Snowflake SnowPro Core Practice Test 33
Question 320
For an original SnowPro Core educational scenario, consider: A reporting role cannot see a curated table even though the user has a different role that owns the object. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect tags on representative new columns and policy bindings across changing schemas.
- Change: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
- Check: Inspect SHOW GRANTS, role hierarchy and active session role for the target object and user.
- Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles.
- Grant ACCOUNTADMIN to every analyst to solve a missing table SELECT error.
Explanation
Correct Answer
C:A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles. Required intervention: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles.
D:A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles. Evidence: Inspect SHOW GRANTS, role hierarchy and active session role for the target object and user.
Incorrect Answers
A:Check: Inspect tags on representative new columns and policy bindings across changing schemas. A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles.
B:Change: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role. A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles.
Question 321
A Snowflake engineer is examining this platform situation: A user has two analyst roles but a query succeeds only after changing which secondary roles are active. A proposed shortcut is: Turn on every role for every connection and assume that never affects object-ownership checks. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Define database roles for database object permissions, then grant them to an account role users can activate.
- Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation.
- Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
- Turn on every role for every connection and assume that never affects object-ownership checks.
Explanation
Correct Answer
C:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. Applied case: A user has two analyst roles but a query succeeds only after changing which secondary roles are active.
Incorrect Answers
A:Define database roles for database object permissions, then grant them to an account role users can activate. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
B:This option addresses a different Snowflake technical topic (Ownership transfers and grant preservation) rather than the documented Primary versus secondary roles decision.
D:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 322
A Snowflake implementation review finds: A user has two analyst roles but a query succeeds only after changing which secondary roles are active. The team proposes: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
- Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
- Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
- Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Explanation
Correct Answer
A:Demonstrable success requires: Query rights and ownership are predictable and do not depend on silently enabled excessive roles. Applied case: A user has two analyst roles but a query succeeds only after changing which secondary roles are active.
Incorrect Answers
B:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
C:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
D:Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
Question 323
The data platform team has not yet approved changes. Current evidence indicates: A user has two analyst roles but a query succeeds only after changing which secondary roles are active. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test.
- Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage.
- Test identical queries under representative roles and verify permitted and denied row counts.
- Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
Explanation
Correct Answer
D:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. Confirm afterward that: Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
Incorrect Answers
A:Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
B:Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
C:Test identical queries under representative roles and verify permitted and denied row counts. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
Question 324
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A user has two analyst roles but a query succeeds only after changing which secondary roles are active. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Dataset sharing requires the designated governance authority instead of arbitrary table-owner discretion.
- Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
- Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access.
- The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
Explanation
Correct Answer
B:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. The result must be validated using the documented dataset or access context.
Incorrect Answers
A:Dataset sharing requires the designated governance authority instead of arbitrary table-owner discretion. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
C:Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
D:The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
Question 325
An implementation sign-off request identifies the following problem: A user has two analyst roles but a query succeeds only after changing which secondary roles are active. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Set supported retention values per object type, edition and legal recovery need, with measured storage impact. Verify: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp.
- Change: Define appropriate FUTURE grants on the intended database or schema in addition to any existing-object grants. Verify: Create a controlled new table after configuring grants and verify permissions separately from an old table.
- Change: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access. Verify: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
- Change: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role. Verify: Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
Explanation
Correct Answer
D:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. The change is successful only when: Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
Incorrect Answers
A:This option addresses a different Snowflake technical topic (Data retention parameters and historical exposure) rather than the documented Primary versus secondary roles decision.
B:Change: Define appropriate FUTURE grants on the intended database or schema in addition to any existing-object grants.
C:Change: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
Question 326
A Snowflake engineer is examining this platform situation: An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error. A proposed shortcut is: Turn on every role for every connection and assume that never affects object-ownership checks. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Turn on every role for every connection and assume that never affects object-ownership checks.
- Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
- Define database roles for database object permissions, then grant them to an account role users can activate.
Explanation
Correct Answer
C:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. Applied case: An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error.
Incorrect Answers
A:Use governed object tags, supported classification methods and appropriate tag-based policy integration. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
B:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. Use this instead: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
D:Define database roles for database object permissions, then grant them to an account role users can activate. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
Question 327
A Snowflake implementation review finds: An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error. The team proposes: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
- Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
- Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery.
- Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
Explanation
Correct Answer
B:Demonstrable success requires: Query rights and ownership are predictable and do not depend on silently enabled excessive roles. Applied case: An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error.
Incorrect Answers
A:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
C:Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
D:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error.
Question 328
The data platform team has not yet approved changes. Current evidence indicates: An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
- Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
- Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
Explanation
Correct Answer
A:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. This check tests the actual data, compute or access boundary before an operationally risky change.
Incorrect Answers
B:Compare effective policy assignments, actual connection methods and login tests for both human and service identities. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
C:Query the same protected column under authorized and limited roles and review masking-policy bindings. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
D:Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
Question 329
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Intended users can perform only authorized operations, and the privilege chain is auditable.
- Recovery regions receive permitted objects and users can resume using the planned endpoint within agreed objectives.
- Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
- The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
Explanation
Correct Answer
C:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. The approved implementation step was: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
Incorrect Answers
A:Intended users can perform only authorized operations, and the privilege chain is auditable. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
B:Recovery regions receive permitted objects and users can resume using the planned endpoint within agreed objectives. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
D:The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
Question 330
For an original SnowPro Core educational scenario, consider: An application tries to create a new table using a privilege available only in an unrelated secondary role and receives an authorization error. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
- Change: Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database.
- Change: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
- Turn on every role for every connection and assume that never affects object-ownership checks.
- Check: Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
Explanation
Correct Answer
C:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. Acceptance: Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
E:Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics. Required intervention: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
Incorrect Answers
A:Check: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
B:Change: Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
