Snowflake SnowPro Core Practice Test 43
Question 420
For an original SnowPro Core educational scenario, consider: A new connection policy unintentionally disables a required legacy client because allowed authentication methods were not checked. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
- Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
- Require all users to share one password to avoid managing distinct sign-in methods.
- Change: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
- Change: Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database.
Explanation
Correct Answer
A:Required intervention: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
D:Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Incorrect Answers
B:Check: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
E:Change: Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database. Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
Question 421
A Snowflake engineer is examining this platform situation: Regional managers should see only rows for their permitted geographic regions even when using the same reporting view. A proposed shortcut is: Publish one unrestricted table and tell analysts to filter their own region voluntarily. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation.
- Publish one unrestricted table and tell analysts to filter their own region voluntarily.
- Define database roles for database object permissions, then grant them to an account role users can activate.
- Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
Explanation
Correct Answer
D:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Applied case: Regional managers should see only rows for their permitted geographic regions even when using the same reporting view.
Incorrect Answers
A:Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
B:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Define database roles for database object permissions, then grant them to an account role users can activate. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 422
A Snowflake implementation review finds: Regional managers should see only rows for their permitted geographic regions even when using the same reporting view. The team proposes: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
- Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery.
- Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
- Account usage metadata is a governed resource and reporting visibility must be granted explicitly rather than assuming every role sees it.
Explanation
Correct Answer
C:Demonstrable success requires: Each role sees only authorized geographic records from the same governed table. Applied case: Regional managers should see only rows for their permitted geographic regions even when using the same reporting view.
Incorrect Answers
A:Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
B:Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery. Regional managers should see only rows for their permitted geographic regions even when using the same reporting view.
D:Account usage metadata is a governed resource and reporting visibility must be granted explicitly rather than assuming every role sees it. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 423
The data platform team has not yet approved changes. Current evidence indicates: Regional managers should see only rows for their permitted geographic regions even when using the same reporting view. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
- Check SHOW GRANTS for database, schema, table and selected warehouse on the active role.
- Test identical queries under representative roles and verify permitted and denied row counts.
Explanation
Correct Answer
D:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Confirm afterward that: Each role sees only authorized geographic records from the same governed table.
Incorrect Answers
A:Query the same protected column under authorized and limited roles and review masking-policy bindings. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
B:Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
C:Check SHOW GRANTS for database, schema, table and selected warehouse on the active role. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 424
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Regional managers should see only rows for their permitted geographic regions even when using the same reporting view. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The role can query only approved objects with no blanket access to sibling datasets.
- The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
- Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
- Each role sees only authorized geographic records from the same governed table.
Explanation
Correct Answer
D:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. The result must be validated using the documented dataset or access context.
Incorrect Answers
A:The role can query only approved objects with no blanket access to sibling datasets. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
B:The pipeline authenticates securely without depending on an individual's privileged interactive credentials. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
C:Query rights and ownership are predictable and do not depend on silently enabled excessive roles. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 425
An implementation sign-off request identifies the following problem: Regional managers should see only rows for their permitted geographic regions even when using the same reporting view. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently. Verify: Test identical queries under representative roles and verify permitted and denied row counts.
- Change: Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation. Verify: Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
- Change: Define database roles for database object permissions, then grant them to an account role users can activate. Verify: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
- Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. Verify: Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing.
Explanation
Correct Answer
A:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. The change is successful only when: Each role sees only authorized geographic records from the same governed table.
Incorrect Answers
B:Change: Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
C:Change: Define database roles for database object permissions, then grant them to an account role users can activate. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
D:Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 426
A Snowflake engineer is examining this platform situation: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst. A proposed shortcut is: Publish one unrestricted table and tell analysts to filter their own region voluntarily. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
- Publish one unrestricted table and tell analysts to filter their own region voluntarily.
- Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
- Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
Explanation
Correct Answer
A:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Applied case: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst.
Incorrect Answers
B:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Use this instead: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
C:Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst.
D:Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 427
A Snowflake implementation review finds: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst. The team proposes: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
- Account usage metadata is a governed resource and reporting visibility must be granted explicitly rather than assuming every role sees it.
- Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
- OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed.
Explanation
Correct Answer
A:Demonstrable success requires: Each role sees only authorized geographic records from the same governed table. Applied case: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst.
Incorrect Answers
B:Account usage metadata is a governed resource and reporting visibility must be granted explicitly rather than assuming every role sees it. A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst.
C:Access and lineage metadata serve distinct questions about observed activity and downstream object relationships. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
D:OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 428
The data platform team has not yet approved changes. Current evidence indicates: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect tags on representative new columns and policy bindings across changing schemas.
- Test identical queries under representative roles and verify permitted and denied row counts.
- Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp.
- Create a controlled new table after configuring grants and verify permissions separately from an old table.
Explanation
Correct Answer
B:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. This check tests the actual data, compute or access boundary before an operationally risky change.
Incorrect Answers
A:Inspect tags on representative new columns and policy bindings across changing schemas. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
C:Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
D:This option addresses a different Snowflake technical topic (Future grants for new objects) rather than the documented Row access policies for jurisdictional filtering decision.
Question 429
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Each role sees only authorized geographic records from the same governed table.
- Auditors obtain the required evidence without permanent global account administration.
- The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
- Each principal connects using approved mechanisms without broad authentication exceptions.
Explanation
Correct Answer
A:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. The approved implementation step was: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
Incorrect Answers
B:Auditors obtain the required evidence without permanent global account administration. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
C:The pipeline authenticates securely without depending on an individual's privileged interactive credentials. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
D:Each principal connects using approved mechanisms without broad authentication exceptions. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 430
For an original SnowPro Core educational scenario, consider: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access.
- Publish one unrestricted table and tell analysts to filter their own region voluntarily.
- Check: Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
- Check: Test identical queries under representative roles and verify permitted and denied row counts.
- Change: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
Explanation
Correct Answer
D:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Acceptance: Each role sees only authorized geographic records from the same governed table.
E:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Evidence: Test identical queries under representative roles and verify permitted and denied row counts.
Incorrect Answers
A:Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
C:Check: Compare effective policy assignments, actual connection methods and login tests for both human and service identities. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
