Snowflake SnowPro Core Practice Test 44
Question 430
For an original SnowPro Core educational scenario, consider: A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access.
- Publish one unrestricted table and tell analysts to filter their own region voluntarily.
- Check: Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
- Check: Test identical queries under representative roles and verify permitted and denied row counts.
- Change: Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
Explanation
Correct Answer
D:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Acceptance: Each role sees only authorized geographic records from the same governed table.
E:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Evidence: Test identical queries under representative roles and verify permitted and denied row counts.
Incorrect Answers
A:Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. A data product is queried by multiple teams and manual WHERE clauses are not consistently added by every analyst.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
C:Check: Compare effective policy assignments, actual connection methods and login tests for both human and service identities. Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
Question 431
A Snowflake engineer is examining this platform situation: A support analyst needs customer trends but should not see full government identifiers in a shared table. A proposed shortcut is: Copy the full customer dataset into each analyst's personal schema and hope they do not disclose it. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database.
- Copy the full customer dataset into each analyst's personal schema and hope they do not disclose it.
- Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
- Define database roles for database object permissions, then grant them to an account role users can activate.
Explanation
Correct Answer
C:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Applied case: A support analyst needs customer trends but should not see full government identifiers in a shared table.
Incorrect Answers
A:Assign controlled imported privileges or supported database-role access to the shared SNOWFLAKE reporting database. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
B:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Define database roles for database object permissions, then grant them to an account role users can activate. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 432
A Snowflake implementation review finds: A support analyst needs customer trends but should not see full government identifiers in a shared table. The team proposes: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed.
- Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery.
- Database roles are scoped to their database and cannot be activated directly as session primary roles; account roles can inherit them.
- Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Explanation
Correct Answer
D:Demonstrable success requires: Authorized roles receive appropriate values while other users see safe masked representations. Applied case: A support analyst needs customer trends but should not see full government identifiers in a shared table.
Incorrect Answers
A:OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
B:Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
C:Database roles are scoped to their database and cannot be activated directly as session primary roles; account roles can inherit them. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 433
The data platform team has not yet approved changes. Current evidence indicates: A support analyst needs customer trends but should not see full government identifiers in a shared table. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Compare ownership and dependent grants before and after transfer using SHOW GRANTS.
- Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage.
Explanation
Correct Answer
A:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Confirm afterward that: Authorized roles receive appropriate values while other users see safe masked representations.
Incorrect Answers
B:Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
C:Compare ownership and dependent grants before and after transfer using SHOW GRANTS. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
D:Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 434
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A support analyst needs customer trends but should not see full government identifiers in a shared table. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Authorized roles receive appropriate values while other users see safe masked representations.
- The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
- The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges.
- Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
Explanation
Correct Answer
A:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. The result must be validated using the documented dataset or access context.
Incorrect Answers
B:The pipeline authenticates securely without depending on an individual's privileged interactive credentials. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
C:The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
D:Query rights and ownership are predictable and do not depend on silently enabled excessive roles. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 435
An implementation sign-off request identifies the following problem: A support analyst needs customer trends but should not see full government identifiers in a shared table. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. Verify: Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing.
- Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Verify: Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Change: Set supported retention values per object type, edition and legal recovery need, with measured storage impact. Verify: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp.
- Change: Define database roles for database object permissions, then grant them to an account role users can activate. Verify: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
Explanation
Correct Answer
B:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. The change is successful only when: Authorized roles receive appropriate values while other users see safe masked representations.
Incorrect Answers
A:Change: Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
C:Change: Set supported retention values per object type, edition and legal recovery need, with measured storage impact. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
D:Change: Define database roles for database object permissions, then grant them to an account role users can activate. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 436
A Snowflake engineer is examining this platform situation: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns. A proposed shortcut is: Copy the full customer dataset into each analyst's personal schema and hope they do not disclose it. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
- Copy the full customer dataset into each analyst's personal schema and hope they do not disclose it.
- Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
- Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures.
Explanation
Correct Answer
A:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Applied case: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns.
Incorrect Answers
B:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Use this instead: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
C:Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
D:Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 437
A Snowflake implementation review finds: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns. The team proposes: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter.
- Resource monitors govern supported warehouse credit consumption and are not a universal spending cap for all Snowflake services.
- Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
- Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Explanation
Correct Answer
D:Demonstrable success requires: Authorized roles receive appropriate values while other users see safe masked representations. Applied case: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns.
Incorrect Answers
A:Row access policies provide centralized row-level access decisions that do not depend on every consuming SQL author remembering a filter. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
B:Resource monitors govern supported warehouse credit consumption and are not a universal spending cap for all Snowflake services. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
C:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 438
The data platform team has not yet approved changes. Current evidence indicates: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Test identical queries under representative roles and verify permitted and denied row counts.
- Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
Explanation
Correct Answer
A:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. This check tests the actual data, compute or access boundary before an operationally risky change.
Incorrect Answers
B:Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns.
C:Test identical queries under representative roles and verify permitted and denied row counts. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
D:Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 439
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
- Query rights and ownership are predictable and do not depend on silently enabled excessive roles.
- Authorized roles receive appropriate values while other users see safe masked representations.
- Authorized employees sign in securely and removed employees cannot retain access through stale credentials.
Explanation
Correct Answer
C:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. The approved implementation step was: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
Incorrect Answers
A:The pipeline authenticates securely without depending on an individual's privileged interactive credentials. A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns.
B:Query rights and ownership are predictable and do not depend on silently enabled excessive roles. A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns.
D:Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 440
For an original SnowPro Core educational scenario, consider: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Check: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp.
- Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
- Change: Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures.
- Copy the full customer dataset into each analyst's personal schema and hope they do not disclose it.
Explanation
Correct Answer
A:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Acceptance: Authorized roles receive appropriate values while other users see safe masked representations.
C:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Evidence: Query the same protected column under authorized and limited roles and review masking-policy bindings.
Incorrect Answers
B:Check: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
D:Change: Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
