DP-750: External Data Access Explained and with Real Exam Questions

When preparing for DP-750: Microsoft Certified: Azure Databricks Data Engineer Associate, you need to understand how Azure Databricks accesses data outside managed Delta tables.

This topic includes several important Unity Catalog concepts:

• storage credentials
• external locations
• external volumes
• Databricks access connector
• managed identity
• Key Vault-backed secret scopes
• foreign catalogs
• COPY INTO

The related questions in your DP-750 question bank are Q16, Q18, Q25, Q26–29, and Q32.

---

1. Why external data access matters in DP-750

Not all data is stored directly inside Databricks-managed tables.

In real projects, data may live in:

• Azure Data Lake Storage Gen2
• Azure Blob Storage
• SQL Server
• Azure SQL Database
• PostgreSQL
• external file systems
• operational databases
• third-party systems

Unity Catalog provides governed ways to access this data. For DP-750, the exam often asks you to choose the right access pattern while following least privilege and avoiding unnecessary data movement.

The most important distinction is:

Cloud storage files       -> storage credential + external location / volume
External databases        -> connection + foreign catalog
Secrets in Azure Key Vault -> Key Vault-backed secret scope

---

2. Storage credential

A storage credential is a Unity Catalog object that represents the identity used to access cloud storage.

For Azure Databricks on Azure, this identity is often based on a managed identity through a Databricks access connector.

Microsoft documentation explains that Unity Catalog can use Azure managed identities to access Azure storage, and that managed identities remove the need to maintain credentials or rotate secrets. To use this pattern, you create an access connector for Azure Databricks, grant its managed identity access to the storage account, and use the access connector when creating a Unity Catalog storage credential.

For DP-750, remember: > Access connector + managed identity = preferred governed access to Azure storage without storing secrets in Databricks.

---

3. Databricks access connector

A Databricks access connector is an Azure resource that provides a managed identity for Azure Databricks.

It is commonly used with Unity Catalog to access Azure Data Lake Storage Gen2.

The common setup flow is:

1. Create a Databricks access connector.
2. Assign the access connector’s managed identity permissions on the storage account.
3. Register the access connector as a Unity Catalog storage credential.
4. Use the storage credential in an external location.

For least privilege, you should assign only the required Azure role to the access connector. In many Unity Catalog external-location scenarios, this is Storage Blob Data Contributor on the relevant storage scope, not a broad subscription-level role. Microsoft’s managed identity guidance describes creating the access connector, granting the managed identity access to the storage account, and then using that access connector for the storage credential.

For DP-750, the access connector is used for storage access. It is not used to expose SQL Server tables as Unity Catalog objects.

---

4. External location

An external location is a Unity Catalog securable object that combines:

cloud storage path + storage credential

Databricks documentation defines an external location as a securable object that combines a storage path with a storage credential that authorizes access to that path.

Example:

CREATE EXTERNAL LOCATION raw_orders
URL 'abfss://raw@storage1.dfs.core.windows.net/orders/'
WITH (STORAGE CREDENTIAL my_storage_credential);

External locations are used when Databricks needs governed access to files in cloud storage.

For DP-750, if a question says:

> A SQL statement such as COPY INTO must access files in an ADLS Gen2 container.

the expected answer is often:

Configure an external location that uses a storage credential.

---

5. External location vs external table vs volume

These three concepts are related but different.

|Concept|Meaning| |---|---| |Storage credential|Identity used to access cloud storage| |External location|Storage path plus storage credential| |External table|Table whose data lives in an external storage path| |Volume|Unity Catalog object for governing file access|

An external table is still a table. It is useful when you want to query structured data as a table.

A volume is used for file access, including structured, semi-structured, and unstructured files. Databricks documentation describes volumes as Unity Catalog objects that represent logical storage in cloud object storage and provide governance over non-tabular datasets.

For DP-750, if the question is about users accessing files directly, think about volumes and READ VOLUME / WRITE VOLUME.

---

6. External volume

A Unity Catalog volume is used to govern access to files.

Volumes can be:

• managed volumes
• external volumes

An external volume points to a storage location outside the Unity Catalog managed storage location. Databricks documentation says external volumes must be registered against a directory within an external location, and volumes can only be created in Unity Catalog schemas.

Example:

CREATE EXTERNAL VOLUME main.raw.files
LOCATION 'abfss://raw@storage1.dfs.core.windows.net/files/';

For DP-750, if the question says:

• expose files from Azure Storage
• authentication should not require storing credentials in Databricks
• users can access files but not modify files
• follow least privilege

then the answer pattern is:

Authentication type: Databricks access connector
Permission: READ VOLUME

READ VOLUME allows read access to files in the volume. WRITE VOLUME would be too broad if users must not modify files.

---

7. Key Vault-backed secret scope

A secret scope allows notebooks and jobs to retrieve secrets securely at runtime.

