Databricks Platform Architect
Design, secure and run Databricks on AWS, Azure and Google Cloud. Lessons, exam-style practice, timed mocks and an AI tutor, mapped to every objective of the official exam guide.
₹399 12-month access · 7-day free trial
The exam
- Questions
- 20
- Time
- 40 minutes
- Passing score
- 80%
- Exam fee
- Free for Databricks customers and partners (Databricks Academy)
- Valid for
- 1 year
- Delivery
- Online in Databricks Academy, not proctored
Official exam page · booked with Databricks
Every section of the exam guide
6 sections and 19 objectives, in the official weights. Each lesson is mapped to the objectives it covers.
Section 1 · Platform Administration Fundamentals22%
What the exam asks
- Explain the Databricks architecture: the account, workspaces, the control plane, the classic and serverless compute planes, and how each cloud deploys them.
- Manage identities (users, groups, service principals) and admin roles at account and workspace level, including identity federation and entitlements.
- Govern compute and cost with compute policies, serverless usage policies (formerly budget policies), budgets, tags and the billing system tables.
- Choose a workspace topology for isolation, environments and disaster recovery.
Lessons
- Databricks Architecture: Accounts, Workspaces and Planes
- Identities, Admin Roles and Entitlements
- Governing Compute and Cost
- Workspace Strategy, Isolation and Disaster Recovery
Section 2 · Account API and Automation13%
What the exam asks
- Use the Account API and workspace APIs with the right authentication (OAuth M2M/U2M, personal access tokens, cloud-native tokens).
- Automate account setup: credential, storage, network and key configurations, and workspace creation through the Account API.
- Manage accounts and workspaces as code with the Databricks Terraform provider and the Databricks CLI.
Lessons
- Databricks REST APIs and Authentication
- Automating Account Setup with the Account API
- Infrastructure as Code: Terraform and the Databricks CLI
Section 3 · Network Configuration22%
What the exam asks
- Describe the network paths between users, the control plane, the compute planes and data, including secure cluster connectivity.
- Deploy workspaces into a customer-managed VPC (AWS, GCP) or with VNet injection (Azure), sized and secured correctly.
- Configure private connectivity (AWS PrivateLink, Azure Private Link, GCP Private Service Connect) and IP access lists.
- Control serverless network access with network connectivity configurations and serverless egress policies.
Lessons
- Network Architecture and Secure Cluster Connectivity
- Customer-Managed VPCs and VNet Injection
- Private Connectivity and IP Access Lists
- Serverless Networking and Egress Control
Section 4 · Platform Access and Security15%
What the exam asks
- Configure single sign-on, SCIM provisioning and automatic identity management for the account.
- Secure workspaces with object permissions, workspace security settings, secret scopes and Unity Catalog admin privileges.
- Monitor and meet compliance needs with audit logs, system tables, the compliance security profile and enhanced security monitoring.
Lessons
- Single Sign-On, SCIM and Identity Management
- Workspace Permissions, Settings and Secrets
- Audit Logs, Monitoring and Compliance
Section 5 · Customer-Managed Keys and Encryption10%
What the exam asks
- Explain how Databricks encrypts data at rest and in transit and what customer-managed keys add.
- Configure customer-managed keys for managed services and workspace storage on AWS KMS, Azure Key Vault and Google Cloud KMS, and predict the effect of rotating or revoking a key.
Lessons
- Encryption at Rest and in Transit
- Configuring Customer-Managed Keys on Each Cloud
Section 6 · External Storage and Cloud Integrations18%
What the exam asks
- Configure Unity Catalog storage credentials, external locations, managed storage locations and volumes on each cloud.
- Replace legacy DBFS root storage, mounts and instance profiles with Unity Catalog patterns.
- Integrate Databricks with each cloud's services: object storage events, streaming services, key and secret stores, catalogs, BI and monitoring.
Lessons
- Unity Catalog Storage: Credentials, External Locations and Managed Storage
- From Legacy Storage to Unity Catalog
- Integrating with Cloud Services
14-Day Standard Plan
The default path for engineers and admins who know Databricks but haven't designed a deployment end to end. It covers all 19 lessons and the six labs in order, with a section drill after each section and daily flashcards. Both practice exams come at the end, on days 13 and 14, and you take only the two for your cloud: aws-1 and aws-2, azure-1 and azure-2, or gcp-1 and gcp-2. Networking (a3) and administration (a1) get the most days because they carry the most questions on every cloud. Sit the accreditation in Databricks Academy on day 14 or 15. About 1–2 hours a day.
