Reviewed by Aditya Kumar · Last reviewed 2026-03-24
**Databricks-backed**: Secrets stored in Databricks control plane. Simpler setup; no Azure dependency. Use for dev, non-sensitive. **Key Vault-backed**: Secrets stored in Azure Key Vault. Enterprise-grade—rotation, audit, RBAC. Use for production. **Trade-offs**: Key Vault...
Databricks-backed: Secrets stored in Databricks control plane. Simpler setup; no Azure dependency. Use for dev, non-sensitive. Key Vault-backed: Secrets stored in Azure Key Vault. Enterprise-grade—rotation, audit, RBAC. Use for production. Trade-offs: Key Vault provides central key management, compliance (HSM, audit logs), and rotation workflows. Databricks-backed is simpler but doesn't integrate with enterprise PKI. Scalability: Key Vault has rate limits; high-frequency access may need caching. Cost: Key Vault has per-secret and per-operation cost; minimal at typical scale. Best practice: Key Vault-backed in production for compliance; Databricks-backed for dev/test. Use ACLs in both cases.
Pro-Move: 'We use Key Vault-backed for all prod scopes—secrets rotate in Key Vault, no Databricks redeploy; we audit access via Key Vault logs.' Red Flag: Using Databricks-backed for prod credentials—fails compliance audits.
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.