Skip to content
Cheat sheets

Data Engineer Associate · Domain 5: Implementing CI/CD · 10% of the exam

Task 5.4: Understand the Databricks CLI to validate, deploy, and manage Declarative Automation Bundles (formerly Databricks Asset Bundles) and other workspace assets in automated CI/CD workflows.

bundle init, validate, deploy, run, summary and destroy, choosing a target, authenticating a CI runner as a service principal, and other CLI command groups.

Study it

  • The Databricks CLI in a CI/CD workflow

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the Databricks documentation page that proves it.

Question 1 · choose 1

A CI pipeline should stop early when a pull request introduces an error in the bundle's YAML configuration, before anything in the prod workspace changes. Which command should the first CI step run?

  1. Adatabricks bundle deploy -t prod --auto-approve
  2. Bdatabricks bundle validate -t prod
  3. Cdatabricks bundle run -t prod
  4. Ddatabricks bundle init
Show the answer and why

  • Adatabricks bundle deploy -t prod --auto-approve

    Incorrect

    deploy pushes the bundle to the workspace; --auto-approve only skips interactive approvals, so changes happen before any check.

  • Bdatabricks bundle validate -t prod

    Correct

    validate checks that the bundle configuration files are syntactically correct for the target without deploying anything.

  • Cdatabricks bundle run -t prod

    Incorrect

    run starts a job or pipeline that was already deployed; it does not check the new configuration.

  • Ddatabricks bundle init

    Incorrect

    init creates a new bundle project from a template; it does not inspect an existing bundle.

The usual CI order is validate, then deploy, then run tests or jobs. validate catches configuration errors without touching the workspace.

Databricks documentation

Task 5.4Report a problem with this question

Question 2 · choose 1

A temporary test target of a bundle is no longer needed. All jobs, pipelines and files that the bundle deployed to that target must be removed. Which command does this?

  1. Adatabricks bundle destroy -t test
  2. Bdatabricks workspace delete on the bundle's .bundle folder
  3. CRemoving the test target from databricks.yml and running databricks bundle deploy
  4. DDeleting each job and pipeline in the UI
Show the answer and why

  • Adatabricks bundle destroy -t test

    Correct

    destroy deletes the previously deployed jobs, pipelines and artifacts of the bundle for the target, after a confirmation prompt.

  • Bdatabricks workspace delete on the bundle's .bundle folder

    Incorrect

    Deleting the folder removes deployed files and state, but the jobs and pipelines stay in the workspace.

  • CRemoving the test target from databricks.yml and running databricks bundle deploy

    Incorrect

    Without the target there is no deployment to that destination, so nothing already deployed there is removed.

  • DDeleting each job and pipeline in the UI

    Incorrect

    Manual deletion is slow, can miss resources and leaves the bundle's files and state behind.

bundle destroy is the counterpart of deploy. Add --auto-approve in automation to skip the confirmation prompt.

Databricks documentation

Task 5.4Report a problem with this question

Question 3 · choose 1

A GitHub Actions workflow runs databricks bundle deploy -t prod. It must authenticate without a person present and without storing credentials in the repository. Which approach does Databricks recommend first for this unattended scenario?

  1. AA developer's personal access token saved in a file in the repository
  2. BOAuth user-to-machine login with databricks auth login
  3. COAuth M2M for a service principal, with credentials in CI environment variables
  4. DThe service principal's client secret written into the workspace mapping of databricks.yml
Show the answer and why

  • AA developer's personal access token saved in a file in the repository

    Incorrect

    A personal token ties production to one person and exposes the secret in the repository.

  • BOAuth user-to-machine login with databricks auth login

    Incorrect

    U2M opens a browser for a user to sign in, which suits attended local work, not CI.

  • COAuth M2M for a service principal, with credentials in CI environment variables

    Correct

    For unattended CI/CD, Databricks recommends OAuth M2M for a service principal, with DATABRICKS_HOST, DATABRICKS_CLIENT_ID and DATABRICKS_CLIENT_SECRET provided as environment variables from the CI system's secrets.

  • DThe service principal's client secret written into the workspace mapping of databricks.yml

    Incorrect

    Hard-coded authentication settings make bundles less reusable and risk exposing sensitive information.

Unattended CI/CD uses a service principal with OAuth M2M, configured through the CI system's environment variables.

Databricks documentation

Task 5.4Report a problem with this question

Question 4 · choose 1

A job was built in the Jobs UI and now has to be managed by a bundle. The existing job must be updated by future deployments rather than duplicated. Which commands accomplish this?

  1. ACopy the job's JSON into a resource file and run databricks bundle deploy
  2. Bbundle generate job for the existing job ID, then bind it to the job
  3. Cdatabricks bundle init with the default template
  4. Ddatabricks bundle summary followed by databricks bundle deploy
Show the answer and why

  • ACopy the job's JSON into a resource file and run databricks bundle deploy

    Incorrect

    Without binding, deploy creates a new job instead of updating the existing one.

  • Bbundle generate job for the existing job ID, then bind it to the job

    Correct

    generate writes the job's configuration into the bundle, and binding, with --bind or bundle deployment bind, links it to the existing job so deploy updates it.

  • Cdatabricks bundle init with the default template

    Incorrect

    init creates a new project from a template; it does not import an existing job.

  • Ddatabricks bundle summary followed by databricks bundle deploy

    Incorrect

    summary shows the bundle's resources and links; it does not adopt an existing job.

To bring existing workspace resources under a bundle, generate their configuration and bind them; otherwise deploy creates new copies.

Databricks documentation

Task 5.4Report a problem with this question

Question 5 · choose 1

Before a reviewer approves a release, the CI pipeline must show which jobs and pipelines the next deployment would create, update or delete, without changing anything. Which command produces this?

  1. Adatabricks bundle validate -t prod
  2. Bdatabricks bundle summary -t prod
  3. Cdatabricks bundle deploy -t prod --auto-approve
  4. Ddatabricks bundle plan -t prod
Show the answer and why

  • Adatabricks bundle validate -t prod

    Incorrect

    By default this command returns a summary of the bundle's identity; it does not list the actions that a deployment would perform on resources.

  • Bdatabricks bundle summary -t prod

    Incorrect

    summary shows the bundle's identity and already deployed resources with links, not pending changes.

  • Cdatabricks bundle deploy -t prod --auto-approve

    Incorrect

    This applies the changes, which the reviewer has not approved yet.

  • Ddatabricks bundle plan -t prod

    Correct

    plan builds the bundle and shows the actions that would be performed on resources, without making changes.

plan previews a deployment; deploy applies it. A JSON plan from plan -o json can also be applied with deploy --plan on the direct engine.

Databricks documentation

Task 5.4Report a problem with this question

Practise domain 5 →Practise all domains →