I85PREP
⌘ K
Databricks Platform Admin study materials
Databricks Platform Admin study resources

Databricks Platform Admin practice questions

One question at a time. Build your Databricks Platform Admin understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Databricks accounts, workspaces and identity boundaries

Which Databricks administrative interface is used to create new workspaces, view billing, and manage account-level identities?

  1. A workspace's Admin Settings page
  2. The account console (accounts.cloud.databricks.com / accounts.azuredatabricks.net) Correct answer.
  3. The Unity Catalog Explorer in any workspace
  4. The Spark UI of an all-purpose cluster

Explanation

The account console is the top-level administrative surface. It is where account admins create workspaces, manage account-level users and groups (with SCIM), configure metastores, view billable usage, and link cloud resources. Workspace Admin Settings only manage a single workspace.

Question 2Databricks accounts, workspaces and identity boundaries

On the Databricks platform, what is the role of the control plane?

  1. It hosts customer data files in S3, ADLS, or GCS
  2. It runs the web app, REST APIs, job scheduler, and cluster manager in Databricks' cloud account Correct answer.
  3. It runs the executors that process customer data inside customer compute
  4. It stores Unity Catalog managed tables on the customer's cloud storage

Explanation

The control plane is operated by Databricks and hosts the workspace web app, REST APIs, notebooks UI, jobs scheduler, and the cluster manager that orchestrates customer compute. Customer data normally stays in the customer's cloud account in the data plane (classic compute) or in Databricks-managed serverless compute.

Question 3Databricks accounts, workspaces and identity boundaries

An admin needs to deploy a Databricks workspace in a customer-managed VPC on AWS so they can control subnets and security groups. Which deployment option supports this?

  1. Default Databricks-managed VPC deployment
  2. Customer-managed VPC (BYOV) workspace deployment Correct answer.
  3. Serverless-only workspace with no VPC at all
  4. Cross-account IAM role deployment using only Databricks default networking

Explanation

The customer-managed VPC option (often called BYOV, bring-your-own-VPC) lets you provision the VPC, subnets, and security groups yourself and register them with the Databricks account, then deploy the workspace into that VPC. This is required for stricter network controls, PrivateLink, or specific CIDR planning.

Question 4Databricks accounts, workspaces and identity boundaries

On Azure Databricks, which networking feature allows the workspace to be deployed into a customer's existing virtual network with control over subnets and NSGs?

  1. VNet injection Correct answer.
  2. VNet peering only
  3. Application Gateway integration
  4. ExpressRoute Direct only

Explanation

VNet injection deploys the Azure Databricks workspace data plane into two delegated subnets in the customer's existing virtual network. The customer controls NSGs, route tables, and DNS. VNet peering and Application Gateway are complementary networking patterns but are not the deployment mode that injects the workspace.

Question 5Databricks accounts, workspaces and identity boundaries

On AWS, which feature provides private connectivity from a corporate network to Databricks REST APIs and notebook web UI without traversing the public internet?

  1. AWS Direct Connect only
  2. Front-end AWS PrivateLink to the Databricks workspace Correct answer.
  3. VPC Flow Logs
  4. S3 Gateway Endpoint

Explanation

Front-end PrivateLink terminates user-to-Databricks traffic (REST APIs, notebook UI) on a VPC endpoint inside the customer's AWS account, keeping it off the public internet. Back-end PrivateLink covers data plane to control plane traffic. Direct Connect is a separate dedicated link technology.

Question 6Databricks accounts, workspaces and identity boundaries

On Azure, what is the equivalent feature to AWS PrivateLink for reaching the Azure Databricks workspace privately?

  1. Azure Private Endpoint backed by Private Link service Correct answer.
  2. Azure Application Gateway only
  3. Azure Firewall NAT rules
  4. Azure Bastion

Explanation

On Azure, Private Endpoints (powered by Azure Private Link) attach a private IP from your VNet to the Azure Databricks workspace, making the workspace reachable without public internet traversal. Application Gateway, Azure Firewall, and Bastion are different services with different roles.

Question 7Databricks accounts, workspaces and identity boundaries

Which of the following best describes 'serverless compute' in Databricks?

  1. Compute that runs in the customer's VPC/VNet exclusively
  2. Compute managed entirely by Databricks (in Databricks' cloud account) and billed by usage, used for SQL warehouses, jobs, and notebooks Correct answer.
  3. Compute that requires no IAM permissions at all
  4. On-prem compute

Explanation

Serverless compute is hosted and managed in the Databricks-operated environment. It eliminates customer responsibility for cluster instance management. Available for SQL warehouses (Serverless SQL), workflows, and notebooks (where supported). Customer data is still governed by UC.

