Reviewed by Aditya Kumar · Last reviewed 2026-03-24
**Why Secret Scopes**: Credentials in notebooks or config get committed or logged. Secret Scopes provide a namespace for secrets, accessed via dbutils.secrets.get(scope="my-scope", key="api-key"). Never log the return value. **Types**: Databricks-backed (stored in Databricks)...
Why Secret Scopes: Credentials in notebooks or config get committed or logged. Secret Scopes provide a namespace for secrets, accessed via dbutils.secrets.get(scope="my-scope", key="api-key"). Never log the return value. Types: Databricks-backed (stored in Databricks) and Key Vault-backed (Azure) or AWS Secrets Manager-backed—enterprise secrets stay in your vault. Scalability: Many secrets across many clusters—use ACLs to restrict scope access per group. Cost: No direct Secret Scope cost; Key Vault has per-secret cost. Best practice: Different scopes per environment (dev/prod); rotate secrets regularly; apply ACLs so only required jobs have access. Use in init scripts, notebooks, and job configs—never in Git.
Pro-Move: 'We use Key Vault-backed scopes with ACLs—analysts get read-only, engineers get write; we rotate DB passwords quarterly via automation.' Red Flag: Using Databricks-backed scopes for production PII/PCI credentials—Key Vault/Secrets Manager is required for compliance.
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.