Free study guide · Databricks
How to pass the Databricks Platform Architect accreditation (AWS, Azure or GCP)
What the exam covers, how to plan your study, and how to read its questions. From the CertLumen course for this exam, kept up to date with the official exam guide.
- Questions
- 20
- Time
- 40 minutes
- Passing score
- 80%
- Exam fee
- Free for Databricks customers and partners (Databricks Academy)
- Valid for
- 1 year
- Delivery
- Online in Databricks Academy, not proctored
What the exam covers
Platform Administration Fundamentals22%
Account API and Automation13%
Network Configuration22%
Platform Access and Security15%
Customer-Managed Keys and Encryption10%
External Storage and Cloud Integrations18%
A study plan that works
The default path for engineers and admins who know Databricks but haven't designed a deployment end to end. It covers all 19 lessons and the six labs in order, with a section drill after each section and daily flashcards. Both practice exams come at the end, on days 13 and 14, and you take only the two for your cloud: aws-1 and aws-2, azure-1 and azure-2, or gcp-1 and gcp-2. Networking (a3) and administration (a1) get the most days because they carry the most questions on every cloud. Sit the accreditation in Databricks Academy on day 14 or 15. Plan on about 1–2 hours a day.
| Day | Focus | Time |
|---|---|---|
| 1 | Kick-off: the accreditation and the platform architecture | 75 min |
| 2 | Identities, admin roles and compute governance | 100 min |
| 3 | Workspace strategy and disaster recovery, then the a1 drill | 100 min |
| 4 | REST APIs, authentication and the Account API | 90 min |
| 5 | Infrastructure as code, then the a2 drill | 100 min |
| 6 | Network paths and customer-managed networks | 100 min |
| 7 | Private connectivity, ingress control and serverless egress | 110 min |
| 8 | Networking lab, then the a3 drill | 100 min |
| 9 | SSO, identity sync, permissions and secrets | 100 min |
| 10 | Audit logs and compliance, then the a4 drill | 100 min |
| 11 | Encryption and customer-managed keys, then the a5 drill | 110 min |
| 12 | Unity Catalog storage and leaving legacy storage | 110 min |
| 13 | Cloud integrations, the a6 drill and Practice Exam 1 | 140 min |
| 14 | Practice Exam 2, final review and the accreditation | 120 min |
Exam strategy
How the accreditation works
Databricks offers the Platform Architect accreditation in three versions: AWS, Azure and GCP. Each one checks that you know the best practices for deploying, securing and integrating Databricks on that cloud. It's a short online knowledge check in Databricks Academy, not a proctored certification exam. Most questions are short architecture scenarios: you get a requirement and pick the configuration that meets it on that cloud.
| Fact | Detail (from the three accreditation pages and the certification FAQ) |
|---|---|
| Name | AWS, Azure or GCP Platform Architect badge. The Academy catalog lists them as "AWS / Azure / GCP Databricks Platform Architect Accreditation" |
| Questions | 20 |
| Question types | Multiple choice and multiple select |
| Time limit | Unlimited, according to the accreditation pages. The Academy catalog describes it as a 20-minute assessment |
| Passing score | 80%, so 16 of 20 |
| Validity | One year |
| Cost | Free for Databricks customers and partners |
| Delivery | Online in Databricks Academy, not proctored. You sign in to Academy to register |
| Test aids | None provided |
| Language | English |
| Prerequisite | Related training in Databricks Academy: the *Databricks on AWS Platform Architect Pathway*, the *Azure Databricks Data + AI Platform Architect Pathway* or the *Databricks on GCP Platform Architect Pathway* |
| Results and retakes | Results appear right away. If you pass, you get a digital badge from Accredible by email, which you can see on credentials.databricks.com. If you fail, the FAQ says you can retake it |
This course's questions are single-answer; the real one isn't
Every question in this course, including the six practice exams, has exactly one correct answer. The real accreditation also has multiple-select items, where you must find every correct option. When you practise, judge each option on its own as true or false for the stated cloud before you look for the best one. That habit carries over directly to multiple-select items.
Three versions, one course
Databricks publishes a topic list for each version but no weights. The AWS and GCP lists are the same. Azure has no separate Account API or customer-managed key topic, but it adds network configuration and platform access and security. This course splits the material into six sections that cover all three lists:
| Course section | AWS topic | Azure topic | GCP topic |
|---|---|---|---|
| a1 Platform Administration Fundamentals | Platform administration fundamentals | Platform administration fundamentals | Platform administration fundamentals |
| a2 Account API and Automation | Account API usage | Covered under administration (Azure workspaces are created through Azure Resource Manager) | Account API usage |
| a3 Network Configuration | Customer-managed VPCs | Network configuration | Customer-managed VPCs |
| a4 Platform Access and Security | Part of administration fundamentals | Platform access and security | Part of administration fundamentals |
| a5 Customer-Managed Keys and Encryption | Customer-managed keys | Part of platform access and security | Customer-managed keys |
| a6 External Storage and Cloud Integrations | External storage; Cloud service integrations | External storage configuration; Cloud service integrations | External storage; Cloud service integrations |
Where the questions are
The section weights are this course's estimate from the three topic lists. The practice exams follow them, with a different mix per cloud. Each practice exam has 20 questions and a 40-minute timer, and draws only from questions tagged all or tagged for that cloud.