Question 8Databricks accounts, workspaces and identity boundaries

Which describes 'Front-end' vs 'Back-end' PrivateLink in AWS Databricks?

  1. Front-end privatizes user-to-workspace traffic (REST API + UI); Back-end privatizes data-plane to control-plane traffic Correct answer.
  2. Front-end is for storage; Back-end is for OAuth
  3. They are the same product
  4. Front-end is only for SQL warehouses

Explanation

Front-end PrivateLink terminates user-to-Databricks traffic on a customer VPC endpoint. Back-end PrivateLink covers communication from the data plane (customer compute) to the Databricks control plane services. Both can be used together for end-to-end private connectivity.

Question 9Databricks accounts, workspaces and identity boundaries

An organization wants every new workspace to enforce: workspace IP allowlist, customer-managed keys, PrivateLink-only access, and identity federation. Where should these be standardized?

  1. In each workspace's Admin Settings, manually, after the workspace is created
  2. At the account level via account-level network configurations, encryption configurations, PrivateLink configs, and identity federation, then assigned/applied at workspace creation Correct answer.
  3. Only on cluster policies
  4. Only via system tables

Explanation

Account-level configurations (network configurations for VPC/PrivateLink, encryption configurations for CMK, identity federation, default workspace settings) are reusable building blocks an account admin defines once and applies to every new workspace. This is the standard hardened-pattern approach.

Question 10Databricks compute policies, jobs and operational evidence

In the supplied autoscaling configuration, every permitted creation path uses the enforced compute policy. Which listed constraint can cap autoscale.max_workers at 8 instead of 64?

  1. Cluster policy with a fixed/max constraint on autoscale.max_workers Correct answer.
  2. Workspace IP access lists
  3. Unity Catalog row filter
  4. OAuth token TTL

Explanation

Cluster policies are JSON documents that constrain cluster configuration. To cap workers, set autoscale.max_workers with type 'range' and maxValue: 8 (or 'fixed'). Policies enforce node types, runtime versions, autotermination, init scripts, instance pools, and many other settings.

Question 11Databricks compute policies, jobs and operational evidence

In a Databricks cluster policy, which JSON snippet correctly fixes the Databricks Runtime version to 14.3 LTS?

  1. "spark_version": { "type": "fixed", "value": "14.3.x-scala2.12" } Correct answer.
  2. "runtime": "14.3-lts"
  3. "spark_conf.spark.version": "14.3"
  4. "dbr_version": { "fixed": "14.3" }

Explanation

Cluster policies use the same field names as the Clusters API. spark_version is the runtime image identifier (e.g., 14.3.x-scala2.12). To pin it, use the policy syntax {"type": "fixed", "value": "14.3.x-scala2.12"}. The other forms are not valid cluster API fields.

Question 12Databricks compute policies, jobs and operational evidence

Which Databricks cluster access mode is required for general multi-user clusters that need Unity Catalog support?

  1. No Isolation Shared
  2. Shared (now called Standard) access mode Correct answer.
  3. Single User access mode (always required)
  4. Custom access mode

Explanation

The Shared access mode (rebranded Standard in newer UI) supports Unity Catalog with table-, row-, and column-level security and process isolation between users. Single User mode also supports Unity Catalog but is dedicated to one identity (useful for ML workloads needing ML Runtime features). No Isolation Shared does NOT support Unity Catalog.

Question 13Databricks compute policies, jobs and operational evidence

Which of the following is true about Single User cluster access mode?

  1. It cannot be used with Unity Catalog under any circumstances
  2. It is dedicated to one assigned user or service principal and supports Unity Catalog plus features like Databricks ML Runtime Correct answer.
  3. It allows multiple users to share the cluster with row-level security
  4. It runs on the control plane, not the data plane

Explanation

Single User access mode is assigned to one principal (a user or service principal). It supports Unity Catalog and is required for some libraries, ML runtime features, and certain GPU workloads where the Shared mode's process isolation is incompatible.

Question 14Databricks compute policies, jobs and operational evidence

What is the primary purpose of a Databricks instance pool?

