Databricks Data Engineer Associate Question 489
Select 3A data engineering team is setting up a Databricks workspace and needs to enable automated jobs to access Azure Data Lake Storage without using personal credentials. They decide to use a service principal. Which of the following steps are necessary to define and configure a service principal to access the storage securely?
- A
Create a service principal in Azure Active Directory and assign it the necessary role to access the storage account.
- B
Generate a personal access token (PAT) in Databricks for the service principal.
- C
Add the service principal to the Databricks workspace by assigning it to a group with appropriate permissions.
- D
Obtain the client ID and client secret for the service principal and configure them in Databricks to authenticate against Azure.
- E
Directly assign the service principal to the storage account without configuring it in Azure Active Directory.
Show answer and explanation
Correct answers: A, C, D
Explanation
Service principals are used to enable secure, non-interactive access to Azure resources, such as storage accounts, from Databricks. To set up a service principal, it must first be created in Azure Active Directory, assigned appropriate roles, and then configured in Databricks with its credentials (client ID and client secret). Additionally, it is essential to assign the service principal to the Databricks workspace with appropriate permissions to ensure it can perform required actions within Databricks.
- A. Correct.
Correct: Creating a service principal in Azure Active Directory and assigning it the appropriate role ensures it has the necessary permissions to access the storage account.
- B. Incorrect.
Incorrect: Service principals do not use personal access tokens (PATs); these are typically used for user authentication in Databricks.
- C. Correct.
Correct: Adding the service principal to the Databricks workspace and assigning it to a group ensures it has the required permissions to interact with Databricks resources.
- D. Correct.
Correct: The client ID and client secret are necessary for authenticating the service principal, and these must be configured in Databricks for secure access.
- E. Incorrect.
Incorrect: A service principal must be created and managed in Azure Active Directory before assigning it to any resource to ensure proper security and identity management.