Azure Databricks supports Azure Key Vault-backed secret scopes. Microsoft documentation explains that a Key Vault-backed scope references secrets stored in Azure Key Vault, and secrets must be managed in Azure Key Vault.

The notebook retrieves the value with:

dbutils.secrets.get(scope="<scope-name>", key="<secret-name>")

Microsoft’s secret workflow documentation says to use the dbutils.secrets utility to access secrets in an Azure Databricks notebook.

For DP-750, if the question says:

• the secret value is managed by a security team in Azure Key Vault
• Databricks must always retrieve the latest value
• least privilege is required
• notebook must retrieve the secret at runtime

then the answer is:

Expose the secret with a Key Vault-backed secret scope.
Retrieve it with dbutils.secrets.get.

Do not use:

spark.conf.get
dbutils.secret.list
Databricks-backed secret scope

because those do not meet the requirement as directly.

---

8. Foreign catalog

A foreign catalog is used for Lakehouse Federation.

It mirrors an external database in Unity Catalog so that users can query external tables from Databricks without copying the data into Databricks-managed storage.

Databricks documentation says a foreign catalog mirrors a database in an external data system and enables read-only queries on that data system from an Azure Databricks workspace.

For DP-750, this is very important:

> External database schemas and tables should appear alongside Unity Catalog objects, but data must not be copied into Databricks-managed storage = foreign catalog.

This is different from Lakeflow Connect.

---

9. Foreign catalog vs Lakeflow Connect

Lakehouse Federation and Lakeflow Connect solve different problems.

|Requirement|Best fit| |---|---| |Query external database tables without copying data|Foreign catalog| |Ingest data from an external system into the lakehouse|Lakeflow Connect| |Mirror external database metadata into Unity Catalog|Foreign catalog| |Build a managed ingestion pipeline|Lakeflow Connect|

Databricks documentation describes a Unity Catalog connection as a securable object that stores the path and credentials for accessing an external database system, and CREATE FOREIGN CATALOG allows creating a read-only mirror of a database from that external data source.

So if the requirement says:

The data is NOT copied into Databricks-managed storage.

then a Lakeflow Connect pipeline is not the best answer, because Lakeflow Connect is an ingestion approach. You should choose a foreign catalog.

---

10. COPY INTO and external locations

COPY INTO is used to load files from cloud object storage into a table.

For Unity Catalog, Databricks documentation describes using COPY INTO to load data from an Azure Data Lake Storage container into a table in Databricks SQL, and recommends using Unity Catalog volumes to access files as part of ingestion.

A typical SQL pattern is:

COPY INTO main.sales.orders
FROM 'abfss://raw@storage1.dfs.core.windows.net/orders/'
FILEFORMAT = CSV;

If this statement needs to access the external ADLS Gen2 path, Databricks must have governed access to the path.

For DP-750, the answer is usually:

external location + storage credential

not:

external table
Lakeflow ingestion gateway
volume only

The key point is that the path must be authorized through Unity Catalog.

---

11. DP-750 decision table for external data access

|Scenario in the question|Best answer pattern| |---|---| |Access ADLS Gen2 by managed identity|Databricks access connector| |Avoid storing storage credentials in Databricks|Managed identity / access connector| |Register cloud storage access in Unity Catalog|Storage credential| |Authorize a cloud storage path|External location| |COPY INTO must access files in ADLS Gen2|External location that uses a storage credential| |Expose files from Azure Storage as a governed object|External volume| |Users can read files but not modify them|READ VOLUME| |Notebook retrieves Key Vault secret at runtime|Key Vault-backed secret scope + dbutils.secrets.get| |Query external SQL Server schemas/tables without copying data|Foreign catalog| |Ingest external database data into Databricks|Lakeflow Connect| |Access connector proposed for SQL Server metadata federation|No|

---

Real Exam Questions

Question 16

You have an Azure Databricks workspace named Workspace1 that is attached to a Unity Catalog metastore named metastore1.

You need to register an Azure Storage account named account1 that has a hierarchical namespace enabled as an external location.

The external location must use a managed identity to authenticate to account1 and the solution must follow the principle of least privilege.

Which three actions should you perform in sequence?

Actions:

1. Assign the Storage Blob Data Owner role to the access connector.
2. Assign Workspace1 the Storage Blob Data Contributor role for account1.
3. Register the access connector as a storage credential in metastore1.
4. Create a Databricks access connector.
5. Assign the Storage Blob Data Contributor role to the access connector.
6. Register the access connector as a storage credential in Workspace1.

|Order|Answer| |---|---| |Step 1|4. Create a Databricks access connector ✅ Correct Answer| |Step 2|5. Assign the Storage Blob Data Contributor role to the access connector ✅ Correct Answer| |Step 3|3. Register the access connector as a storage credential in metastore1 ✅ Correct Answer|

---

Question 18

You have an Azure Databricks workspace.

