• Home
  • Articles
  • [2024] ADA-C01 PDF Questions - Perfect Prospect To Go With Lead2Passed Practice Exam [Q30-Q53]

[2024] ADA-C01 PDF Questions - Perfect Prospect To Go With Lead2Passed Practice Exam [Q30-Q53]

Share

[2024] ADA-C01 PDF Questions - Perfect Prospect To Go With Lead2Passed Practice Exam

Snowflake ADA-C01 Pdf Questions - Outstanding Practice To your Exam

NEW QUESTION # 30
An Administrator receives data from a Snowflake partner. The partner is sharing a dataset that contains multiple secure views. The Administrator would like to configure the data so that only certain roles can see certain secure views.
How can this be accomplished?

  • A. Individually grant imported privileges onto the schema in the share.
  • B. Clone the data and insert it into a company-owned share and apply the desired RBAC on the new tables.
  • C. Create views over the incoming shared database and apply the desired RBAC onto these views.
  • D. Apply RBAC directly onto the partner's shared secure views.

Answer: C

Explanation:
Explanation
According to the Snowflake documentation1, secure views are only exposed to authorized users who have been granted the role that owns the view. Therefore, applying RBAC directly onto the partner's shared secure views (option A) is not possible, as the administrator does not own those views. Individually granting imported privileges onto the schema in the share (option B) is also not feasible, as the privileges granted on the schema do not apply to existing secure views, only tofuture ones2. Cloning the data and inserting it into a company-owned share (option C) is not recommended, as it would create unnecessary duplication of data and increase storage costs. The best option is to create views over the incoming shared database and apply the desired RBAC onto these views (option D). This way, the administrator can control the access to the data based on the roles in their account, without modifying the original data or views from the partner.


NEW QUESTION # 31
For Snowflake network policies, what will occur when the account_level and user_level network policies are both defined?

  • A. A network policy error will be generated with no definitions provided.
  • B. The account_level policy will override the user_level policy.
  • C. The user_level policy will override the account_level policy.
  • D. The user_level network policies will not be supported.

Answer: C

Explanation:
Explanation
According to the Network Policies documentation, a network policy can be applied to an account, a security integration, or a user. If there are network policies applied to more than one of these, the most specific network policy overrides more general network policies. The following summarizes the order of precedence:
*Account: Network policies applied to an account are the most general network policies. They are overridden by network policies applied to a security integration or user.
*Security Integration: Network policies applied to a security integration override network policies applied to the account, but are overridden by a network policy applied to a user.
*User: Network policies applied to a user are the most specific network policies. They override both accounts and security integrations.
Therefore, if both the account_level and user_level network policies are defined, the user_level policy will take effect and the account_level policy will be ignored. The other options are incorrect because:
*The account_level policy will not override the user_level policy, as explained above.
*The user_level network policies will be supported, as they are part of the network policyfeature.
*A network policy error will not be generated, as there is no conflict between the account_level and user_level network policies.


NEW QUESTION # 32
What are benefits of creating and maintaining resource monitors in Snowflake? (Select THREE).

  • A. Resource monitors add no additional load to virtual warehouse compute.
  • B. Resource monitor governance is tightly controlled and monitors can only be created by the ACCOUNTADMIN role or users with the CREATE MONITOR privilege.
  • C. Resource monitors can be applied to more than one virtual warehouse.
  • D. The cost of running a resource monitor is only 10% of a credit, per day of operation.
  • E. Multiple resource monitors can be applied to a single virtual warehouse.
  • F. Multiple triggers can be configured across various virtual warehouse thresholds.

Answer: A,C,F

Explanation:
Explanation
According to the Snowflake documentation1, resource monitors are a feature that helps you manage and control Snowflake costs by monitoring and setting limits on your compute resources. Resource monitors do not consume any credits or add any load to the virtual warehouses they monitor1. Resource monitors can also have multiple triggers that specify different actions (such as suspending or notifying) when certain percentages of the credit quota are reached2. Resource monitors can be applied to either the entire account or a specific set of individual warehouses1. The other options are not benefits of resource monitors. The cost of running a resource monitor is negligible, not 10% of a credit3. Multiple resource monitors cannot be applied to a single virtual warehouse; only one resource monitor can be assigned to a warehouse at a time2. Resource monitor governance is not tightly controlled; account administrators can enable users with other roles to view and modify resource monitors using SQL2.


NEW QUESTION # 33
What roles can be used to create network policies within Snowflake accounts? (Select THREE).

