Question
You have an Azure Databricks workspace.
You have an Azure key vault named kv-secure that stores a secret named storageKey. The value of storageKey is managed and updated by the cloud security team at your company.
You need to enable a Databricks notebook named Notebook1 to retrieve the value of storageKey securely at runtime. The solution must follow the principle of least privilege and always retrieve the latest value.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Expose storageKey to Databricks by using: a Key Vault-backed secret scope is a read-only interface to the key vault, so the security team keeps managing the secret in Azure and Databricks reads the value held there. A Databricks-backed scope stores its own copy in a Databricks database, which would not follow updates made in the key vault. An access connector provides a managed identity for Unity Catalog storage access; it does not expose key vault secrets to notebooks.
Retrieve storageKey from within Notebook1 by using: dbutils.secrets.get returns the secret value for a given scope and key, and redacts it in notebook output. dbutils.secrets.list returns only metadata such as key names, not values. spark.conf.get reads Spark configuration properties and is not the call for reading a secret from a scope.
