Exam DP-203 topic 3 question 22 discussion

Accessing the ADLS via Databricks should be using Azure Active Directory with Passthrough. Accessing the files in ADLS should be SAS, based on the options provided. The explanation provided for this question is incorrect.

1. Accessing the Databricks should be using Personal Tokens 2. Accessing the ADLS should be using Shared Access Signatures. (Because of controlled access to project folders they work).

ChatGPT 4o Azure Active Directory (Azure AD) passthrough for both

The whole community is confused. Everyone has their own answers and explanations. No consensus whatsoever :(

Personal Token Shared Access Signatures

1. Personal Token 2. Passthrough

Personal access token Credential Pass through

box1 Azure Active Directory with Passthrough box2 SAS

Box 1 - Pass through Databricks Box 2 - SAS - DL Gen 2

Databricks: Azure Active Directory credential passthrough or personal access tokens. Data Lake Storage: Azure Active Directory credential passthrough. Please note that while shared access keys and shared access signatures are valid authentication methods for Data Lake Storage, they do not meet the requirement of minimizing administrative effort and providing granular access control based on projects in this scenario.

I think the answers given are correct. The question is which authentication to use "for" Databricks and Gen2. So we look at authenticating for (or "into") either of them. The question then becomes which authentication can you use to access databricks and then through that which authentication can you use to authenticate for gen2?

As we need to access Databricks via ADLS use Azure Databricks access tokens or AAD tokens as explained here: https://learn.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/aad/ Data Lake Storage with Passtrough

Both should be Azure Active Directory with Passthrough 1. Shared Key and SAS authorization grants access to a user (or application) without requiring them to have an identity in Azure Active Directory (Azure AD). With these two forms of authentication, Azure RBAC and ACLs have no effect. ACLs let you grant "fine-grained" access, such as write access to a specific directory or file. https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control-model Azure AD provides superior security and ease of use over Shared Key for authorizing requests to Blob storage. For more information, see Authorize access to data in Azure Storage. https://learn.microsoft.com/en-us/azure/storage/blobs/security-recommendations 2. Azure AD Passthrough will ensure a user can only access the data that they have previously been granted access to via Azure AD in ADLS Gen2. https://www.databricks.com/blog/2019/10/24/simplify-data-lake-access-with-azure-ad-credential-passthrough.html

Databricks- Azure Active Directory with Passthrough https://learn.microsoft.com/en-us/azure/databricks/security/credential-passthrough/adls-passthrough Data Lake Storage - SAS https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control-model

the question is about how to authenticate the ADLS gen2 dataset both in Databricks and ADLSGen2... Its not about how you authenticate the Databricks. 1) Credential Pass through 2) SAS

Given answer seems correct, agree with HaBroNounen's explanation

Azure Data Lake Storage Gen2 also supports Shared Key and SAS methods for authentication. To authenticate to and access Databricks REST APIs, you can use Azure Databricks personal access tokens or Azure Active Directory (Azure AD) tokens