  • A. ORGADMIN
  • B. ACCOUNTADMIN
  • C. Any role with the global permission of CREATE NETWORK POLICY
  • D. SECURITYADMIN
  • E. SYSADMIN
  • F. Any role that owns the database where the network policy is created

Answer: B,C,D

Explanation:
Explanation
Network policies are used to restrict access to the Snowflake service and internal stages based on user IP address1. To create network policies, a role must have the global permission of CREATE NETWORK POLICY2. By default, the system-defined roles of SECURITYADMIN and ACCOUNTADMIN have this permission3. However, any other role can be granted this permission by an administrator4. Therefore, the answer is B, C, and E. The other options are incorrect because SYSADMIN and ORGADMIN do not have the CREATE NETWORK POLICY permission by default3, and network policies are not tied to specific databases5.


NEW QUESTION # 34
A Snowflake Administrator wants to create a virtual warehouse that supports several dashboards, issuing various queries on the same database.
For this warehouse, why should the Administrator consider setting AUTO_SUSPEND to 0 or NULL?

  • A. To save costs on warehouse shutdowns and startups for different queries
  • B. To keep the query result cache warm for good performance on repeated queries
  • C. To save costs by running the warehouse as little as possible
  • D. To keep the data cache warm to support good performance of similar queries

Answer: D

Explanation:
Explanation
According to the Snowflake documentation1, the AUTO_SUSPEND property specifies the number of seconds of inactivity after which a warehouse is automatically suspended. If the property is set to 0 or NULL, the warehouse never suspends automatically. For a warehouse that supports several dashboards, issuing various queries on the same database, setting AUTO_SUSPEND to 0 or NULL can help to keep the data cache warm, which means that the data used by the queries is already loaded into the warehouse memory and does not need to be fetched from the storage layer. This can improve the performance of similar queries that access the same data. Option A is incorrect because setting AUTO_SUSPEND to 0 or NULL does not save costs on warehouse shutdowns and startups, but rather increases the costs by keeping the warehouse running continuously. Option B is incorrect because setting AUTO_SUSPEND to 0 or NULL does not run the warehouse as little as possible, but rather runs the warehouse as much as possible. Option D is incorrect because setting AUTO_SUSPEND to 0 or NULL does not affect the query result cache, which is a separate cache that stores the results of previous queries for a period of time. The query result cache is not dependent on the warehouse state, but on the query criteria2.


NEW QUESTION # 35
A virtual warehouse report_wh is configured with AUTO_RESUME=TRUE and AUTO_SUSPEND=300. A user has been granted the role accountant.
An application with the accountant role should use this warehouse to run financial reports, and should keep track of compute credits used by the warehouse.
What minimal privileges on the warehouse should be granted to the role to meet the requirements for the application? (Select TWO).

  • A. MONITOR
  • B. OPERATE
  • C. USAGE
  • D. OWNERSHIP
  • E. MODIFY

Answer: A,C

Explanation:
Explanation
According to the Snowflake documentation1, the MONITOR privilege on a warehouse grants the ability to view the warehouse usage and performance metrics, such as the number of credits consumed, the average and maximum run time, and the number of queries executed. The USAGE privilege on a warehouse grants the ability to use the warehouse to execute queries and load data. Therefore, the minimal privileges on the warehouse that should be granted to the role to meet the requirements for the application are MONITOR and USAGE. Option A is incorrect because the OPERATE privilege on a warehouse grants the ability to start, stop, resume, and suspend the warehouse, which is not required for the application. Option B is incorrect because the MODIFY privilege on a warehouse grants the ability to alter the warehouse properties, such as the size, auto-suspend, and auto-resume settings, which is not required for the application. Option E is incorrect because the OWNERSHIP privilege on a warehouse grants the ability to drop the warehouse, grant or revoke privileges on the warehouse, and transfer the ownership to another role, which is not required for the application.


NEW QUESTION # 36
What access control policy will be put into place when future grants are assigned to both database and schema objects?

  • A. Database privileges will take precedence over schema privileges.
  • B. An access policy combining both the database object and the schema object will be used, with the most permissive policy taking precedence.
  • C. Schema privileges will take precedence over database privileges.
  • D. An access policy combining both the database object and the schema object will be used, with the most restrictive policy taking precedence.

Answer: C

Explanation:
Explanation
When future grants are defined on the same object type for a database and a schema in the same database, the schema-level grants take precedence over the database level grants, and the database level grants are ignored4.
This behavior applies to privileges on future objects granted to one role or different roles4. Future grants allow defining an initial set of privileges to grant on new (i.e. future) objects of a certain type in a database or a schema3. As soon as the new objects are created inside the database or schema, the predefined set of privileges are assigned to the object automatically without any manual intervention3.


