Question 1 · Developing Code for Data Processing using Python and SQL
A data engineering team uses Databricks Repos integrated with a Git provider. A team member accidentally committed a notebook containing a hard-coded API key directly to the main branch and pushed it to the remote repository. The team wants to remove the secret from the repository history. Which TWO actions should the team take as immediate remediation steps within Databricks and their Git workflow? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answers: A, D
- A. Rotate/revoke the exposed API key in the target system immediately, since the secret is already compromised regardless of Git history cleanup.
- D. Perform a
git filter-repoor equivalent history-rewriting operation on the remote repository to remove the secret from all historical commits, then force-push the rewritten history.
Option A is correct — rotating/revoking the compromised credential is the single most critical immediate action; the secret must be treated as compromised the moment it was pushed. Option D is correct — to truly remove a secret from Git history, a history-rewriting tool like git filter-repo (or BFG Repo Cleaner) must be used on the remote, followed by a force-push; this is the standard Git remediation. Option F is incorrect — the Databricks Repos UI only manages the working state of the repo (branch switching, pull, commit, push); it cannot rewrite remote Git history. Option E is incorrect — deleting and re-cloning the Repo object in Databricks only affects the local workspace copy; the remote Git provider's history is completely unaffected. Option B is a good future prevention best practice but is not an immediate remediation for the already-exposed secret. Option C is incorrect — Databricks Unity Catalog audit logs record API actions, not notebook cell content or committed file contents; the secret would not be captured there.