dbt Architect Certification Exam

Last checked November 10, 2026 against the official dbt Labs exam page.

1. Question 1Configuring dbt data warehouse connections

   A security team has enabled a network policy on the Snowflake account that only admits connections from approved address ranges. After the dbt Cloud project is set up, every scheduled run fails while opening the warehouse connection. What is the most appropriate fix?

   1. ATurn off the network policy for the whole account so the scheduled runs can connect
   2. BMove the Snowflake account to a different cloud region so the connection path changes
   3. CGrant the dbt service user the account administrator role so it bypasses network checks
   4. DAdd the egress IP addresses that dbt Cloud publishes to the policy's approved list
   Show answer and explanationHide answer

   Correct answer: D

   Warehouses that restrict inbound addresses must allow the egress IPs dbt Cloud uses, so adding them keeps the restriction in place while letting dbt connect. Turning the policy off removes a security control, a role grant does not get around network-level checks, and a region change does not alter the source addresses dbt Cloud uses.

2. Question 2Configuring dbt git connections

   Which two benefits come from connecting a repository through a native git provider integration instead of a generic git URL with a deploy key? (Choose two.)

   1. APull request events can trigger CI jobs automatically
   2. BJob status can be reported back to the pull request on the git provider
   3. CCompiled model SQL is stored on the git provider's servers for review
   4. DThe repository's git history is copied into the warehouse as a table
   Show answer and explanationHide answer

   Correct answer: A, B

   Native integrations let the git provider notify dbt Cloud of pull request events, which enables automatic CI, and let job status be reported back to the pull request. The other two statements describe things dbt Cloud does not do with the git provider or the warehouse.

3. Question 3Creating and maintaining dbt environments

   A security team wants to rotate the RSA private key that dbt Cloud uses to authenticate to Snowflake, with no interruption to scheduled jobs. Which sequence is the safest?

   1. AStop all jobs, replace the key pair, and restart the jobs once the change is complete
   2. BAdd the new public key next to the old one, update dbt Cloud, then remove the old key
   3. CEmail the new private key to every developer and let each person update their own copy
   4. DCommit the new private key to the repository so every environment picks it up automatically
   Show answer and explanationHide answer

   Correct answer: B

   Registering the new public key before switching lets both keys work during the overlap, so jobs keep authenticating while the credential in dbt Cloud is updated and the old key is removed afterward. Stopping jobs causes avoidable downtime, while emailing or committing a private key exposes the credential.

4. Question 4Creating and maintaining job definitions

   A job runs three commands in order: dbt seed, then dbt run, then dbt test. The dbt run command fails. What happens to the dbt test command?

   1. AIt runs anyway, because the test command does not depend on the build command
   2. BIt runs in parallel with the next scheduled job in the same account
   3. CIt is skipped, because commands run in sequence and a failure ends the run
   4. DIt is queued and retried automatically at the next scheduled trigger
   Show answer and explanationHide answer

   Correct answer: C

   Commands in a job run one after another, and a failed command ends the run, so the later test command does not execute. The other options describe independent execution, parallel runs, or an automatic retry, none of which happen within a single job run.

5. Question 5Configuring dbt security and licenses

   Which two practices reduce the risk from long-lived credentials used by automation that calls the dbt Cloud API? (Choose two.)

   1. AScope each service token to only the permission sets the automation needs
   2. BKeep the token in a shared team document so it can be recovered easily
   3. CRotate tokens on a regular schedule and revoke any that are no longer in use
   4. DGenerate the token from an administrator's personal login and reuse it everywhere
   Show answer and explanationHide answer

   Correct answer: A, C

   Service tokens carry only the permission sets assigned to them, and regular rotation with revocation limits the damage from a leaked credential. A shared document and reuse of an administrator's personal token both widen exposure and tie automation to one person.