Databricks Data Engineer Associate Question 490
Select 3A data engineering team wants to securely access Azure Data Lake from Databricks without using personal credentials. They decide to use a service principal for this purpose. Which of the following steps are necessary to correctly configure the service principal for access?
- A
Create an Azure Active Directory (AAD) application and assign it the required permissions to the Data Lake.
- B
Generate a client secret or certificate for the service principal and securely store it in Databricks.
- C
Assign the service principal to a Databricks workspace as a user and configure user-level permissions.
- D
Use Databricks secrets to securely store the credentials for the service principal.
- E
Configure the Databricks cluster to use the service principal for authentication with the Data Lake.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely access Azure Data Lake using a service principal, you must create an Azure Active Directory (AAD) application, assign necessary permissions to the Data Lake, and generate authentication credentials (client secret or certificate). These credentials should be securely stored in Databricks Secrets. Service principals are not treated as users in Databricks, and authentication does not require cluster-level configuration.
- A. Correct.
Creating an Azure Active Directory (AAD) application is the first step to creating a service principal, and assigning it the necessary permissions ensures it can access the Data Lake.
- B. Correct.
A client secret or certificate is required for the service principal to authenticate. The secret or certificate should be securely stored in Databricks to ensure secure access.
- C. Incorrect.
Service principals are not users and cannot be assigned to a Databricks workspace as regular users. This step is incorrect.
- D. Correct.
Storing the service principal's credentials in Databricks Secrets ensures secure handling of sensitive information like client secrets.
- E. Incorrect.
While the service principal is used to authenticate with the Data Lake, it doesn’t need to be directly configured at the cluster level. Authentication is managed through credentials stored in Databricks Secrets.