Snowflake SnowPro Core Practice Test 47
Question 460
For an original SnowPro Core educational scenario, consider: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Change: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls.
- Check: Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Treat SHOW TABLES output as a complete historical log of every sensitive data query.
- Change: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls.
Explanation
Correct Answer
C:Acceptance: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
E:Acceptance: Auditors can identify relevant usage and downstream dependencies without granting ordinary analysts privileged raw audit access. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
Incorrect Answers
A:Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
B:Change: Configure supported federated SSO and multifactor authentication with user provisioning and offboarding controls. Access and lineage metadata serve distinct questions about observed activity and downstream object relationships.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A security analyst wants to map downstream views that depend on a restricted source column before changing permissions.
Question 461
A Snowflake engineer is examining this platform situation: An ingestion pipeline contains long-lived AWS keys inside CREATE STAGE definitions and violates key-rotation policy. A proposed shortcut is: Paste permanent cloud administrator access keys into every external stage definition. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Paste permanent cloud administrator access keys into every external stage definition.
- Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
- Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently.
- Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access.
Explanation
Correct Answer
B:Validate the premise using: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. This targeted change addresses the stated technical or governance gap without discarding necessary controls.
Incorrect Answers
A:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Attach a supported row access policy that evaluates appropriate identity or role context and filters rows consistently. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
D:Grant the minimum required USAGE on parent database and schema plus explicit object-level privileges and warehouse access. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 462
A Snowflake implementation review finds: An ingestion pipeline contains long-lived AWS keys inside CREATE STAGE definitions and violates key-rotation policy. The team proposes: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services.
- Query authorization can consider active primary and secondary roles, while CREATE object ownership and required creation privileges follow primary-role semantics.
- A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles.
- Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Explanation
Correct Answer
D:Relevant validation before approval: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Demonstrable success requires: The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
Incorrect Answers
A:Network policies constrain client origin but do not replace authentication or grants; mistakes can lock out legitimate services. An ingestion pipeline contains long-lived AWS keys inside CREATE STAGE definitions and violates key-rotation policy.
B:This option addresses a different Snowflake technical topic (Primary versus secondary roles) rather than the documented Storage integrations and cloud IAM decision.
C:A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 463
The data platform team has not yet approved changes. Current evidence indicates: An ingestion pipeline contains long-lived AWS keys inside CREATE STAGE definitions and violates key-rotation policy. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Inspect tags on representative new columns and policy bindings across changing schemas.
- Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Inspect replication group membership, refresh history, secondary object state and controlled cutover scenarios.
Explanation
Correct Answer
C:Confirm afterward that: The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Applied case: An ingestion pipeline contains long-lived AWS keys inside CREATE STAGE definitions and violates key-rotation policy.
Incorrect Answers
A:Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
B:Inspect tags on representative new columns and policy bindings across changing schemas. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
D:Inspect replication group membership, refresh history, secondary object state and controlled cutover scenarios. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 464
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An ingestion pipeline contains long-lived AWS keys inside CREATE STAGE definitions and violates key-rotation policy. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
- Recovery regions receive permitted objects and users can resume using the planned endpoint within agreed objectives.
- Intended users can perform only authorized operations, and the privilege chain is auditable.
- Each principal connects using approved mechanisms without broad authentication exceptions.
Explanation
Correct Answer
A:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. The result must be validated using the documented dataset or access context.
Incorrect Answers
B:Recovery regions receive permitted objects and users can resume using the planned endpoint within agreed objectives. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
C:Intended users can perform only authorized operations, and the privilege chain is auditable. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
D:Each principal connects using approved mechanisms without broad authentication exceptions. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 465
An implementation sign-off request identifies the following problem: An ingestion pipeline contains long-lived AWS keys inside CREATE STAGE definitions and violates key-rotation policy. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Verify: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Change: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Verify: Inspect authentication method, key/secret lifecycle, effective grants and connection audit logs.
- Change: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Verify: Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Change: Define database roles for database object permissions, then grant them to an account role users can activate. Verify: Inspect database-role grants, parent account-role membership and a permitted SELECT using the active account role.
