a secrets manager, you decouple the sensitive credentials from the pipeline logic. This ensures that the CI/CD platform can authenticate with Databricks dynamically during the execution phase, maintaining a high security posture while allowing for easy rotation of credentials without needing to refactor the entire codebase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the Databricks Personal Access Token directly into the YAML pipeline file.
Why it's wrong here
Hardcoding credentials is a severe security vulnerability. Anyone with read access to the repository can obtain the token and impersonate the user. Secrets should never be stored in plain text in source control; instead, they must be injected at runtime using secure environment variables or secret managers.
- ✓
Store the token as an encrypted secret in the CI/CD provider's secret store.
Why this is correct
Storing credentials in a secure, encrypted secret store provided by CI/CD platforms like GitHub Actions or GitLab is the standard security practice. This prevents exposure in logs or source control while ensuring the pipeline can securely access the Databricks API during the execution of deployment tasks.
- ✗
Save the token in a public S3 bucket and download it when the pipeline starts.
Why it's wrong here
Public buckets provide no security for sensitive data. Any user or automated scanner can access the token instantly, leading to potential data breaches or unauthorized infrastructure modifications. Credentials must always be protected by access controls and encryption mechanisms specifically designed for secrets management.
- ✗
Use your own password as the token for easier memorization and access.
Why it's wrong here
Using personal passwords as authentication tokens is a critical security failure and violates organizational compliance standards. Databricks tokens are specifically designed to provide scoped access that can be revoked independently of user passwords, providing a layer of security that simple passwords cannot match.
About these practice questions
One of 276 original Databricks-DE-Assoc practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-DE-Assoc practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-DE-Assoc exam.