- Day 1Kick-off: the accreditation and the platform architecture
- Day 2Identities, admin roles and compute governance
- Day 3Workspace strategy and disaster recovery, then the a1 drill
- Day 4REST APIs, authentication and the Account API
- Day 5Infrastructure as code, then the a2 drill
- Day 6Network paths and customer-managed networks
- Day 7Private connectivity, ingress control and serverless egress
- … and 7 more days, with mock exams at the end
Sample questions
Written for practice in the style of the real exam: never questions from the real exam.
Sample question 1
An AWS administrator is creating the cross-account IAM role for a new Databricks workspace. The role's trust relationship lets the Databricks AWS account 414351767826 assume it and requires an external ID. Which value goes in sts:ExternalId?
- AThe Databricks account ID shown in the account console
- BThe customer's 12-digit AWS account ID
- CThe workspace ID that the new workspace will receive
- DThe ARN of the Unity Catalog master role used for storage credentials
Show the answer
A. The credential configuration's IAM role trusts the Databricks AWS account 414351767826, and the trust policy requires sts:ExternalId to equal your Databricks account ID. Terraform's databricks_aws_assume_role_policy data source builds this trust policy from external_id = var.databricks_account_id. The external ID ties the role to your Databricks account, which protects against the confused-deputy problem.
Sample question 2
A platform team on AWS must make sure shuffle data exchanged between the worker nodes of classic clusters is encrypted, with the least operational effort and without a shared secret stored in DBFS. What should they do?
- AConfigure a customer-managed key for workspace storage with
reuse_key_for_cluster_volumesset to true - BEnable back-end AWS PrivateLink so that all traffic between cluster nodes stays on the AWS network
- CUse instance types that encrypt traffic between nodes automatically, such as M6i, C6i or R6i
- DAdd a managed services key, which encrypts traffic between the compute plane and the control plane
Show the answer
C. Traffic between worker nodes is not encrypted by default on AWS. Databricks documents two options: an init script that enables Spark authentication, AES encryption and TLS 1.3 (Public Preview, Enterprise tier), whose secret is derived from a keystore in DBFS, or instance types that encrypt traffic in transit automatically with no extra configuration. Customer-managed keys protect data at rest only.
About this exam
Which version should I take?
The one for the cloud you work on. The AWS and GCP versions share a topic list (administration, Account API, external storage, cloud integrations, customer-managed VPCs and keys). Azure swaps Account API and keys for network configuration and platform access and security. Take your cloud's two practice exams: aws-1/aws-2, azure-1/azure-2 or gcp-1/gcp-2.
Is this a certification?
No. It's an accreditation (a badge): a free, short, unproctored knowledge check in Databricks Academy. Databricks certifications are separate, paid, proctored exams with a two-year validity.
Who can take it, and does it cost anything?
The accreditation pages say it's free for Databricks customers and partners. You sign in to Databricks Academy to register, and the related training is the Platform Architect pathway for your cloud.
Is it timed?
The accreditation pages list the time limit as unlimited. The Academy catalog describes it as a 20-minute assessment, which is roughly how long it takes. This course's practice exams use a 40-minute timer so you practise recall under some pressure.
What question types are there, and why are the practice questions single-answer?
The real accreditation has multiple-choice and multiple-select questions. This course's questions all have one correct answer, so practise judging each option separately as true or false for the stated cloud. That's the skill multiple-select items need.
What score do I need, and can I retake it?
80%, which is 16 of 20. The certification FAQ says badge assessment results are shared immediately and you can retake the assessment if you don't pass.
How long is it valid?
The accreditation pages give one year. Your badge page on credentials.databricks.com shows the actual expiry date, so check it there and plan to renew before it lapses.
How many questions come from each topic?
Databricks doesn't publish weights. This course estimates them from the topic lists, and the practice exams use 4 administration, 3 Account API, 4 networking, 2 access and security, 3 keys and 4 storage questions on AWS and GCP. On Azure the mix is 4, 1, 5, 4, 2 and 4.
I'm on Azure. Can I skip the Account API and key lessons?
Skim them rather than skip them. Azure has no Account API topic, but account-level automation (identities, metastores, NCCs, network policies) and Terraform still come up, and customer-managed keys sit under platform access and security. The Azure practice exams include 1 Account API and 2 key questions.
Do I need an account admin role and a cloud account?
Only for the labs, which are guided architecture exercises that create real cloud resources. If you don't have a sandbox, read each lab step and predict what it creates and what breaks without it. The lessons, drills and practice exams don't need any access.
See where you stand in 8 minutes
Ten questions from this course, weighted like the real exam, with your score by section and a rough chance of passing.