Explanation
Correct Answer
A:The change is successful only when: The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
Incorrect Answers
B:Change: Use a dedicated least-privilege service user with supported key-pair or workload-identity authentication and documented rotation. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
C:Change: Use supported access-history, object-dependency and audit metadata with appropriate retention and access controls. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
D:Change: Define database roles for database object permissions, then grant them to an account role users can activate. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 466
A Snowflake engineer is examining this platform situation: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration. A proposed shortcut is: Paste permanent cloud administrator access keys into every external stage definition. What should the Snowflake engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
- Use governed object tags, supported classification methods and appropriate tag-based policy integration.
- Paste permanent cloud administrator access keys into every external stage definition.
- Configure suitable warehouse resource monitor thresholds and supported notifications or suspension actions; separately monitor serverless usage.
Explanation
Correct Answer
A:Validate the premise using: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Applied case: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
Incorrect Answers
B:Use governed object tags, supported classification methods and appropriate tag-based policy integration. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
C:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. Applied case: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
D:Configure suitable warehouse resource monitor thresholds and supported notifications or suspension actions; separately monitor serverless usage. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 467
A Snowflake implementation review finds: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration. The team proposes: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations. Which platform principle most strongly supports the recommended response? Select ONE best answer.
- Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
- A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles.
- Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer.
- Masking policies transform values exposed to queries based on policy context without requiring separate duplicated source tables for every audience.
Explanation
Correct Answer
A:Relevant validation before approval: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing. Applied case: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
Incorrect Answers
B:A role inherits the privileges of roles granted to it, and users acquire permissions through their assigned active roles. A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
C:Identity federation centralizes authentication while Snowflake role authorization remains a separate explicit layer. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
D:This option addresses a different Snowflake technical topic (Dynamic data masking and classification) rather than the documented Storage integrations and cloud IAM decision.
Question 468
The data platform team has not yet approved changes. Current evidence indicates: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity.
- Inspect tags on representative new columns and policy bindings across changing schemas.
- Test identical queries under representative roles and verify permitted and denied row counts.
Explanation
Correct Answer
A:Confirm afterward that: The approved bucket is reachable without exposing personal credentials or unrelated cloud paths. Applied case: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
Incorrect Answers
B:Inspect query references, policy evaluation or access metadata and lineage edges for representative controlled activity. A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
C:Inspect tags on representative new columns and policy bindings across changing schemas. A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
D:Test identical queries under representative roles and verify permitted and denied row counts. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 469
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration. The service owner needs positive and negative results and evidence that legitimate data workflows still function. Which acceptance result demonstrates correct platform behavior without disrupting authorized workflows? Select ONE best answer.
- The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
- Intended users can perform only authorized operations, and the privilege chain is auditable.
- Each principal connects using approved mechanisms without broad authentication exceptions.
- The department can query the designated database while unrelated databases remain private.
Explanation
Correct Answer
A:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. The approved implementation step was: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
Incorrect Answers
B:Intended users can perform only authorized operations, and the privilege chain is auditable. A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
C:Each principal connects using approved mechanisms without broad authentication exceptions. A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration.
D:The department can query the designated database while unrelated databases remain private. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
Question 470
For an original SnowPro Core educational scenario, consider: A data engineer cannot read a new S3 bucket because its IAM trust and allowed location do not match the storage integration. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Paste permanent cloud administrator access keys into every external stage definition.
- Change: Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation.
- Check: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
- Check: Test identical queries under representative roles and verify permitted and denied row counts.
- Change: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
Explanation
Correct Answer
C:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. Acceptance: The approved bucket is reachable without exposing personal credentials or unrelated cloud paths.
E:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. Evidence: Check integration grants, cloud IAM role trust, allowed prefixes and controlled stage listing.
Incorrect Answers
A:Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials. Use this instead: Use supported storage integrations tied to narrowly scoped cloud IAM permissions and approved external locations.
B:Change: Plan a controlled GRANT OWNERSHIP transfer with documented handling of existing grants and post-transfer validation. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
D:Check: Test identical queries under representative roles and verify permitted and denied row counts. Storage integrations delegate external cloud access through controlled identity relationships, reducing exposure from embedded static credentials.