| Section | Weight (estimate) | AWS exam | Azure exam | GCP exam | Highest-yield topics |
|---|---|---|---|---|---|
| a1 Administration | 22% | 4 | 4 | 4 | Control plane vs compute planes, admin roles, identity federation, compute policies, budgets, billing system tables, one metastore per region |
| a2 Account API | 13% | 3 | 1 | 3 | Account API hosts, OAuth M2M and token federation, workspace configuration objects, Terraform account vs workspace providers |
| a3 Networking | 22% | 4 | 5 | 4 | Secure cluster connectivity, VPC and VNet sizing, private connectivity per cloud, private access settings, context-based ingress, NCCs and network policies |
| a4 Access and security | 15% | 2 | 4 | 2 | SSO and unified login, automatic identity management vs SCIM, secrets, audit logs, compliance security profile |
| a5 Keys and encryption | 10% | 3 | 2 | 3 | Managed services vs workspace storage keys, where each key lives, adding and rotating keys, revocation |
| a6 Storage and integrations | 18% | 4 | 4 | 4 | Storage credentials per cloud, external locations and privileges, managed storage, legacy DBFS and mounts, service credentials, file events |
| Total | 100% | 20 | 20 | 20 |
Take the two practice exams for your cloud
There are six practice exams: aws-1, aws-2, azure-1, azure-2, gcp-1 and gcp-2. Take only the two for the accreditation you're sitting. The other clouds' exams test answers that are wrong on your cloud, such as VNet injection rules on an AWS exam, so they add confusion rather than readiness. Use them only if you plan a second accreditation later.
How to study
- Learn. Read each lesson with your cloud in mind. Most lessons compare AWS, Azure and GCP in a table, so read your column closely and skim the others.
- Lab. The labs are guided architecture exercises. They need an account admin role and a cloud account you're allowed to change. If you don't have a sandbox, read each step and predict what it creates and what would break without it.
- Drill. After each section, take its drill untimed. Focus on questions for your cloud and those that apply to all clouds, and read every explanation, including the notes on the wrong options.
- Flashcards. Short daily sessions. The facts that decide questions are small: subnet sizes, tier requirements, what can't change after creation.
- Practice exams. Take your cloud's two exams in one sitting each, with no notes. They're timed at 40 minutes even though the real one isn't, which keeps you honest about recall.
- Review loop. Keep an error log: topic, cloud, why you missed it (knowledge gap, wrong cloud, misread constraint), the correct rule and where it lives in the course. Retest that topic 48 hours later.
Use the official pathway too
The accreditation lists the Academy pathway for your cloud as related training. For AWS and GCP, the catalog names three short prep courses: Platform Administration Fundamentals, Networking and Security Fundamentals, and Cloud Integrations. Do them alongside this course. They're also how Academy expects you to reach the assessment.
Readiness criteria
- ≥ 85% (17 of 20) on both practice exams for your cloud, on the first attempt. The real exam passes at 80% and adds multiple-select items, so leave a margin.
- ≥ 80% on every section drill, counting questions for your cloud and those for all clouds.
- Without notes, you can fill in the cheat-sheet tables for your cloud: network sizing, private connectivity, serverless firewall method, CMK use cases and storage credentials.
- You can say, for your cloud, what must be decided at workspace creation and what can be changed later.
- You can name today's product for every entry in the renames table.
Answering architecture scenario questions
A typical item describes a company, a cloud and a requirement, then asks which configuration meets it. Work through it in this order:
- Find the cloud. The same requirement has different answers on AWS, Azure and GCP: VPC vs VNet injection, PrivateLink vs Private Link vs Private Service Connect, IAM role vs Access Connector vs service account.
- Find the layer. Is it identity, a network path (user to workspace, compute to control plane, serverless to your resources, compute to data), encryption, storage governance or cost?
- Find the constraint words (see the table below) and predict the answer before reading the options.
- Check prerequisites. Private connectivity, IP access lists, context-based ingress, serverless egress control and CMK need the Enterprise tier on AWS (and on GCP, except IP access lists, which need Premium) and the Premium tier on Azure. Back-end private connectivity also needs a customer-managed VPC or VNet injection.
- Check timing. Some choices are fixed at workspace creation. On AWS and GCP you can't move a workspace from a Databricks-managed VPC to a customer-managed one, and on GCP a customer-managed key can only be added when the workspace is created. Azure is the exception for networking: an ARM update can migrate a managed-VNet workspace to VNet injection or swap its subnets. An option that "updates the existing workspace" into a create-time-only setting is a distractor.