  1. To replace clusters entirely
  2. To pre-warm cloud VM instances so that clusters can start faster and reuse instances across runs Correct answer.
  3. To define which catalogs a user can access
  4. To store job logs

Explanation

An instance pool holds idle, ready-to-use VMs of a specific node type. Clusters created with the pool draw VMs from the pool, eliminating cold-start time for many workloads. Pools have min/max idle instances and idle-timeout settings to balance cost and start time.

Question 15Databricks compute policies, jobs and operational evidence

In the supplied supported classic-compute design where all permitted creation paths use an enforced library/init-script policy, which listed approach standardizes the required dependencies?

  1. Manually install on each cluster every time
  2. Use cluster-scoped init scripts (or library configurations) plus a cluster policy that enforces them, or define libraries on cluster policy / job Correct answer.
  3. Place files in DBFS root only
  4. Create a notebook that runs pip install at the start of every job

Explanation

A supported policy and dependency-installation arrangement can standardize relevant classic compute in the stated scope. Library compatibility, installation outcomes, creation permissions and alternate compute paths still need verification. The policy alone does not guarantee every possible cluster or serverless environment has one identical runtime.

Question 16Databricks compute policies, jobs and operational evidence

An admin wants the SQL warehouse to scale automatically between 1 and 8 clusters based on query queue length. Which warehouse setting controls this?

  1. Cluster size only
  2. Auto-scaling Min/Max Clusters on the SQL warehouse Correct answer.
  3. Spot instance percentage
  4. Photon toggle

Explanation

SQL warehouses scale horizontally by adding clusters via the Min/Max Clusters auto-scaling settings. Each added cluster handles additional concurrent queries. Cluster size scales the per-cluster capacity. Photon enables vectorized execution but does not scale clusters.

Question 17Databricks compute policies, jobs and operational evidence

Which two cluster access modes support Unity Catalog?

  1. Single User and Shared (Standard) Correct answer.
  2. No Isolation Shared and Single User
  3. Custom and Shared
  4. Only Single User

Explanation

Unity Catalog is supported on Single User mode (assigned to one identity) and Shared/Standard mode (multi-user with process isolation). No Isolation Shared is legacy and does NOT support Unity Catalog.

Question 18Databricks compute policies, jobs and operational evidence

Which Databricks REST API path lists clusters in a workspace?

  1. GET /api/2.0/clusters/list Correct answer.
  2. GET /api/2.1/jobs/list
  3. POST /api/2.0/clusters/list
  4. GET /api/2.0/sql/warehouses

Explanation

GET /api/2.0/clusters/list returns the clusters in a workspace. /api/2.1/jobs/list is for jobs. /api/2.0/sql/warehouses is for SQL warehouses. POST is not the correct verb for listing clusters.

Question 19Databricks compute policies, jobs and operational evidence

Which of these statements about cluster policy 'permissions' is correct?

  1. Anyone can use any policy by default
  2. Admins grant 'Can Use' on a cluster policy to specific users/groups; only those principals can launch clusters from that policy Correct answer.
  3. Cluster policies are disabled in Unity Catalog
  4. Cluster policies only affect SQL warehouses

Explanation

Cluster policies have ACLs. Admins grant Can Use to selected principals (users, groups, service principals). Only those principals can create clusters using that policy. Combined with personal compute defaults, admins can heavily constrain compute.

Question 20Databricks compute policies, jobs and operational evidence

What is the function of Databricks 'workspace files' (as a recommended replacement for DBFS for code and small assets)?

  1. Block storage on cluster nodes
  2. A workspace-resident file store under /Workspace, accessible from notebooks/jobs and governed via workspace ACLs Correct answer.
  3. A replacement for Unity Catalog tables
  4. A cluster init log destination

Explanation

Workspace files (under /Workspace) are first-class files in the workspace, accessible in notebooks via standard Python I/O. Permissions follow workspace ACLs. They are recommended over DBFS root for code, configs, and small assets and integrate with Repos.

Question 21Databricks compute policies, jobs and operational evidence

What security advantage does Photon provide?

  1. Automatic data encryption
  2. Photon is a vectorized execution engine for performance; it does not by itself add new security Correct answer.
  3. It removes the need for Unity Catalog
  4. It encrypts secret scopes

Explanation

Photon is a C++-based vectorized execution engine that improves SQL/DataFrame performance. It is a performance feature, not a security feature. UC, secret scopes, encryption, and IP access lists provide security; Photon is orthogonal.

