Snowflake SnowPro Core Practice Test 42
Question 410
For an original SnowPro Core educational scenario, consider: A service integration breaks because administrators apply a restrictive IP network policy without including its known outbound NAT addresses. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access.
- Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles.
- Check: Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Check: Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing.
- Disable all client-source restrictions permanently because an integration has an undocumented egress IP.
Explanation
Correct Answer
A:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. Acceptance: Approved clients connect while unexpected source networks are rejected before sensitive work proceeds.
D:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. Required intervention: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access.
Incorrect Answers
B:Change: Create least-privilege custom roles with explicit object grants and appropriate parent-role inheritance instead of using broad system roles. Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
C:Check: Query the same protected column under authorized and limited roles and review masking-policy bindings. Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
Question 411
A Snowflake engineer is examining this platform situation: An organization wants service integrations to use key authentication while employees use federated interactive sign-in. A proposed shortcut is: Require all users to share one password to avoid managing distinct sign-in methods. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls.
- Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
- Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
- Require all users to share one password to avoid managing distinct sign-in methods.
Explanation
Correct Answer
C:The required acceptance condition is: Each principal connects using approved mechanisms without broad authentication exceptions. Applied case: An organization wants service integrations to use key authentication while employees use federated interactive sign-in.
Incorrect Answers
A:Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
B:Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
D:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 412
A Snowflake implementation review finds: An organization wants service integrations to use key authentication while employees use federated interactive sign-in. The team proposes: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
- Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
- In managed access schemas, individual object owners cannot independently grant privileges; schema ownership or global grant management controls them.
- Resource monitors govern supported warehouse credit consumption and are not a universal spending cap for all Snowflake services.
Explanation
Correct Answer
A:Relevant validation before approval: Compare effective policy assignments, actual connection methods and login tests for both human and service identities. This principle explains the proposed technical approach, which is: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
Incorrect Answers
B:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:In managed access schemas, individual object owners cannot independently grant privileges; schema ownership or global grant management controls them. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
D:Resource monitors govern supported warehouse credit consumption and are not a universal spending cap for all Snowflake services. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 413
The data platform team has not yet approved changes. Current evidence indicates: An organization wants service integrations to use key authentication while employees use federated interactive sign-in. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
- Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
Explanation
Correct Answer
D:If confirmed, the proportionate intervention is: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Applied case: An organization wants service integrations to use key authentication while employees use federated interactive sign-in.
Incorrect Answers
A:Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
B:Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:Check SHOW GRANTS for database, schema, table and selected warehouse on the active role. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 414
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An organization wants service integrations to use key authentication while employees use federated interactive sign-in. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Each principal connects using approved mechanisms without broad authentication exceptions.
- Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access.
- Intended users can perform only authorized operations, and the privilege chain is auditable.
- Approved clients connect while unexpected source networks are rejected before sensitive work proceeds.
Explanation
Correct Answer
A:The approved implementation step was: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Applied case: An organization wants service integrations to use key authentication while employees use federated interactive sign-in.
Incorrect Answers
B:Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:Intended users can perform only authorized operations, and the privilege chain is auditable. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
D:Approved clients connect while unexpected source networks are rejected before sensitive work proceeds. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 415
An implementation sign-off request identifies the following problem: An organization wants service integrations to use key authentication while employees use federated interactive sign-in. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Set supported retention values per object type, edition and legal recovery need, with measured storage impact. Verify: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp.
- Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Verify: Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Verify: Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test.
- Change: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Verify: Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
Explanation
Correct Answer
D:The change is successful only when: Each principal connects using approved mechanisms without broad authentication exceptions.
Incorrect Answers
A:Change: Set supported retention values per object type, edition and legal recovery need, with measured storage impact. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
B:Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 416
A Snowflake engineer is examining this platform situation: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked. A proposed shortcut is: Require all users to share one password to avoid managing distinct sign-in methods. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
- Require all users to share one password to avoid managing distinct sign-in methods.
- Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
Explanation
Correct Answer
D:The required acceptance condition is: Each principal connects using approved mechanisms without broad authentication exceptions. Applied case: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked.
Incorrect Answers
A:Use governed object tags, supported classification methods and appropriate tag-based policy integration. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
B:Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Use this instead: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
Question 417
A Snowflake implementation review finds: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked. The team proposes: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
- Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
- Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
- Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Explanation
Correct Answer
C:Relevant validation before approval: Compare effective policy assignments, actual connection methods and login tests for both human and service identities. Applied case: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked.
Incorrect Answers
A:Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
B:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
D:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked.
Question 418
The data platform team has not yet approved changes. Current evidence indicates: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test selected ACCOUNT_USAGE views under a read-only audit role and verify available columns and latency.
- Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
- Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing.
- Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
Explanation
Correct Answer
B:If confirmed, the proportionate intervention is: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Applied case: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked.
Incorrect Answers
A:Test selected ACCOUNT_USAGE views under a read-only audit role and verify available columns and latency. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
D:Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 419
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Intended users can perform only authorized operations, and the privilege chain is auditable.
- Each principal connects using approved mechanisms without broad authentication exceptions.
- Recovery regions receive permitted objects and users can resume using the planned endpoint within agreed objectives.
- The new steward manages objects while approved consumers retain their intended privileges.
Explanation
Correct Answer
B:The approved implementation step was: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Applied case: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked.
Incorrect Answers
A:Intended users can perform only authorized operations, and the privilege chain is auditable. A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked.
C:Recovery regions receive permitted objects and users can resume using the planned endpoint within agreed objectives. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
D:The new steward manages objects while approved consumers retain their intended privileges. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 420
For an original SnowPro Core educational scenario, consider: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
- Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
- Require all users to share one password to avoid managing distinct sign-in methods.
- Change: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
- Change: Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database.
Explanation
Correct Answer
A:Required intervention: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
D:Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Incorrect Answers
B:Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
E:Change: Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