NEW QUESTION # 37
A company has set up a new Snowflake account. An Identity Provider (IdP) has been configured for both Single Sign-On (SSO) and SCIM provisioning.
What maintenance is required to ensure that the SCIM provisioning process continues to operate without errors?

  • A. The IdP Administrator must issue a REFRESH transaction at least once every six months to synchronize all users and roles.
  • B. The IdP service account requires a new RSA key pair to be generated every six months.
  • C. The OAuth Bearer Tokens have a lifespan of six months and must be regenerated prior to expiration.
  • D. The Administrator must issue a POST RENEW call to the REST API at least once every six months.

Answer: C

Explanation:
Explanation
According to the Snowflake documentation1, the authentication process for SCIM provisioning uses an OAuth Bearer token and this token is valid for six months. Customers must keep track of their authentication token and can generate a new token on demand. If the token expires, the SCIM provisioning process will fail.
Therefore, the token must be regenerated before it expires. The other options are not required for SCIM provisioning.


NEW QUESTION # 38
A Snowflake Administrator needs to persist all virtual warehouse configurations for auditing and backups.
Given a table already exists with the following schema:
Table Name:VWH_META
Column 1:SNAPSHOT_TIME TIMESTAMP_NTZ
Column 2:CONFIG VARIANT
Which commands should be executed to persist the warehouse data at the time of execution in JSON format in the table VWH META?

  • A. 1. SHOW WAREHOUSES;
    2. INSERT INTO VWH META
    SELECT CURRENT TIMESTAMP (), *
    FROM TABLE (RESULT_SCAN (LAST_QUERY_ID ())) ;
  • B. 1. SHOW WAREHOUSES;
    2. INSERT INTO VWH_META
    SELECT CURRENT_TIMESTAMP (),
    OBJECT CONSTRUCT (*)
    FROM TABLE (RESULT_SCAN (LAST_QUERY_ID ()));
  • C. 1. SHOW WAREHOUSES;
    2. INSERT INTO VWH META
    SELECT CURRENT TIMESTAMP (),
    FROM TABLE (RESULT_SCAN (LAST_QUERY_ID(1) ) ) ;
  • D. 1. SHOW WAREHOUSES;
    2. INSERT INTO VWH META
    SELECT CURRENT TIMESTAMP (), *
    FROM TABLE (RESULT_SCAN (SELECT
    LAST QUERY ID(-1)));

Answer: B

Explanation:
Explanation
According to the Using Persisted Query Results documentation, the RESULT_SCAN function allows you to query the result set of a previous command as if it were a table. The LAST_QUERY_ID function returns the query ID of the most recent statement executed in the current session. Therefore, the combination of these two functions can be used to access the output of the SHOW WAREHOUSES command, which returns the configurations of all the virtual warehouses in the account. However, to persist the warehouse data in JSON format in the table VWH_META, the OBJECT_CONSTRUCT function is needed to convert the output of the SHOW WAREHOUSES command into a VARIANT column. The OBJECT_CONSTRUCT function takes a list of key-value pairs and returns a single JSON object. Therefore, the correct commands to execute are:
1.SHOW WAREHOUSES;
2.INSERT INTO VWH_META SELECT CURRENT_TIMESTAMP (), OBJECT_CONSTRUCT (*) FROM TABLE (RESULT_SCAN (LAST_QUERY_ID ())); The other options are incorrect because:
*A. This option does not use the OBJECT_CONSTRUCT function, so it will not persist the warehouse data in JSON format. Also, it is missing the * symbol in the SELECT clause, so it will not select any columns from the result set of the SHOW WAREHOUSES command.
*B. This option does not use the OBJECT_CONSTRUCT function, so it will not persist the warehouse data in JSON format. It will also try to insert multiple columns into a single VARIANT column, which will cause a type mismatch error.
*D. This option does not use the OBJECT_CONSTRUCT function, so it will not persist the warehouse data in JSON format. It will also try to use the RESULT_SCAN function on a subquery, which is not supported. The RESULT_SCAN function can only be used on a query ID or a table name.


NEW QUESTION # 39
A Snowflake Administrator needs to set up Time Travel for a presentation area that includes facts and dimensions tables, and receives a lot of meaningless and erroneous loT data. Time Travel is being used as a component of the company's data quality process in which the ingestion pipeline should revert to a known quality data state if any anomalies are detected in the latest load. Data from the past 30 days may have to be retrieved because of latencies in the data acquisition process.
According to best practices, how should these requirements be met? (Select TWO).