Question 22Databricks compute policies, jobs and operational evidence

Which feature lets admins specify that all init scripts must come from Unity Catalog volumes (and not legacy DBFS paths)?

  1. Cluster policy with init_scripts.0.volumes constraints (and platform-wide deprecation of DBFS-hosted init scripts) Correct answer.
  2. Cluster ACLs only
  3. OAuth scopes
  4. Workspace IP access lists

Explanation

Databricks is migrating init script hosting away from DBFS toward UC Volumes and workspace files. Admins can enforce this with cluster policies that require init_scripts to come from a volume path (init_scripts.0.volumes.destination) and disallow DBFS sources.

Question 23Databricks compute policies, jobs and operational evidence

Which Databricks feature lets a workspace admin schedule and orchestrate multi-task pipelines with retries and dependencies?

  1. MLflow
  2. Databricks Workflows (Jobs) Correct answer.
  3. Spark UI
  4. Cluster Policy

Explanation

Databricks Workflows (the Jobs feature) lets you build DAGs of tasks (notebooks, JARs, Python wheels, dbt, SQL, DLT). Tasks can have dependencies, retries, conditional execution, and triggers. Admins can manage Job permissions and access via groups.

Question 24Databricks compute policies, jobs and operational evidence

An admin needs to allow only a specific Microsoft Entra ID group of data scientists to use a 'GPU ML Cluster Policy'. Which sequence is correct?

  1. Provision the group via SCIM, then grant 'Can Use' on the cluster policy to that group Correct answer.
  2. Add each user as account admin
  3. Grant the policy to PUBLIC then revoke from non-data-scientists individually
  4. Configure a workspace IP access list with the data scientists' IPs

Explanation

First ensure the Entra ID group is provisioned to Databricks via SCIM (account-level), then in the cluster policy permissions, grant 'Can Use' to that group. This ties Databricks compute access to IdP group membership and removes the need to manage individual users.

Question 25Databricks compute policies, jobs and operational evidence

What is the recommended approach for managing an init script that installs proprietary Python wheels on every cluster?

  1. Hardcode credentials in the script
  2. Store the wheels in a Unity Catalog volume, install them via cluster policy library configuration or an init script that pulls from the volume, and grant READ VOLUME to the cluster's principal Correct answer.
  3. Email the wheels to each user
  4. Put them in the workspace home folder of every user

Explanation

UC volumes provide governed file storage. Place wheels in a volume and reference them in cluster libraries or init scripts. Grant READ VOLUME (USAGE on parents) to the principal running the cluster. This avoids credentials in scripts and centralizes distribution.

Question 26Databricks compute policies, jobs and operational evidence

An admin needs to ensure that no cluster runs longer than 60 minutes idle. Which JSON property in a cluster policy fixes this?

  1. "autotermination_minutes": { "type": "fixed", "value": 60 } Correct answer.
  2. "idle_minutes": 60
  3. "max_idle": 60
  4. "cluster_idle_timeout": "60m"

Explanation

The cluster API field is autotermination_minutes (integer minutes after which an idle cluster terminates). In a cluster policy, you fix it with {"type": "fixed", "value": 60}. The other names are not valid cluster API fields.

Question 27Databricks compute policies, jobs and operational evidence

Which Databricks feature replaces the legacy 'No Isolation Shared' cluster mode for multi-user, governed compute?

  1. Single User mode for everyone
  2. Shared (Standard) access mode with Unity Catalog Correct answer.
  3. DBFS mounts
  4. Spark Streaming

Explanation

Shared/Standard mode with Unity Catalog provides multi-user clusters with process isolation, fine-grained data access controls, and audit. No Isolation Shared is being phased out because it does not support UC and provides weaker isolation between users.

Question 28Databricks compute policies, jobs and operational evidence

Which of the following is the correct CLI command to create a cluster from a JSON file with the Databricks CLI v0.200+?

  1. databricks clusters create --json @cluster.json Correct answer.
  2. databricks cluster new -f cluster.json
  3. databricks api compute create-cluster cluster.json
  4. databricks-cli clusters submit cluster.json

Explanation

In the v0.200+ Databricks CLI, 'databricks clusters create --json @cluster.json' creates a cluster (the @ prefix loads the JSON from a file). 'databricks api ...' is a generic API passthrough but uses different positional arguments. The other forms are not valid CLI syntax.

Question 29Databricks compute policies, jobs and operational evidence

Which of the following is correct about SQL warehouse 'serverless' vs 'pro' vs 'classic'?

