Databricks-DE-Pro Developing Code (Python/SQL) Practice Question
When designing a production-grade data pipeline in Databricks, what is the recommended approach for managing secrets such as database credentials?
⚠ Common exam trap
Many candidates mistakenly select environment variables or hardcoded config files, forgetting that Databricks provides a dedicated secure utility for managing runtime secrets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the dbutils.secrets.get() method to retrieve credentials at runtime.
Hardcoding credentials in notebooks is a severe security risk. Databricks Secrets provides a centralized, secure way to store and manage sensitive information. By referencing secrets via the 'dbutils.secrets.get()' API, credentials are kept out of the source code and version control. This approach ensures that secrets can be rotated without modifying code and restricts access to those specifically authorized to view them through the Databricks access control policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store credentials in a public GitHub repository.
Why it's wrong here
Storing credentials in public repositories is a catastrophic security failure. Even in private repositories, hardcoded secrets are susceptible to accidental exposure through git history. Secrets must be stored in specialized vaults, such as Databricks Secrets or Azure Key Vault, and accessed programmatically during runtime to prevent unauthorized exposure.
- ✓
Use the dbutils.secrets.get() method to retrieve credentials at runtime.
Why this is correct
The 'dbutils.secrets.get()' method is the standard, secure way to access secrets stored within the Databricks Secret Scope. This keeps sensitive information out of the notebook text, allowing for secure integration with external systems while providing centralized management and auditing of secret usage within the Databricks platform's security framework.
- ✗
Pass credentials as environment variables via cluster initialization scripts.
Why it's wrong here
While init scripts can set environment variables, this is not the recommended practice for secret management in Databricks. Secrets in environment variables are often visible to any user with permission to describe the cluster, making them less secure than the scoped-access model provided by the Databricks Secret API.
- ✗
Encrypt credentials using a local Python library and save them to a file.
Why it's wrong here
Manually encrypting credentials relies on the developer correctly managing the encryption keys, which introduces new security vulnerabilities. Databricks provides a robust, managed service for secrets that handles encryption at rest and in transit, making manual encryption unnecessary and inherently less secure than the platform's native, audited secret management.
About these practice questions
This Databricks-DE-Pro question is part of Courseiva's 267-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-DE-Pro practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-DE-Pro exam.