  • A. The fact and dimension tables should be cloned together using the same Time Travel options to reduce potential referential integrity issues with the restored data.
  • B. Related data should not be placed together in the same schema. Facts and dimension tables should each have their own schemas.
  • C. The fact and dimension tables should have the same DATA_RETENTION_TIME_IN_ DAYS.
  • D. Only TRANSIENT tables should be used to ensure referential integrity between the fact and dimension tables.
  • E. The DATA_RETENTION_TIME_IN_DAYS should be kept at the account level and never used for lower level containers (databases and schemas).

Answer: A,C

Explanation:
Explanation
According to the Understanding & Using Time Travel documentation, Time Travel is a feature that allows you to query, clone, and restore historical data in tables, schemas, and databases for up to 90 days. To meet the requirements of the scenario, the following best practices should be followed:
*The fact and dimension tables should have the same DATA_RETENTION_TIME_IN_DAYS. This parameter specifies the number of days for which the historical data is preserved and can be accessed by Time Travel. To ensure that the fact and dimension tables can be reverted to a consistent state in case of any anomalies in the latest load, they should have the same retention period. Otherwise, some tables may lose their historical data before others, resulting in data inconsistency and quality issues.
*The fact and dimension tables should be cloned together using the same Time Travel options to reduce potential referential integrity issues with the restored data. Cloning is a way of creating a copy of an object (table, schema, or database) at a specific point in time using Time Travel. To ensure that the fact and dimension tables are cloned with the same data set, they should be cloned together using the same AT or BEFORE clause. This will avoid any referential integrity issues that may arise from cloning tables at different points in time.
The other options are incorrect because:
*Related data should not be placed together in the same schema. Facts and dimension tables should each have their own schemas. This is not a best practice for Time Travel, as it does not affect the ability to query, clone, or restore historical data. However, it may be a good practice for data modeling and organization, depending on the use case and design principles.
*The DATA_RETENTION_TIME_IN_DAYS should be kept at the account level and never used for lower level containers (databases and schemas). This is not a best practice for Time Travel,as it limits the flexibility and granularity of setting the retention period for different objects. The retention period can be set at the account, database, schema, or table level, and the most specific setting overrides the more general ones. This allows for customizing the retention period based on the data needs and characteristics of each object.
*Only TRANSIENT tables should be used to ensure referential integrity between the fact and dimension tables. This is not a best practice for Time Travel, as it does not affect the referential integrity between the tables. Transient tables are tables that do not have a Fail-safe period, which means that they cannot be recovered by Snowflake after the retention period ends. However, they still support Time Travel within the retention period, and can be queried, cloned, and restored like permanent tables. The choice of table type depends on the data durability and availability requirements, not on the referential integrity.


NEW QUESTION # 40
What are characteristics of data replication in Snowflake? (Select THREE).

  • A. Users can have unlimited primary databases and they can be replicated to an unlimited number of accounts if all accounts are within the same organization.
  • B. Replication can only occur within the same cloud provider.
  • C. The ALTER DATABASE ... ENABLE REPLICATION TO ACCOUNTS command must be issued from the primary account.
  • D. Databases created from shares can be replicated.
  • E. Users must be granted REPLICATIONADMIN privileges in order to enable replication.
  • F. To start replication run the ALTER DATABASE ... REFRESH command on the account where the secondary database resides.

Answer: A,C,D

Explanation:
Explanation
*Option A is correct because the ALTER DATABASE ... ENABLE REPLICATION TO ACCOUNTS command must be issued from the primary account that owns the database to be replicated1.
*Option B is incorrect because users must be granted REPLICATIONGRANTER privileges in order to enable replication1.
*Option C is incorrect because to start replication, the ALTER DATABASE ... REFRESH command must be run on the primary database, not the secondary database1.
*Option D is incorrect because replication can occur across different cloud providers, as well as across regions2.
*Option E is correct because databases created from shares can be replicated, as long as the share is active and the database is not dropped or altered1.
*Option F is correct because users can have unlimited primary databases and they can be replicated to an unlimited number of accounts if all accounts are within the same organization1.


NEW QUESTION # 41
What are benefits of using Snowflake organizations? (Select TWO).

  • A. Administrators can simplify data movement across all accounts within the organization.
  • B. Administrators can monitor and understand usage across all accounts in the organization.
  • C. Administrators have the ability to create accounts in any available cloud provider or region.
  • D. User administration is simplified across all accounts within the organization.
  • E. Administrators can change Snowflake account editions on-demand based on need.