  1. Serverless runs in Databricks' cloud account (fastest start, fully managed); Pro and Classic run in the customer's data plane (Pro is the more feature-rich classic) Correct answer.
  2. All three run in the customer VPC
  3. Classic is fastest to start
  4. Pro is deprecated

Explanation

The supplied warehouse types distinguish provider-managed serverless compute from the relevant classic customer-compute arrangements. Feature support, startup behavior, networking and availability depend on cloud, region and configuration. A type label alone does not guarantee the fastest possible startup or every governance capability.

Question 30Databricks compute policies, jobs and operational evidence

Which feature lets admins define a default catalog for a workspace so users don't always specify the full three-level name?

  1. Workspace default catalog (set by an admin in Admin Settings) Correct answer.
  2. Cluster spark.defaultCatalog only
  3. Personal default schema in user preferences only
  4. There is no default catalog feature

Explanation

Admins can configure a workspace's default catalog in Admin Settings. New SQL sessions default to that catalog (so 'sales.orders' resolves under it). This streamlines onboarding while still allowing fully-qualified names. Cluster-level Spark configs are alternative but less common.

Question 31Databricks compute policies, jobs and operational evidence

Which scenario describes when an admin should use a Single User cluster instead of Shared (Standard) cluster mode?

  1. When multiple analysts run interactive SQL on the same cluster
  2. When running a job that requires Databricks ML Runtime libraries or specialized GPU/CUDA workloads not supported on Shared Correct answer.
  3. When you want UC governance
  4. When you want to disable governance

Explanation

Single User mode is required when the Shared mode's process isolation conflicts with workload requirements: notably ML runtime extensions, certain GPU/CUDA setups, or libraries that need direct JVM/driver access. Single User still supports UC.

Question 32Databricks accounts, workspaces and identity boundaries

For the supplied IdP integration explicitly using account-level SCIM provisioning rather than another supported identity-management method, which listed standard synchronizes users and groups?

  1. SAML only (no automated provisioning)
  2. SCIM 2.0 provisioning at the account level Correct answer.
  3. LDAP synchronization
  4. Kerberos delegation

Explanation

Databricks supports SCIM 2.0 at the account level. The IdP (Okta, Microsoft Entra ID, OneLogin, etc.) pushes users and groups to Databricks via the SCIM API at /api/2.0/accounts/{account_id}/scim/v2/Users and /Groups. Identity federation propagates them to assigned workspaces.

Question 33Databricks accounts, workspaces and identity boundaries

What is a Databricks 'service principal'?

  1. A user account used for end-user logins
  2. A non-human identity used by automated tools, jobs, and CI/CD to authenticate to Databricks Correct answer.
  3. A workspace-level admin role granted to a security team
  4. A cluster setting that escalates privileges

Explanation

A service principal is a non-human identity intended for automation: jobs, scheduled pipelines, REST API integrations, and CI/CD. They can authenticate via OAuth or PATs and can be granted Unity Catalog and workspace permissions like users.

Question 34Databricks accounts, workspaces and identity boundaries

Which authentication method does Databricks recommend for new automation, replacing legacy long-lived personal access tokens (PATs) where possible?

  1. Basic auth with username/password
  2. OAuth tokens (machine-to-machine for service principals, U2M for users) Correct answer.
  3. Cookie-based session tokens
  4. API keys downloaded as files only

Explanation

Databricks recommends OAuth: M2M (client_id/client_secret) for service principals, and U2M (browser-based) for users. OAuth tokens are short-lived and can be rotated. PATs still work but are long-lived and harder to manage at scale.

Question 35Databricks accounts, workspaces and identity boundaries

An admin wants to restrict Databricks workspace access to traffic from corporate office IPs and a VPN. Which feature should they configure?

  1. Workspace IP access lists Correct answer.
  2. Cluster policy
  3. Unity Catalog catalog-level grants
  4. Token lifetime policy

Explanation

IP access lists allow admins to permit or block source IP CIDRs at the workspace level. Configured via Admin Settings or the /api/2.0/ip-access-lists REST endpoint. Combined with PrivateLink, they significantly reduce the workspace attack surface.

Question 36Databricks accounts, workspaces and identity boundaries

On the Databricks CLI v0.200+, which command authenticates an interactive user via OAuth U2M for a given host?

