Snowflake SnowPro Core Practice Test 45
Question 440
For an original SnowPro Core educational scenario, consider: A privileged fraud investigator needs true card-token fields while a BI analyst should see masked versions of those columns. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Check: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp.
- Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns.
- Change: Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures.
- Copy the full customer dataset into each analyst's personal schema and hope they do not disclose it.
Explanation
Correct Answer
A:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Acceptance: Authorized roles receive appropriate values while other users see safe masked representations.
C:Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience. Evidence: Query the same protected column under authorized and limited roles and review masking-policy bindings.
Incorrect Answers
B:Check: Inspect effective retention parameters and attempt a safe as-of query at an approved timestamp. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
D:Change: Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Question 441
A Snowflake engineer is examining this platform situation: A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas. A proposed shortcut is: Assume assigning a PUBLIC tag automatically prevents queries against every tagged object. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS.
- Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Assume assigning a PUBLIC tag automatically prevents queries against every tagged object.
- Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls.
Explanation
Correct Answer
B:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Applied case: A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas.
Incorrect Answers
A:Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas.
Question 442
A Snowflake implementation review finds: A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas. The team proposes: Use governed object tags, supported classification methods and appropriate tag-based policy integration. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Account usage metadata is a governed resource and reporting visibility must be granted explicitly rather than assuming every role sees it.
- Database roles are scoped to their database and cannot be activated directly as session primary roles; account roles can inherit them.
- In managed access schemas, individual object owners cannot independently grant privileges; schema ownership or global grant management controls them.
- Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Explanation
Correct Answer
D:Demonstrable success requires: Sensitive assets are discoverable and consistently protected where explicit policies apply.
Incorrect Answers
A:This option addresses a different Snowflake technical topic (Governance access to shared SNOWFLAKE database) rather than the documented Tags and policy-based governance decision.
B:Database roles are scoped to their database and cannot be activated directly as session primary roles; account roles can inherit them. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:In managed access schemas, individual object owners cannot independently grant privileges; schema ownership or global grant management controls them. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Question 443
The data platform team has not yet approved changes. Current evidence indicates: A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect tags on representative new columns and policy bindings across changing schemas.
- Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage.
- Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test.
- Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
Explanation
Correct Answer
A:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Confirm afterward that: Sensitive assets are discoverable and consistently protected where explicit policies apply.
Incorrect Answers
B:Inspect assigned warehouse monitor, thresholds, triggered actions and other service meter usage. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
D:Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs. A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas.
Question 444
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Sensitive assets are discoverable and consistently protected where explicit policies apply.
- Authorized roles receive appropriate values while other users see safe masked representations.
- The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges.
- Authorized employees sign in securely and removed employees cannot retain access through stale credentials.
Explanation
Correct Answer
A:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. The result must be validated using the documented dataset or access context.
Incorrect Answers
B:Authorized roles receive appropriate values while other users see safe masked representations. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
D:Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Question 445
An implementation sign-off request identifies the following problem: A multinational data team cannot reliably identify which new columns hold confidential identifiers across hundreds of schemas. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Verify: Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Change: Use governed object tags, supported classification methods and appropriate tag-based policy integration. Verify: Inspect tags on representative new columns and policy bindings across changing schemas.
- Change: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement. Verify: Compare effective policy assignments, actual connection methods and login tests for both human and service identities.
- Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Verify: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
Explanation
Correct Answer
B:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. The change is successful only when: Sensitive assets are discoverable and consistently protected where explicit policies apply.
Incorrect Answers
A:Change: Apply dynamic masking policies with role-aware conditions to appropriately classified sensitive columns. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:Change: Define appropriate supported authentication policies and client-type restrictions per user population, testing changes before enforcement.
D:Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Question 446
A Snowflake engineer is examining this platform situation: A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change. A proposed shortcut is: Assume assigning a PUBLIC tag automatically prevents queries against every tagged object. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Assume assigning a PUBLIC tag automatically prevents queries against every tagged object.
- Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Define appropriate FUTURE grants on the intended database or schema in addition to any existing-object grants.
- Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
Explanation
Correct Answer
B:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Applied case: A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change.
Incorrect Answers
A:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Use this instead: Use governed object tags, supported classification methods and appropriate tag-based policy integration.
C:Define appropriate FUTURE grants on the intended database or schema in addition to any existing-object grants. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
D:Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Question 447
A Snowflake implementation review finds: A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change. The team proposes: Use governed object tags, supported classification methods and appropriate tag-based policy integration. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery.
- Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges.
- Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
- Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Explanation
Correct Answer
D:Relevant validation before approval: Inspect tags on representative new columns and policy bindings across changing schemas.
Incorrect Answers
A:Cross-region recovery requires explicitly configured replication and failover; local zero-copy cloning is not geographic disaster recovery. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
B:Snowflake authentication policies can constrain permitted methods and clients independently of RBAC privileges. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:This option addresses a different Snowflake technical topic (Primary versus secondary roles) rather than the documented Tags and policy-based governance decision.
Question 448
The data platform team has not yet approved changes. Current evidence indicates: A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test identical queries under representative roles and verify permitted and denied row counts.
- Inspect tags on representative new columns and policy bindings across changing schemas.
- Inspect replication group membership, refresh history, secondary object state and controlled cutover scenarios.
- Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
Explanation
Correct Answer
B:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. This check tests the actual data, compute or access boundary before an operationally risky change.
Incorrect Answers
A:Test identical queries under representative roles and verify permitted and denied row counts. A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change.
C:Inspect replication group membership, refresh history, secondary object state and controlled cutover scenarios. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
D:Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Question 449
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Sensitive assets are discoverable and consistently protected where explicit policies apply.
- The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
- The role can query only approved objects with no blanket access to sibling datasets.
- The department can query the designated database while unrelated databases remain private.
Explanation
Correct Answer
A:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. The approved implementation step was: Use governed object tags, supported classification methods and appropriate tag-based policy integration.
Incorrect Answers
B:The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:The role can query only approved objects with no blanket access to sibling datasets. A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change.
D:The department can query the designated database while unrelated databases remain private. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Question 450
For an original SnowPro Core educational scenario, consider: A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Assume assigning a PUBLIC tag automatically prevents queries against every tagged object.
- Check: Inspect tags on representative new columns and policy bindings across changing schemas.
- Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS.
- Change: Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
Explanation
Correct Answer
B:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Acceptance: Sensitive assets are discoverable and consistently protected where explicit policies apply.
D:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Evidence: Inspect tags on representative new columns and policy bindings across changing schemas.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
E:Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
