Snowflake SnowPro Core Practice Test 39
Question 380
For an original SnowPro Core educational scenario, consider: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
- Fix a missing schema USAGE by granting ALL PRIVILEGES on the whole account.
- Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles.
- Change: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
- Check: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
Explanation
Correct Answer
D:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. Evidence: Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
E:Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate. Acceptance: The role can query only approved objects with no blanket access to sibling datasets.
Incorrect Answers
A:Applied case: A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Reading a table normally requires privileges on its containing database and schema as well as SELECT on the table; warehouse USAGE is separate.
C:Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles. A developer grants USAGE on a warehouse and believes it implicitly authorizes reading every database table.
Question 381
A Snowflake engineer is examining this platform situation: A production integration stores an administrator password in source code and rotates it manually once a year. A proposed shortcut is: Embed a permanent ACCOUNTADMIN password in the application's Git repository. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
- Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
- Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
- Embed a permanent ACCOUNTADMIN password in the application's Git repository.
Explanation
Correct Answer
B:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. This targeted change addresses the stated technical or governance gap without discarding necessary controls.
Incorrect Answers
A:Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 382
A Snowflake implementation review finds: A production integration stores an administrator password in source code and rotates it manually once a year. The team proposes: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
- Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
- Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
- Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
Explanation
Correct Answer
B:Relevant validation before approval: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs. Demonstrable success requires: The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
Incorrect Answers
A:Access and lineage metadata serve distinct questions about observed activity and downstream object relationships. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 383
The data platform team has not yet approved changes. Current evidence indicates: A production integration stores an administrator password in source code and rotates it manually once a year. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
- Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing.
- Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
- Test IdP login, MFA challenge, disabled account behavior and effective role mapping.
Explanation
Correct Answer
A:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. Confirm afterward that: The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
Incorrect Answers
B:Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:Check SHOW GRANTS for database, schema, table and selected warehouse on the active role. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Test IdP login, MFA challenge, disabled account behavior and effective role mapping. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 384
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A production integration stores an administrator password in source code and rotates it manually once a year. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The new steward manages objects while approved consumers retain their intended privileges.
- Dataset sharing requires the designated governance authority instead of arbitrary table-owner discretion.
- The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
- Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access.
Explanation
Correct Answer
C:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. The result must be validated using the documented dataset or access context.
Incorrect Answers
A:The new steward manages objects while approved consumers retain their intended privileges. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
B:Dataset sharing requires the designated governance authority instead of arbitrary table-owner discretion. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 385
An implementation sign-off request identifies the following problem: A production integration stores an administrator password in source code and rotates it manually once a year. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Verify: Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test.
- Change: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Verify: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
- Change: Set supported retention values per object type, edition and legal recovery need, with measured storage impact. Verify: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp.
- Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Verify: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
Explanation
Correct Answer
B:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. The change is successful only when: The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
Incorrect Answers
A:Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:Change: Set supported retention values per object type, edition and legal recovery need, with measured storage impact. A production integration stores an administrator password in source code and rotates it manually once a year.
D:Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 386
A Snowflake engineer is examining this platform situation: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity. A proposed shortcut is: Embed a permanent ACCOUNTADMIN password in the application's Git repository. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Embed a permanent ACCOUNTADMIN password in the application's Git repository.
- Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
- Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
Explanation
Correct Answer
B:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. Applied case: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity.
Incorrect Answers
A:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. Use this instead: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
C:Use governed object tags, supported classification methods and appropriate tag-based policy integration. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 387
A Snowflake implementation review finds: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity. The team proposes: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
- Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery.
- Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
- Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Explanation
Correct Answer
A:Relevant validation before approval: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs. Applied case: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity.
Incorrect Answers
B:This option addresses a different Snowflake technical topic (Cross-region replication and failover groups) rather than the documented Service authentication and key rotation decision.
C:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity.
D:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 388
The data platform team has not yet approved changes. Current evidence indicates: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
- Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Create a controlled new table after configuring grants and verify permissions separately from an old table.
- Test identical queries under representative roles and verify permitted and denied row counts.
Explanation
Correct Answer
A:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. This check tests the actual data, compute or access boundary before an operationally risky change.
Incorrect Answers
B:Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:Create a controlled new table after configuring grants and verify permissions separately from an old table. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Test identical queries under representative roles and verify permitted and denied row counts. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 389
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
- Approved clients connect while unexpected source networks are rejected before sensitive work proceeds.
- New approved tables inherit intended least-privilege access without relying on daily manual scripts.
- Each principal connects using approved mechanisms without broad authentication exceptions.
Explanation
Correct Answer
A:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. The approved implementation step was: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
Incorrect Answers
B:Approved clients connect while unexpected source networks are rejected before sensitive work proceeds. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:New approved tables inherit intended least-privilege access without relying on daily manual scripts. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Each principal connects using approved mechanisms without broad authentication exceptions. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
Question 390
For an original SnowPro Core educational scenario, consider: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
- Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
- Embed a permanent ACCOUNTADMIN password in the application's Git repository.
- Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
- Change: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
Explanation
Correct Answer
A:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. Acceptance: The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
E:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. Evidence: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
Incorrect Answers
B:Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity.
