Question 24

You are configuring Unity Catalog to read and write data in an Azure Data Lake Storage Gen2 account that is protected by a storage firewall. Corporate security forbids storing or rotating any long-lived secrets. You must let Unity Catalog access the storage on behalf of users by using an **Access Connector for Azure Databricks** with a **managed identity**, then surface it as a Unity Catalog storage credential. Which TWO actions are required to grant the managed identity access to the storage account? (Choose TWO.)

• ACreate an Access Connector for Azure Databricks (a first-party Azure resource) configured with a system-assigned or user-assigned managed identity, and note its resource ID for use when creating the storage credential.
• BAssign the `Storage Blob Data Contributor` role on the storage account to the access connector's managed identity using Azure RBAC.
• CGenerate a client secret for the managed identity in Microsoft Entra ID and store it in an Azure Key Vault-backed secret scope for rotation.
• DCreate a Databricks personal access token and embed it in the storage account's connection string.
• EAdd the storage account's account key to a Databricks-backed secret scope and reference it from the storage credential.