Databricks-DE-Assoc Implementing CI/CD Practice Question
When utilizing Databricks Asset Bundles, how should secrets (e.g., API keys, database credentials) be handled to ensure security during CI/CD?
⚠ Common exam trap
Candidates frequently suggest storing secrets in environment variables or configuration files directly, ignoring the security risk of leaking credentials and the availability of Databricks' built-in secret reference syntax.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the bundle's secret reference syntax to map variables to a secret scope.
Hardcoding secrets in configuration files is a critical security vulnerability. Databricks Asset Bundles support referencing secrets through the 'secrets' scope, which securely retrieves credentials at runtime. By decoupling sensitive data from the version-controlled YAML files, teams maintain security, avoid leaking credentials in Git, and simplify secret rotation. This practice is essential for enterprise security and ensures that sensitive infrastructure data is managed in alignment with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the secrets in the bundle's YAML configuration files.
Why it's wrong here
Hardcoding secrets into version-controlled files exposes them to anyone with access to the repository, leading to severe security breaches. Secrets should always be stored in a dedicated, encrypted secret management service (like Azure Key Vault or AWS Secrets Manager) and retrieved dynamically by the Databricks environment at runtime.
- ✗
Store secrets as environment variables in the Git repository.
Why it's wrong here
Environment variables containing secrets are often inadvertently exposed in CI/CD logs or repository history. Like hardcoding, this is a significant security risk. Secrets should be fetched from a secure, authorized secret store using the Databricks secret referencing syntax, ensuring they remain encrypted and inaccessible to unauthorized users or systems.
- ✓
Use the bundle's secret reference syntax to map variables to a secret scope.
Why this is correct
Referencing secret scopes allows the CI/CD pipeline to inject credentials at execution time without exposing the actual values in the code. This is the industry-standard approach to managing sensitive information, ensuring that credentials remain secure while allowing the automation engine to authenticate successfully to external services during job execution.
- ✗
Ask all developers to manually enter secrets in the production UI.
Why it's wrong here
Manual intervention in the production UI creates a non-repeatable, un-audited process that is prone to human error and security lapses. Automation should handle credential injection in a secure, transparent manner. Requiring manual entry also slows down deployment cycles and prevents the organization from achieving a true CI/CD maturity level.
About these practice questions
One of 276 original Databricks-DE-Assoc practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-DE-Assoc practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-DE-Assoc exam.