Databricks-GenAI-Assoc Design Applications Practice Question
A team is designing a GenAI application that must call an external LLM provider from a Databricks notebook and from a Model Serving endpoint. The security team requires that the provider API key never appear in notebook source code, Git history, or the model artifact, and that the same governed credential be reused by both the notebook and the serving endpoint. Which design satisfies these requirements?
⚠ Common exam trap
The trap here is treating any secret scope reference as sufficient, when the requirement also demands that the same governed credential be consumable by a Model Serving endpoint, which a manually resolved secret does not satisfy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key in a Unity Catalog connection that supports external services, and reference that connection from both the notebook and the Model Serving endpoint.
Centralizing the external provider credential in a Unity Catalog connection keeps plaintext out of source code, Git history, and artifacts while letting both notebooks and Model Serving endpoints reference the same governed object. Secret scopes with manual injection, widget defaults, and cluster Spark configurations either leak the value or fail to reach the serving runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the API key in a Unity Catalog connection that supports external services, and reference that connection from both the notebook and the Model Serving endpoint.
Why this is correct
A Unity Catalog connection centralizes credential storage and access control, so the API key never appears in code or artifacts. Both notebooks and Model Serving endpoints can reference the same governed connection, giving consistent secret rotation and auditability. This directly meets the requirement that one governed credential be reused without exposing the plaintext anywhere in source or configuration.
- ✗
Hard-code the API key as a widget default in the notebook and mirror it into the serving endpoint's environment variables so both components share one value.
Why it's wrong here
Widget defaults are stored in the notebook definition and are visible in version history and exports, so the credential leaks into Git. Mirroring the same plaintext into the endpoint configuration spreads the exposure further. This approach violates the requirement that the key never appear in notebook source or the model artifact, and it offers no rotation or audit trail.
- ✗
Store the API key in a Databricks secret scope and reference it with dbutils.secrets.get in the notebook, then pass the resolved value into the serving endpoint's environment variables.
Why it's wrong here
Referencing a secret with dbutils.secrets.get keeps the value out of notebook source, but resolving it and passing the plaintext into a serving endpoint's environment variables exposes the credential in the endpoint configuration and defeats the governed reuse requirement. The key would also be visible to anyone who can read the endpoint definition, so this design is not acceptable.
- ✗
Place the API key in a cluster-scoped Spark configuration on the interactive cluster, and have the serving endpoint read the same configuration at request time.
Why it's wrong here
Spark configurations are visible to any user who can view the cluster and do not apply to Model Serving endpoints, which run outside the interactive cluster context. The key would be exposed to cluster users and unavailable to the endpoint, so this design neither protects the credential nor enables the required reuse across both runtime environments.
About these practice questions
One of 330 original Databricks-GenAI-Assoc practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Databricks exam blueprint
This Databricks-GenAI-Assoc practice question is part of Courseiva's free Databricks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Databricks-GenAI-Assoc exam.