Answer: B,C

Explanation:
Explanation
According to the Snowflake documentation1, organizations are a feature that allows linking the accounts owned by a business entity, simplifying account management and billing, replication and failover, data sharing, and other account administration tasks. Some of the benefits of using organizations are:
*Administrators can monitor and understand usage across all accounts in the organization using the ORGANIZATION_USAGE schema, which provides historical usage data for all accounts in the organization via views in a shared database named SNOWFLAKE2. This can help to optimize costs and performance across the organization.
*Administrators have the ability to create accounts in any available cloud provider or region using the CREATE ACCOUNT command, which allows specifying the cloud platform and region for the new account3.
This can help to meet the business needs and compliance requirements of the organization.
Option A is incorrect because administrators cannot change Snowflake account editions on-demand based on need, but rather have to contact Snowflake Support to request an edition change4. Option C is incorrect because administrators cannot simplify data movement across all accounts within the organization, but rather have to enable account database replication for both the source and target accounts, and use the ALTER DATABASE ... ENABLE REPLICATION TO ACCOUNTS command to promote a local database to serve as the primary database and enable replication to the target accounts5. Option D is incorrect because user administration is not simplified across all accounts within the organization, but rather requires creating and managing users, roles, and privileges for each account separately, unless using a federated authentication method such as SSO or SCIM.


NEW QUESTION # 42
A Snowflake account is configured with SCIM provisioning for user accounts and has bi-directional synchronization for user identities. An Administrator with access to SECURITYADMIN uses the Snowflake UI to create a user by issuing the following commands:
use role USERADMIN;
create or replace role DEVELOPER_ROLE;
create user PTORRES PASSWORD = 'hello world!' MUST_CHANGE_PASSWORD = FALSE default_role = DEVELOPER_ROLE; The new user named PTORRES successfully logs in, but sees a default role of PUBLIC in the web UI. When attempted, the following command fails:
use DEVELOPER_ROLE;
Why does this command fail?

  • A. The new role will only take effect once the identity provider has synchronized by way of SCIM with the Snowflake account.
  • B. USERADMIN needs to explicitly grant the DEVELOPER_ROLE to the new USER.
  • C. The DEVELOPER_ROLE needs to be granted to SYSADMIN before user PTORRES will be able to use the role.
  • D. The new role can only take effect after USERADMIN has logged out.

Answer: B

Explanation:
Explanation
According to the Snowflake documentation1, creating a user with a default role does not automatically grant that role to the user. The user must be explicitly granted the role by the role owner or a higher-level role.
Therefore, the USERADMIN role, which created the DEVELOPER_ROLE, needs to explicitly grant the DEVELOPER_ROLE to the new user PTORRES using the GRANT ROLE command. Otherwise, the user PTORRES will not be able to use the DEVELOPER_ROLE and will see the default role of PUBLIC in the web UI. Option A is incorrect because the DEVELOPER_ROLE does not need to be granted to SYSADMIN before user PTORRES can use the role. Option B is incorrect because the new role can take effect immediately after it is created and granted to the user, and does not depend on the USERADMIN role logging out. Option D is incorrect because the new role will not be affected by the identity provider synchronization, as it is created and managed in Snowflake.


NEW QUESTION # 43
An Administrator has been asked to support the company's application team need to build a loyalty program for its customers. The customer table contains Personal Identifiable Information (PII), and the application team's role is DEVELOPER.
CREATE TABLE customer_data (
customer_first_name string,
customer_last_name string,
customer_address string,
customer_email string,
... some other columns,
);
The application team would like to access the customer data, but the email field must be obfuscated.
How can the Administrator protect the sensitive information, while maintaining the usability of the data?

  • A. Use the CURRENT_ROLE context function to integrate with a masking policy on the fields that contain sensitive data.
  • B. Use the CURRENT_ROLE and CURRENT_USER context functions to integrate with a secure view and filter the sensitive data.
  • C. Create a view on the customer_data table to eliminate the email column by omitting it from the SELECT clause. Grant the role DEVELOPER access to the view.
  • D. Create a separate table for all the non-Pll columns and grant the role DEVELOPER access to the new table.

Answer: A


NEW QUESTION # 44
An Administrator has a user who needs to be able to suspend and resume a task based on the current virtual warehouse load, but this user should not be able to modify the task or start a new run.
What privileges should be granted to the user to meet these requirements? (Select TWO).

  • A. USAGE on the database and schema containing the task
  • B. OWNERSHIP on the database and schema containing the task
  • C. OWNERSHIP on the task
  • D. EXECUTE TASK on the task
  • E. OPERATE on the task

Answer: A,E


NEW QUESTION # 45
A Snowflake organization MYORG consists of two Snowflake accounts:

The ACCOUNT1 has a database PROD_DB and the ORGADMIN role enabled.
Management wants to have the PROD_DB database replicated to ACCOUNT2.
Are there any necessary configuration steps in ACCOUNT1 before the database replication can be configured and initiated in ACCOUNT2?

