Snowflake SnowPro Core Practice Test 46
Question 450
For an original SnowPro Core educational scenario, consider: A steward wants consistent sensitivity labels that can support reporting and governed policy decisions as tables change. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Assume assigning a PUBLIC tag automatically prevents queries against every tagged object.
- Check: Inspect tags on representative new columns and policy bindings across changing schemas.
- Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS.
- Change: Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
Explanation
Correct Answer
B:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Acceptance: Sensitive assets are discoverable and consistently protected where explicit policies apply.
D:Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value. Evidence: Inspect tags on representative new columns and policy bindings across changing schemas.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
C:Change: Use a managed access schema and delegate grant decisions to the schema owner or a role with MANAGE GRANTS. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
E:Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Tags carry metadata labels and can support classification and policy attachment, but merely assigning a label does not automatically encrypt or hide every value.
Question 451
A Snowflake engineer is examining this platform situation: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs. A proposed shortcut is: Treat SHOW TABLES output as a complete historical log of every sensitive data query. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls.
- Treat SHOW TABLES output as a complete historical log of every sensitive data query.
- Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access.
- Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role.
Explanation
Correct Answer
A:The required acceptance condition is: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs.
Incorrect Answers
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs.
C:Apply account- or user-scope network policy with accurate allowed sources and tested break-glass access. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
D:Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 452
A Snowflake implementation review finds: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs. The team proposes: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
- Account usage metadata is a governed resource and reporting visibility must be granted explicitly rather than assuming every role sees it.
- Database roles are scoped to their database and cannot be activated directly as session primary roles; account roles can inherit them.
- Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
Explanation
Correct Answer
A:Demonstrable success requires: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs.
Incorrect Answers
B:This option addresses a different Snowflake technical topic (Governance access to shared SNOWFLAKE database) rather than the documented Data lineage and access history decision.
C:This option addresses a different Snowflake technical topic (Database roles and local privilege boundaries) rather than the documented Data lineage and access history decision.
D:Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 453
The data platform team has not yet approved changes. Current evidence indicates: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
- Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
Explanation
Correct Answer
C:Confirm afterward that: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs.
Incorrect Answers
A:Query the same protected column under authorized and limited roles and review masking-policy bindings. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
D:Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 454
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- Approved clients connect while unexpected source networks are rejected before sensitive work proceeds.
- The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges.
- The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
- Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access.
Explanation
Correct Answer
D:The approved implementation step was: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Applied case: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs.
Incorrect Answers
A:Approved clients connect while unexpected source networks are rejected before sensitive work proceeds. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:The watched warehouse raises alerts or suspends as configured without claiming to cap unrelated charges. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
C:The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 455
An implementation sign-off request identifies the following problem: Compliance asks which roles read confidential columns during an incident, but the team has only table DDL logs. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role. Verify: Compare CURRENT_ROLE, CURRENT_SECONDARY_ROLES and attempted SQL with each role mode.
- Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Verify: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Change: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Verify: Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Change: Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures. Verify: Inspect replication group membership, refresh history, secondary object state and controlled cutover scenarios.
Explanation
Correct Answer
C:The change is successful only when: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access.
Incorrect Answers
A:Change: Set the correct primary role and authorized secondary-role configuration, remembering that object creation ownership uses the primary role. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
D:Change: Configure supported database or failover group replication with tested refresh, permissions and secondary-region activation procedures. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 456
A Snowflake engineer is examining this platform situation: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions. A proposed shortcut is: Treat SHOW TABLES output as a complete historical log of every sensitive data query. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Configure suitable warehouse resource monitor thresholds and supported notifications or suspension actions; separately monitor serverless usage.
- Treat SHOW TABLES output as a complete historical log of every sensitive data query.
- Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls.
- Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation.
Explanation
Correct Answer
C:The required acceptance condition is: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
Incorrect Answers
A:Configure suitable warehouse resource monitor thresholds and supported notifications or suspension actions; separately monitor serverless usage. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
D:Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 457
A Snowflake implementation review finds: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions. The team proposes: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
- Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
- OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed.
- Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Explanation
Correct Answer
D:Demonstrable success requires: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
Incorrect Answers
A:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
C:OWNERSHIP grants control object management, and transferring ownership has specific grant-handling semantics that must be reviewed. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 458
The data platform team has not yet approved changes. Current evidence indicates: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Query the same protected column under authorized and limited roles and review masking-policy bindings.
- Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test.
- Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing.
Explanation
Correct Answer
A:Confirm afterward that: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
Incorrect Answers
B:Query the same protected column under authorized and limited roles and review masking-policy bindings. A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
C:Check schema type, object ownership and whether the correct role can GRANT SELECT in a controlled test. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
D:Record source IP addresses, policy precedence, login failures and emergency recovery path under safe testing. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 459
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The pipeline authenticates securely without depending on an individual's privileged interactive credentials.
- Authorized employees sign in securely and removed employees cannot retain access through stale credentials.
- Each dataset has a documented recovery horizon consistent with actual platform support.
- Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access.
Explanation
Correct Answer
D:The approved implementation step was: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
Incorrect Answers
A:The pipeline authenticates securely without depending on an individual's privileged interactive credentials. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:Authorized employees sign in securely and removed employees cannot retain access through stale credentials. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
C:Each dataset has a documented recovery horizon consistent with actual platform support. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Question 460
For an original SnowPro Core educational scenario, consider: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Change: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
- Check: Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Treat SHOW TABLES output as a complete historical log of every sensitive data query.
- Change: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls.
Explanation
Correct Answer
C:Acceptance: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
E:Acceptance: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Incorrect Answers
A:Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:Change: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