  1. databricks login --token
  2. databricks auth login --host <workspace-url> Correct answer.
  3. databricks oauth init
  4. databricks configure --aad-token

Explanation

The new CLI uses 'databricks auth login --host https://<workspace>.cloud.databricks.com', which opens a browser for OAuth U2M and stores a profile in ~/.databrickscfg. 'databricks configure --token' is the legacy PAT path; 'databricks login' is not the v0.200+ command.

Question 37Databricks accounts, workspaces and identity boundaries

Which REST API endpoint is used to create a new user via SCIM at the account level?

  1. POST /api/2.0/accounts/{account_id}/scim/v2/Users Correct answer.
  2. POST /api/2.0/scim/Users
  3. POST /api/2.1/users/create
  4. PUT /api/2.0/identity/Users

Explanation

Account-level SCIM uses POST /api/2.0/accounts/{account_id}/scim/v2/Users with a SCIM-compliant JSON body. Workspace-level SCIM (legacy) is at /api/2.0/preview/scim/v2/Users on the workspace host. The other paths are not real Databricks endpoints.

Question 38Databricks accounts, workspaces and identity boundaries

Which statement about Databricks workspace admins vs account admins is correct?

  1. Workspace admins can create new workspaces and manage billing
  2. Account admins manage the entire account (billing, workspaces, account-level identities, metastores), while workspace admins manage only their assigned workspace Correct answer.
  3. All users start as account admins
  4. Workspace admins automatically become account admins

Explanation

Account admins operate at the account console: workspaces, billing, account identities, metastores. Workspace admins operate within one workspace: workspace settings, workspace ACLs, cluster policies, job permissions. The two roles are deliberately separated.

Question 39Databricks accounts, workspaces and identity boundaries

Which of the following is a prerequisite for SCIM identity federation across multiple workspaces in an account?

  1. Each workspace must be in a different region
  2. The workspaces must be on Unity Catalog with identity federation enabled at the account level Correct answer.
  3. PrivateLink must be configured
  4. Each user must have a personal access token

Explanation

Identity federation puts users and groups at the account level (Unity Catalog account console) and assigns them to workspaces. The workspaces must be enabled for identity federation; many newer workspaces are by default. PrivateLink and PATs are not prerequisites.

Question 40Databricks accounts, workspaces and identity boundaries

An admin needs to limit which IP ranges can hit the workspace API. What is the correct approach for IP access lists?

  1. Configure IP access lists from Workspace Admin Settings or via /api/2.0/ip-access-lists, marking ranges as ALLOW or BLOCK Correct answer.
  2. Reconfigure the cluster's network ACLs only
  3. Set spark.conf entries blocking external IPs
  4. Use Unity Catalog grants to limit IPs

Explanation

IP access lists are configured via the Workspace Admin Settings UI or the /api/2.0/ip-access-lists REST API. Each list is ALLOW or BLOCK with a list of CIDRs. Allow lists ensure only trusted IPs can reach the workspace.

Question 41Databricks accounts, workspaces and identity boundaries

Which best describes 'identity federation' in Databricks?

  1. A SAML provider that federates Databricks workspaces to AWS
  2. An account-level identity model where users/groups exist at the account and are synced/assigned into workspaces Correct answer.
  3. A way for two metastores to share one user
  4. An auth method for Spark drivers

Explanation

Identity federation puts users, groups, and service principals at the account level. SCIM provisioning targets the account. Workspaces are then assigned identities or groups; permission management is unified. This replaces older per-workspace SCIM.

Question 42Databricks accounts, workspaces and identity boundaries

On Azure Databricks, what is the recommended IdP for SCIM and SSO integration?

  1. Google Cloud Identity
  2. Microsoft Entra ID (formerly Azure Active Directory) Correct answer.
  3. AWS IAM Identity Center
  4. Auth0 only

Explanation

Azure Databricks integrates natively with Microsoft Entra ID for SSO and SCIM provisioning of users and groups. Other IdPs (Okta, OneLogin, Ping) work via SAML+SCIM, but Entra ID is the most native option on Azure.

Question 43Databricks accounts, workspaces and identity boundaries

Which is the recommended approach to give an automated job in Databricks access to a UC table without sharing a human user's credentials?

  1. Use a service principal, grant SELECT on the table to it, and run the job as that service principal Correct answer.
  2. Share the data engineer's PAT with the job
  3. Mark the table as PUBLIC SELECT
  4. Create a workspace-local Hive metastore copy

Explanation

Service principals are the recommended automation identity. The admin grants the necessary UC privileges and configures the job to run as the service principal (Run as: service principal). PATs from human accounts are an audit and rotation problem.