  • A. No configuration steps are necessary in ACCOUNT1. Replicating databases across accounts within the same Snowflake organization is enabled by default.
  • B. USE ROLE ORGADMIN;
    SELECT SYSTEMSGLOBAL ACCOUNT SET_PARAMETER ( 'MYORG. ACCOUNT1',
    'ENABLE_ACCOUNT_DATABASE_REPLICATION', 'TRUE');
    USE ROLE ACCOUNTADMIN;
    ALTER DATABASE PROD_DB ENABLE REPLICATION TO ACCOUNTS MYORG. ACCOUNT2
    IGNORE EDITION CHECK;
  • C. It is not possible to replicate a database from an Enterprise edition Snowflake account to a Standard edition Snowflake account.
  • D. USE ROLE ORGADMIN;
    SELECT SYSTEMSGLOBAL_ACCOUNT_SET_PARAMETER ('MYORG. ACCOUNT1',
    'ENABLE_ACCOUNT_DATABASE_REPLICATION', 'TRUE');
    SELECT SYSTEMSGLOBAL_ACCOUNT_SET_PARAMETER ('MYORG. ACCOUNT2',
    'ENABLE_ACCOUNT_DATABASE_REPLICATION', 'TRUE');
    USE ROLE ACCOUNTADMIN;
    ALTER DATABASE PROD DB ENABLE REPLICATION TO ACCOUNTS MYORG. ACCOUNT2;

Answer: B

Explanation:
Explanation
According to the Snowflake documentation1, database replication across accounts within the same organization requires the following steps:
*Link the accounts in the organization using the ORGADMIN role.
*Enable account database replication for both the source and target accounts using the SYSTEM$GLOBAL_ACCOUNT_SET_PARAMETER function.
*Promote a local database to serve as the primary database and enable replication to the target accounts using the ALTER DATABASE ... ENABLE REPLICATION TO ACCOUNTS command.
*Create a secondary database in the target account using the CREATE DATABASE ... FROM SHARE command.
*Refresh the secondary database periodically using the ALTER DATABASE ... REFRESH command.
Option A is incorrect because it does not include the step of creating a secondary database in the target account. Option C is incorrect because replicating databases across accounts within the same organization is not enabled by default, but requires enabling account database replication for both the source and target accounts. Option D is incorrect because it is possible to replicate a database from an Enterprise edition Snowflake account to a Standard edition Snowflake account, as long as the IGNORE EDITION CHECK option is used in the ALTER DATABASE ... ENABLE REPLICATION TO ACCOUNTS command2.
Option B is correct because it includes all the necessary configuration steps in ACCOUNT1, except for creating a secondary database in ACCOUNT2, which can be done after the replication is enabled.


NEW QUESTION # 46
When adding secure views to a share in Snowflake, which function is needed to authorize users from another account to access rows in a base table?

  • A. CURRENT_CLIENT
  • B. CURRENT_ROLE
  • C. CURRENT ACCOUNT
  • D. CURRENT_USER

Answer: D

Explanation:
Explanation
According to the Working with Secure Views documentation, secure views are designed to limit access to sensitive data that should not be exposed to all users of the underlying table(s). When sharing secure views with another account, the view definition must include a function that returns the identity of the user who is querying the view, such as CURRENT_USER, CURRENT_ROLE, or CURRENT_ACCOUNT. These functions can be used to filter the rows in the base table based on the user's identity. For example, a secure view can use the CURRENT_USER function to compare the user name with a column in the base table that contains the authorized user names. Only the rows that match the user name will be returned by the view. The CURRENT_CLIENT function is not suitable for this purpose, because it returns the IP address of the client that is connected to Snowflake, which is not related to the user's identity.


NEW QUESTION # 47
What is a characteristic of Snowflake's transaction locking and concurrency modeling?

  • A. Transaction locking in Snowflake is enforced exclusively at the row and table levels.
  • B. If two queries are concurrently executed against the same table, one of the two queries will be blocked until the other query completes.
  • C. A deadlock cannot occur in Snowflake, since concurrently executed queries and DML statements do not block one another.
  • D. Queries executed within a given transaction see that transaction's uncommitted changes.

Answer: C

Explanation:
Explanation
According to the Snowflake documentation1, Snowflake uses a multi-version concurrency control (MVCC) model, which means that each transaction operates on a consistent snapshot of the database at a point in time.
This allows queries and DML statements to run concurrently without blocking each other, as they do not modify the same data. Therefore, a deadlock, which occurs when concurrent transactions are waiting on resources that are locked by each other, cannot happen in Snowflake. Option B is incorrect because queries and DML statements do not block each other in Snowflake, unless they are explicitly started transactions and multiple statements in each transaction2. Option C is incorrect because transaction locking in Snowflake is enforced at the partition level, not the row or table level3. Option D is incorrect because queries executed within a given transaction do not see that transaction's uncommitted changes, but only the committed changes that occurred before the transaction started1.