- Eliminate, then pick the account-level, Unity Catalog-governed, managed option among those left.
| Constraint wording | What it usually points to |
|---|---|
| "no public IP addresses on cluster nodes", "no open inbound ports" | Secure cluster connectivity (the default for new workspaces) |
| "cluster traffic to the control plane must not use the public internet" | Classic compute plane (back-end) private connectivity: AWS PrivateLink, Azure Private Link or GCP Private Service Connect |
| "users may only reach the workspace from the corporate network" | Inbound (front-end) private connectivity with public access disabled, or context-based ingress / IP access lists if traffic stays public |
| "serverless compute must reach a firewalled storage account or bucket" | Your cloud's serverless firewall method or an NCC private endpoint rule, never a classic VPC setting |
| "prevent data exfiltration from serverless notebooks" | Serverless egress control: a network policy in restricted mode, tested in dry-run first |
| "automation without long-lived secrets" | A service principal with OAuth token federation (workload identity federation); otherwise OAuth M2M |
| "manage identities once for every workspace" | Account-level identities with identity federation, synced by automatic identity management or account SCIM |
| "we must control and be able to revoke the key" | Customer-managed keys. Pick managed services (control plane data) or workspace storage (root storage and disks) from the data named |
| "govern access to files in our bucket or container" | Storage credential + external location + grants, or an external volume |
| "call a cloud service such as Secrets Manager or Glue from code" | A Unity Catalog service credential, not a storage credential or instance profile |
| "charge costs back to teams" | Tags (compute policies, serverless usage policies) analysed in system.billing.usage |
| "same setup in every region and environment" | Terraform with the account-level provider, or the Account API; bundles only for jobs, pipelines and other workspace code |
| "regulated data such as HIPAA or PCI-DSS" | The compliance security profile with the right compliance standard |
Multiple-select items
- Read the stem for how many answers it wants and follow it exactly.
- Treat each option as a separate true/false statement about the stated cloud. Don't choose by comparing options with each other.
- Options that are true on another cloud are the most common trap: an Azure-only setting in an AWS question, or an AWS object name in a GCP one.
- If an option is true only with a missing prerequisite, such as PrivateLink on a Databricks-managed VPC, treat it as false.
Elimination tactics
- Remove options that change something fixed at creation: converting an AWS or GCP workspace from a Databricks-managed VPC, moving a GCP workspace to a different VPC, adding a customer-managed key to an existing GCP workspace.
- Remove options that fix a different path. IP access lists don't filter PrivateLink traffic. NCC private endpoints don't affect classic clusters. A classic VPC endpoint doesn't help serverless compute.
- Remove legacy answers when a current feature fits: mounts, instance profiles for data, credential passthrough, workspace-level SCIM or SSO, workspace-local groups, personal access tokens for automation.
- Remove answers that put identities on the wrong side. Unity Catalog grants go to account-level principals, not workspace-local groups, and the workspace admin role can't be given to a group.
- Be suspicious of "stops spending". Budgets alert, they don't cap usage, except Unity Gateway budgets with Block usage turned on.
- When two options look alike, the difference is the answer: managed services key vs workspace storage key, storage credential vs service credential,
ACCOUNTvsENDPOINTprivate access level.
Words that point to the answer
Phrases in a question that usually point to one answer. The course has the full list.
| When the question says | Think of |
|---|---|
| AWS, classic workspace, our network team must own the VPC and route egress through our firewall | Customer-managed VPC, registered as a network configuration when you create the workspace |
| Azure, compute must live in our VNet with routes to on-premises | VNet injection: container and host subnets delegated to Microsoft.Databricks/workspaces |
| GCP, the VPC lives in a central network project, workspaces in their own projects | Customer-managed Shared VPC: host project for the VPC, service project for each workspace |
| no public IPs on cluster nodes, no inbound ports open to the cluster network | Secure cluster connectivity (formerly No Public IP) |
| AWS: cluster traffic to the control plane must stay off the public internet | Classic compute plane (back-end) PrivateLink: VPC endpoints for the workspace REST API and the SCC relay |
| users may reach the workspace only over private IPs from the corporate network | Inbound (front-end) private connectivity with public access disabled |
| Azure front-end Private Link works for API calls but browser SSO sign-in fails | Add a browser_authentication private endpoint (one per region, ideally in a dedicated workspace) with the privatelink.azuredatabricks.net DNS zone |
| allow the workspace only from office IPs, or only let service principals call the API from the CI network | Context-based ingress (recommended) or workspace IP access lists |
| restrict the account console to approved networks | Account console IP access lists |
| serverless notebooks and jobs must reach only approved destinations | Serverless egress control: a network policy in Restricted access mode, tested in dry-run first |
Revise from the cheat sheet
The course's cheat sheet has a page for each of these:
- Administration: roles, deployment, compute policies and cost
- Account API, authentication and infrastructure as code
- Networking: customer-managed networks, private connectivity and serverless
- Identity, access, secrets and compliance
- Encryption and customer-managed keys
- Unity Catalog storage, legacy migration and cloud integrations
Practise with the real exam's mix
205 exam-style questions, 6 timed practice exams, flashcards and an AI tutor.