You have an Azure key vault named kv-secure that stores a secret named storageKey. The value of storageKey is managed and updated by the cloud security team at your company.

You need to enable a Databricks notebook named Notebook1 to retrieve the value of storageKey securely at runtime. The solution must follow the principle of least privilege and always retrieve the latest value.

What should you do?

|Area|Answer| |---|---| |Expose storageKey to Databricks by using|A Key Vault-backed secret scope ✅ Correct Answer| |Retrieve storageKey from within Notebook1 by using|dbutils.secret.get ✅ Correct Answer|

---

Question 25

You have an Azure Databricks workspace that is enabled for Unity Catalog.

You need to create an external volume named Volume1 in an existing schema. Volume1 must expose files from an Azure Storage container.

The solution must meet the following requirements:

1. Ensure that authentication does NOT require storing credentials in Databricks.

1. Ensure that users can access the files, but NOT modify the files.

1. Follow the principle of least privilege.

Which type of authentication should you configure, and which permission should you grant to the users?

|Area|Answer| |---|---| |Authentication type|A Databricks access connector ✅ Correct Answer| |Permission|READ VOLUME ✅ Correct Answer|

---

Question 26

You have an Azure Databricks workspace named Workspace1 that contains a lakehouse and is enabled for Unity Catalog.

You have a connection to a Microsoft SQL Server database named DB1.

You need to expose the schemas and tables of DB1 to meet the following requirements:

1. The schemas and tables can be queried in Databricks.

1. The schemas and tables appear alongside other Unity Catalog objects.

1. The data is NOT copied into Databricks-managed storage.

Solution: You create a Lakeflow Connect pipeline and connect it to DB1.

Does this meet the goal?

A. Yes

B. No ✅ Correct Answer

---

Question 27

You have an Azure Databricks workspace named Workspace1 that contains a lakehouse and is enabled for Unity Catalog.

You have a connection to a Microsoft SQL Server database named DB1.

You need to expose the schemas and tables of DB1 to meet the following requirements:

1. The schemas and tables can be queried in Databricks.

1. The schemas and tables appear alongside other Unity Catalog objects.

1. The data is NOT copied into Databricks-managed storage.

Solution: You create a Databricks access connector.

Does this meet the goal?

A. Yes

B. No ✅ Correct Answer

---

Question 28

You have an Azure Databricks workspace named Workspace1 that contains a lakehouse and is enabled for Unity Catalog.

You have a connection to a Microsoft SQL Server database named DB1.

You need to expose the schemas and tables of DB1 to meet the following requirements:

1. The schemas and tables can be queried in Databricks.

1. The schemas and tables appear alongside other Unity Catalog objects.

1. The data is NOT copied into Databricks-managed storage.

Solution: You create a foreign catalog in Catalog Explorer.

Does this meet the goal?

A. Yes ✅ Correct Answer

B. No

---

Question 29

You have an Azure Databricks workspace named Workspace1 that contains a lakehouse and is enabled for Unity Catalog.

You have a connection to a Microsoft SQL Server database named DB1.

You need to expose the schemas and tables of DB1 to meet the following requirements:

1. The schemas and tables can be queried in Databricks.

1. The schemas and tables appear alongside other Unity Catalog objects.

1. The data is NOT copied into Databricks-managed storage.

Solution: You create a new native catalog in Unity Catalog.

Does this meet the goal?

A. Yes

B. No ✅ Correct Answer

---

Question 32

You have an Azure Databricks workspace that is enabled for Unity Catalog.

You have a CSV file stored in an Azure Data Lake Storage Gen2 container.

You plan to ingest the data into an existing table by running the following SQL statement.

COPY INTO Customer
FROM 'abfss://container1@storageaccount.dfs.core.windows.net/data/customer'
FILEFORMAT = CSV

You need to ensure that the statement can access the data in the container.

What should you configure?

A. an external table named Customer in the CSV file format

B. a Lakeflow ingestion gateway

C. an external location that uses a storage credential ✅ Correct Answer

D. a volume in a catalog

---

Key takeaways

For DP-750, external data access questions usually test whether you can choose the correct Unity Catalog object for the access pattern.

Remember these patterns:

• Storage credential stores or represents the identity used to access cloud storage.

• Databricks access connector provides managed identity-based access to Azure storage.

• External location combines a storage path with a storage credential.

• External volume governs file access in Unity Catalog.

• READ VOLUME allows users to read files without modifying them.

• Key Vault-backed secret scope lets Databricks reference secrets stored in Azure Key Vault.

• dbutils.secrets.get retrieves secrets securely in notebooks.

• Foreign catalog exposes external database schemas and tables without copying data.

• Lakeflow Connect is for ingestion, not read-only federation.

• COPY INTO needs governed access to the source path, usually through an external location and storage credential.

If you can identify whether the source is cloud storage, external files, Key Vault secrets, or an external database, you can usually choose the correct DP-750 external access answer quickly.