Snowflake SnowPro Core Practice Test 38
Question 370
For an original SnowPro Core educational scenario, consider: An ownership transfer unexpectedly affects prior grants, leaving a reporting service unable to SELECT from the table. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Drop the former owner role before checking what objects and grants it controls.
- Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
- Check: Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
- Change: Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation.
- Check: Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test.
Explanation
Correct Answer
C:OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed. Required intervention: Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation.
D:OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed. Evidence: Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed.
B:Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed.
E:Check: Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test. OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed.
Question 371
A Snowflake engineer is examining this platform situation: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema. A proposed shortcut is: Fix a missing schema USAGE by granting ALL PRIVILEGES on the whole account. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS.
- Fix a missing schema USAGE by granting ALL PRIVILEGES on the whole account.
- Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
- Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation.
Explanation
Correct Answer
C:Validate the premise using: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role. Applied case: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema.
Incorrect Answers
A:Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
D:Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
Question 372
A Snowflake implementation review finds: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema. The team proposes: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
- Time Travel retention limits vary by table class and edition, and historical storage contributes to cost.
- Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
- Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Explanation
Correct Answer
C:Relevant validation before approval: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role. Applied case: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema.
Incorrect Answers
A:This option addresses a different Snowflake technical topic (Tags and policy-based governance) rather than the documented Object privileges and parent USAGE decision.
B:Time Travel retention limits vary by table class and edition, and historical storage contributes to cost. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
D:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
Question 373
The data platform team has not yet approved changes. Current evidence indicates: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
- Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
- Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
- Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
Explanation
Correct Answer
A:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. Applied case: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema.
Incorrect Answers
B:Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode. A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema.
C:Compare ownership and dependent grants before and after transfer using SHOW GRANTS. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
D:Compare effective policy assignments, actual connection methods and login tests for both human and service identities. A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema.
Question 374
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
- The role can query only approved objects with no blanket access to sibling datasets.
- The new steward manages objects while approved consumers retain their intended privileges.
- The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges.
Explanation
Correct Answer
B:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. The result must be validated using the documented dataset or access context.
Incorrect Answers
A:The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
C:The new steward manages objects while approved consumers retain their intended privileges. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
D:The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
Question 375
An implementation sign-off request identifies the following problem: A role has SELECT on a table but cannot query it because it lacks USAGE on the containing schema. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access. Verify: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
- Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles. Verify: Inspect SHOW GRANTS, role hierarchy and active session role for the target object and user.
- Change: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently. Verify: Test identical queries under representative roles and verify permitted and denied row counts.
- Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. Verify: Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing.
Explanation
Correct Answer
A:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. The change is successful only when: The role can query only approved objects with no blanket access to sibling datasets.
Incorrect Answers
B:Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
C:Change: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
D:Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
Question 376
A Snowflake engineer is examining this platform situation: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table. A proposed shortcut is: Fix a missing schema USAGE by granting ALL PRIVILEGES on the whole account. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
- Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
- Fix a missing schema USAGE by granting ALL PRIVILEGES on the whole account.
- Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS.
Explanation
Correct Answer
A:Validate the premise using: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role. Applied case: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
Incorrect Answers
B:Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
C:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
D:Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
Question 377
A Snowflake implementation review finds: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table. The team proposes: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery.
- OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed.
- Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
- Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
Explanation
Correct Answer
D:Relevant validation before approval: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role. Applied case: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
Incorrect Answers
A:Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery. A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
B:OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
C:This option addresses a different Snowflake technical topic (Dynamic data masking and classification) rather than the documented Object privileges and parent USAGE decision.
Question 378
The data platform team has not yet approved changes. Current evidence indicates: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
- Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Inspect SHOW GRANTS, role hierarchy and active session role for the target object and user.
- Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
Explanation
Correct Answer
D:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. Applied case: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
Incorrect Answers
A:Compare ownership and dependent grants before and after transfer using SHOW GRANTS. A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
B:Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity. A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
C:Inspect SHOW GRANTS, role hierarchy and active session role for the target object and user. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
Question 379
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Approved clients connect while unexpected source networks are rejected before sensitive work proceeds.
- Auditors obtain the required evidence without permanent global account administration.
- The role can query only approved objects with no blanket access to sibling datasets.
- The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges.
Explanation
Correct Answer
C:The approved implementation step was: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
Incorrect Answers
A:Approved clients connect while unexpected source networks are rejected before sensitive work proceeds. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
B:Auditors obtain the required evidence without permanent global account administration. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
D:The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges. A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
Question 380
For an original SnowPro Core educational scenario, consider: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
- Fix a missing schema USAGE by granting ALL PRIVILEGES on the whole account.
- Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles.
- Change: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
- Check: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
Explanation
Correct Answer
D:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. Evidence: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
E:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. Acceptance: The role can query only approved objects with no blanket access to sibling datasets.
Incorrect Answers
A:Applied case: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
C:Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles. A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