NEW QUESTION # 48
If the query matches the definition, will Snowflake always dynamically rewrite the query to use a materialized view?

  • A. Yes, because materialized views are always faster.
  • B. No, because the optimizer might decide against it.
  • C. No, because the materialized view may not be up-to-date.
  • D. No, because joins are not supported by materialized views.

Answer: B

Explanation:
Explanation
Snowflake's query optimizer can automatically rewrite queries against the base table or regular views to use the materialized view instead, if the query matches the definition of the materialized view1. However, this is not always guaranteed, as the optimizer might decide against using the materialized view based on various factors, such as the freshness of the data, the size of the result set, the complexity of the query, and the availability of the materialized view2. Therefore, the answer is no, because the optimizer might decide against it.


NEW QUESTION # 49
Which masking policy will mask a column whenever it is queried through a view owned by a role named MASKED_VIEW_ROLE?

  • A. create or replace masking policy maskstring as (val string) returns string -> case when is_role_in_session ('MASKED_VIEW_ROLE') then ' ** else val end;
    *,
  • B. create or replace masking policy maskString as (val string) returns string -> case when array_contains ('MASKED_VIEW_ROLE' :: variant, parse_json (current_available_roles ())) then
    '*
    else val
    end;
    ** '
  • C. create or replace masking policy maskString as (val string) returns string -> case when current_role() in ('MASKED_VIEW_ROLE') then ' ********* ' else val end;
  • D. create or replace masking policy maskstring as (val string) returns string -> case when invoker_role() in ('MASKED_VIEW_ROLE') then else val end;
    ' **

Answer: A

Explanation:
Explanation
A masking policy is a SQL expression that transforms the data in a column based on the role that queries the column1. The is_role_in_session function returns true if the specified role is in the current session2. Therefore, the masking policy in option A will mask the column data with asterisks whenever it is queried through a view owned by the MASKED_VIEW_ROLE3. The other options use different functions that do not check the ownership of the view, but rather the current role, the invoker role, or the available roles in the session45.
These functions may not return the desired result if the role that owns the view is different from the role that queries the view.


NEW QUESTION # 50
A Snowflake Administrator created a role ROLE_MANAGED_ACCESS and a schema SCHEMA_MANAGED_ACCESS as follows:
USE ROLE SECURITYADMIN;
CREATE ROLE ROLE_MANAGED_ACCESS;
GRANT ROLE ROLE_MANAGED_ACCESS TO ROLE SYSADMIN;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE ROLE_MANAGED_ACCESS;
GRANT ALL privileges ON DATABASE WORK TO ROLE ROLE_MANAGED_ACCESS;
USE ROLE ROLE_MANAGED_ACCESS;
CREATE SCHEMA SCHEMA_MANAGED_ACCESS WITH MANAGED ACCESS;
USE ROLE SECURITYADMIN;
GRANT SELECT, INSERT ON FUTURE TABLES IN SCHEMA SCHEMA MANAGED ACCESS to ROLE_MANAGED_ACCESS; The Administrator now wants to disable the managed access on the schema.
How can this be accomplished?

  • A. REVOKE SELECT, INSERT ON FUTURE TABLES IN SCHEMA SCHEMA_MANAGED_ACCESS FROM ROLE_MANAGED_ACCESS; ALTER SCHEMA SCHEMA MANAGED ACCESS DISABLE MANAGED ACCESS;
  • B. ALTER SCHEMA SCHEMA MANAGED ACCESS DISABLE MANAGED ACCESS;
  • C. USE ROLE ROLE MANAGED_ACCESS;
    DROP SCHEMA WORK. SCHEMA_MANAGED_ACCESS;
    CREATE SCHEMA SCHEMA_MANAGED_ACCESS;
    Then recreate all needed objects.
  • D. USE ROLE ROLE_MANAGED_ACCESS;
    DROP SCHEMA WORK. SCHEMA MANAGED_ACCESS;
    CREATE SCHEMA SCHEMA_MANAGED_ACCESS WITHOUT MANAGED ACCESS;
    Then recreate all needed objects.

Answer: B

Explanation:
Explanation
According to the Snowflake documentation1, you can change a managed access schema to a regular schema using the ALTER SCHEMA statement with the DISABLE MANAGED ACCESS keywords. This will disable the managed access feature on the schema and revert the access control to the default behavior. Option B is incorrect because dropping and recreating the schema will also delete all the objects and metadata in the schema, which is not necessary to disable the managed access. Option C is incorrect because revoking the privileges on the future tables from the role is not required to disable the managed access. Option D is incorrect because there is no WITHOUT MANAGED ACCESS option in the CREATE SCHEMA statement.


