Snowflake SnowPro Core Practice Test 40
Question 390
For an original SnowPro Core educational scenario, consider: A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
- Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
- Embed a permanent ACCOUNTADMIN password in the application's Git repository.
- Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
- Change: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
Explanation
Correct Answer
A:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. Acceptance: The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
E:Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk. Evidence: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
Incorrect Answers
B:Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Nonhuman access should have isolated credentials and scoped roles; sharing personal logins obscures ownership and magnifies credential risk.
D:Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. A scheduled loader fails after its shared human account is disabled, revealing that the pipeline has no dedicated service identity.
Question 391
A Snowflake engineer is examining this platform situation: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding. A proposed shortcut is: Give every employee a common password because Snowflake data is encrypted at rest. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
- Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
- Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls.
- Give every employee a common password because Snowflake data is encrypted at rest.
Explanation
Correct Answer
B:The required acceptance condition is: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Applied case: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding.
Incorrect Answers
A:Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
D:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Question 392
A Snowflake implementation review finds: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding. The team proposes: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
- Grants on ALL existing objects differ from FUTURE grants that apply when matching objects are created later.
- Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
- Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
Explanation
Correct Answer
C:Demonstrable success requires: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Applied case: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding.
Incorrect Answers
A:Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
B:Grants on ALL existing objects differ from FUTURE grants that apply when matching objects are created later. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
D:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Question 393
The data platform team has not yet approved changes. Current evidence indicates: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
- Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage.
- Test IdP login, MFA challenge, disabled account behavior and effective role mapping.
Explanation
Correct Answer
D:Confirm afterward that: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Applied case: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding.
Incorrect Answers
A:Query the same protected column under authorized and limited roles and review masking-policy bindings. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
B:Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Question 394
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Authorized employees sign in securely and removed employees cannot retain access through stale credentials.
- New approved tables inherit intended least-privilege access without relying on daily manual scripts.
- Each role sees only authorized geographic records from the same governed table.
- Approved clients connect while unexpected source networks are rejected before sensitive work proceeds.
Explanation
Correct Answer
A:The approved implementation step was: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Applied case: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding.
Incorrect Answers
B:New approved tables inherit intended least-privilege access without relying on daily manual scripts. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:Each role sees only authorized geographic records from the same governed table. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
D:Approved clients connect while unexpected source networks are rejected before sensitive work proceeds. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Question 395
An implementation sign-off request identifies the following problem: Several analysts reuse local passwords even though the organization requires identity-provider MFA and centralized offboarding. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Verify: Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test.
- Change: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Verify: Test IdP login, MFA challenge, disabled account behavior and effective role mapping.
- Change: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently. Verify: Test identical queries under representative roles and verify permitted and denied row counts.
- Change: Use governed object tags, supported classification methods and appropriate tag-based policy integration. Verify: Inspect tags on representative new columns and policy bindings across changing schemas.
Explanation
Correct Answer
B:The change is successful only when: Authorized employees sign in securely and removed employees cannot retain access through stale credentials.
Incorrect Answers
A:Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:Change: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
D:Change: Use governed object tags, supported classification methods and appropriate tag-based policy integration. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Question 396
A Snowflake engineer is examining this platform situation: A departing employee can still use an old Snowflake login after being removed from the company's main directory. A proposed shortcut is: Give every employee a common password because Snowflake data is encrypted at rest. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
- Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database.
- Give every employee a common password because Snowflake data is encrypted at rest.
- Define appropriate FUTURE grants on the intended database or schema in addition to any existing-object grants.
Explanation
Correct Answer
A:The required acceptance condition is: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Applied case: A departing employee can still use an old Snowflake login after being removed from the company's main directory.
Incorrect Answers
B:Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A departing employee can still use an old Snowflake login after being removed from the company's main directory.
D:Define appropriate FUTURE grants on the intended database or schema in addition to any existing-object grants. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Question 397
A Snowflake implementation review finds: A departing employee can still use an old Snowflake login after being removed from the company's main directory. The team proposes: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
- In managed access schemas, individual object owners cannot independently grant privileges; schema ownership or global grant management controls them.
- Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
- Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Explanation
Correct Answer
C:Demonstrable success requires: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Applied case: A departing employee can still use an old Snowflake login after being removed from the company's main directory.
Incorrect Answers
A:Access and lineage metadata serve distinct questions about observed activity and downstream object relationships. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
B:In managed access schemas, individual object owners cannot independently grant privileges; schema ownership or global grant management controls them. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
D:Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges. A departing employee can still use an old Snowflake login after being removed from the company's main directory.
Question 398
The data platform team has not yet approved changes. Current evidence indicates: A departing employee can still use an old Snowflake login after being removed from the company's main directory. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect replication group membership, refresh history, secondary object state and controlled cutover scenarios.
- Test identical queries under representative roles and verify permitted and denied row counts.
- Inspect tags on representative new columns and policy bindings across changing schemas.
- Test IdP login, MFA challenge, disabled account behavior and effective role mapping.
Explanation
Correct Answer
D:Confirm afterward that: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Applied case: A departing employee can still use an old Snowflake login after being removed from the company's main directory.
Incorrect Answers
A:Inspect replication group membership, refresh history, secondary object state and controlled cutover scenarios. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
B:Test identical queries under representative roles and verify permitted and denied row counts. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:Inspect tags on representative new columns and policy bindings across changing schemas. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Question 399
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A departing employee can still use an old Snowflake login after being removed from the company's main directory. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Each principal connects using approved mechanisms without broad authentication exceptions.
- Authorized employees sign in securely and removed employees cannot retain access through stale credentials.
- Each dataset has a documented recovery horizon consistent with actual platform support.
- Each role sees only authorized geographic records from the same governed table.
Explanation
Correct Answer
B:The approved implementation step was: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Applied case: A departing employee can still use an old Snowflake login after being removed from the company's main directory.
Incorrect Answers
A:Each principal connects using approved mechanisms without broad authentication exceptions. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:Each dataset has a documented recovery horizon consistent with actual platform support. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
D:Each role sees only authorized geographic records from the same governed table. A departing employee can still use an old Snowflake login after being removed from the company's main directory.
Question 400
For an original SnowPro Core educational scenario, consider: A departing employee can still use an old Snowflake login after being removed from the company's main directory. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Change: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
- Check: Test IdP login, MFA challenge, disabled account behavior and effective role mapping.
- Result: Authorized employees sign in securely and removed employees cannot retain access through stale credentials.
- Check: Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
- Change: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
- Result: The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
Explanation
Correct Answer
A:Acceptance: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Applied case: A departing employee can still use an old Snowflake login after being removed from the company's main directory.
B:Acceptance: Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
C:Required intervention: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
Incorrect Answers
D:Check: Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
E:Change: Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
F:Result: The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