Question 44Databricks accounts, workspaces and identity boundaries

An admin notices a service principal that hasn't been used for 12 months. What's the BEST hygiene action?

  1. Disable or delete the service principal and rotate any associated secrets Correct answer.
  2. Promote it to account admin so it cannot expire
  3. Convert it to a user account
  4. Ignore it; idle service principals are harmless

Explanation

Unused identities expand the attack surface. Disable or delete the service principal and rotate or revoke its secrets and PATs. Periodic identity review is a baseline IAM control.

Question 45Databricks accounts, workspaces and identity boundaries

Which of the following accurately describes the role of an Account Admin?

  1. Only an account admin can configure workspace-level cluster policies; workspace admins cannot
  2. Account admins manage account-level resources: workspaces, billing, account identities, metastores, network configurations, encryption keys, and account audit settings Correct answer.
  3. Account admins are limited to viewing logs
  4. Account admins are workspace-scoped

Explanation

Account admins are the highest privilege at the account console. They manage workspaces, billing, account-level identities, metastores, network configurations (PrivateLink, customer-managed VPCs/VNets), encryption keys, and account-level audit. Workspace admins are scoped to a single workspace.

Question 46Databricks accounts, workspaces and identity boundaries

Which is true about workspace-level vs account-level groups in identity-federated workspaces?

  1. Workspace-level groups exist independently and are unrelated to account-level groups
  2. Account-level groups are recommended for governance; they can be assigned to workspaces, and Unity Catalog grants are made to account-level principals Correct answer.
  3. All groups must be defined as workspace-level for SCIM to work
  4. Account-level groups cannot be referenced in UC grants

Explanation

In an identity-federated account, account-level groups are the recommended governance unit. They are managed via SCIM, assigned to one or more workspaces, and are the principals used in Unity Catalog grants and many ACLs. Workspace-local groups still exist but are scoped to one workspace.

Question 47Databricks accounts, workspaces and identity boundaries

What does enabling 'token lifetime' policies in workspace settings accomplish?

  1. Caps the maximum lifetime of personal access tokens generated in that workspace (e.g., max 90 days) Correct answer.
  2. Encrypts cluster log files
  3. Grants admin rights
  4. Increases SQL warehouse parallelism

Explanation

Workspace admins can configure token lifetime policies that enforce a maximum lifetime (in days) on PATs. This reduces risk from long-lived credentials and supports rotation. Combined with disabling PAT creation entirely (and using OAuth), it tightens credential hygiene.

Question 48Databricks accounts, workspaces and identity boundaries

Which API path is correct for SCIM at the workspace level (legacy workspace SCIM)?

  1. /api/2.0/preview/scim/v2/Users Correct answer.
  2. /api/2.1/scim/Users
  3. /scim/v3/Users
  4. /api/2.0/admin/users

Explanation

Workspace-level SCIM lives at /api/2.0/preview/scim/v2/Users and /Groups on the workspace host. Account-level SCIM is at /api/2.0/accounts/{account_id}/scim/v2/Users. Modern setups federate identity at the account level.

Question 49Databricks accounts, workspaces and identity boundaries

Which is true about Databricks workspace-level entitlements like 'Workspace Access', 'Databricks SQL access', 'Allow cluster creation'?

  1. They are immutable
  2. Admins assign them to users/groups (via Admin Settings or SCIM) to control which workspace features a principal can use Correct answer.
  3. They are part of UC grants
  4. They are derived from PAT scopes

Explanation

Workspace entitlements (workspace-access, databricks-sql-access, allow-cluster-create) are settable per principal in Admin Settings (or via SCIM PATCH on the principal). They control what features a principal can use within the workspace.

Question 50Unity Catalog objects, privileges and storage responsibility

Where in Databricks are 'metastores' created and assigned to workspaces?

  1. Inside each workspace's Admin Settings
  2. From the account console (Data > Metastores), and then assigned to one or more workspaces Correct answer.
  3. From a notebook using CREATE METASTORE
  4. Automatically created per cluster

Explanation

In the stated manual account-level Unity Catalog setup, the account administrator creates the regional metastore and assigns relevant workspaces under the supported relationship. Many newer workspaces can be enabled automatically and actual interface paths vary. A workspace administrator’s data privileges also depend on the current defaults and assignments.