NEW QUESTION # 51
A user with the proper role issues the following commands when setting up and activating network policies:
CREATE OR REPLACE NETWORK POLICY foo_policy
ALLOWED_IP_LIST = ( '1.1.1.0/24', '2.2.2.0/24' , '3.3. 3. 0/24' )
BLOCKED IP LIST = ( '1.1.1.1')
COMMENT = 'Account level policy';
ALTER ACCOUNT SET NETWORK_POLICY=FOO_POLICY;
CREATE OR REPLACE NETWORK POLICY bar_policy
ALLOWED_IP_LIST = ('3.3.3.0/24')
BLOCKED IP LIST = ('3.3.3.10')
COMMENT = 'user level policy';
ALTER USER userl SET NETWORK_POLICY=BAR_POLICY;
Afterwards, user1 attempts to log in to Snowflake from IP address 3.3.3.10.
Will the login be successful?

  • A. No, because 3.3.3.10 is found in the BLOCKED_IP_LIST of bar_policy.
  • B. Yes, because 3.3.3.10 is found in the ALLOWED_IP_LIST of bar_policy.
  • C. Yes, because 3.3.3.10 is found in the ALLOWED_IP_LIST of foo_policy.
  • D. No, because 3.3.3.10 is not found in the ALLOWED_IP_LIST of foo_policy.

Answer: A

Explanation:
Explanation
According to the Snowflake documentation1, network policies are a feature that allows restricting access to your account based on user IP address. A network policy can be applied to an account, a user, or a security integration, and can specify a list of allowed IP addresses and a list of blocked IP addresses. If there are network policies applied to more than one of these, the most specific network policy overrides more general network policies. In this case, the user1 has a network policy (bar_policy) applied to them, which overrides the account-level network policy (foo_policy). The bar_policy allows access only from the IP range 3.3.3.0/24, and blocks access from the IP address 3.3.3.10. Therefore, the user1 will not be able to log in to Snowflake from IP address 3.3.3.10, as it is found in the BLOCKED_IP_LIST of bar_policy. Option A is incorrect because the ALLOWED_IP_LIST of bar_policy does not override the BLOCKED_IP_LIST of bar_policy.
Option C is incorrect because the ALLOWED_IP_LIST of foo_policy does not apply to user1, as it is overridden by the user-level network policy. Option D is incorrect because the ALLOWED_IP_LIST of foo_policy does not matter, as it is overridden by the user-level network policy.


NEW QUESTION # 52
A team is provisioning new lower environments from the production database using cloning. All production objects and references reside in the database, and do not have external references.
What set of object references needs to be re-pointed before granting access for usage?

  • A. Sequences, views, and secure views
  • B. Sequences, views, secure views, and materialized views
  • C. There are no object references that need to be re-pointed
  • D. Sequences, storage integrations, views, secure views, and materialized views

Answer: D

Explanation:
Explanation
According to the Snowflake documentation1, when an object in a schema is cloned, any future grants defined for this object type in the schema are applied to the cloned object unless the COPY GRANTS option is specified in the CREATE statement for the clone operation. However, some objects may still reference the source object or external objects after cloning, which may cause issues with access or functionality. These objects include:
*Sequences: If a table column references a sequence that generates default values, the cloned table may reference the source or cloned sequence, depending on where the sequence is defined. To avoid conflicts, the sequence reference should be re-pointed to the desired sequence using the ALTER TABLE command2.
*Storage integrations: If a stage or a table references a storage integration, the cloned object may still reference the source storage integration, which may not be accessible or valid in the new environment. To avoid errors, the storage integration reference should be re-pointed to the desired storage integration using the ALTER STAGE or ALTER TABLE command34.
*Views, secure views, and materialized views: If a view references another view or table, the cloned view may still reference the source object, which may not be accessible or valid in the new environment. To avoid errors, the view reference should be re-pointed to the desired object using the CREATE OR REPLACE VIEW command5.
1: Cloning Considerations | Snowflake Documentation 2: [ALTER TABLE | Snowflake Documentation] 3:
[ALTER STAGE | Snowflake Documentation] 4: [ALTER TABLE | Snowflake Documentation] 5: [CREATE VIEW | Snowflake Documentation]


NEW QUESTION # 53
......

Online Questions - Outstanding Practice To your ADA-C01 Exam: https://itexams.lead2passed.com/Snowflake/ADA-C01-practice-exam-dumps.html

Related Articles

more
Snowflake ADA-C01 Certification Practice Exam