A company is designing its serving layer for data that is in cloud storage. Multiple terabytes of the data will be used for reporting. Some data does not have a clear use case but could be useful for experimental analysis. This experimentation data changes frequently and is sometimes wiped out and replaced completely in a few days. The company wants to centralize access control, provide a single point of connection for the end-users, and maintain data governance. What solution meets these requirements while MINIMIZING costs, administrative effort, and development overhead?
Correct Answer: A
The most cost-effective and administratively efficient solution is to use a combination of native and external tables. Native tables for reporting data ensure performance and governance, while external tables allow for flexibility with frequently changing experimental data. Creating roles with specific grants to datasets aligns with the principle of least privilege, centralizing access control and simplifying user management12. Reference * Snowflake Documentation on Optimizing Cost1. * Snowflake Documentation on Controlling Cost2.
Question 202
What Snowflake features should be leveraged when modeling using Data Vault?
Correct Answer: B
Question 203
A new user user_01 is created within Snowflake. The following two commands are executed: Command 1-> show grants to user user_01; Command 2 ~> show grants on user user 01; What inferences can be made about these commands?
Correct Answer: D
The SHOW GRANTS command in Snowflake can be used to list all the access control privileges that have been explicitly granted to roles, users, and shares. The syntax and the output of the command vary depending on the object type and the grantee type specified in the command1. In this question, the two commands have the following meanings: Command 1: show grants to user user_01; This command lists all the roles granted to the user user_01. The output includes the role name, the grantee name, and the granted by role name for each grant. This command is equivalent to show grants to user current_user if user_01 is the current user1. Command 2: show grants on user user_01; This command lists all the privileges that have been granted on the user object user_01. The output includes the privilege name, the grantee name, and the granted by role name for each grant. This command shows which role owns the user object user_01, as the owner role has the privilege to modify or drop the user object2. Therefore, the correct inference is that command 1 defines all the grants which are given to user_01, and command 2 defines which role owns user_01. Reference: SHOW GRANTS Understanding Access Control in Snowflake
Question 204
A company's client application supports multiple authentication methods, and is using Okta. What is the best practice recommendation for the order of priority when applications authenticate to Snowflake?
Correct Answer: A
* This is the best practice recommendation for the order of priority when applications authenticate to Snowflake, according to the Snowflake documentation and the web search results. Authentication is the process of verifying the identity of a user or application that connects to Snowflake. Snowflake supports multiple authentication methods, each with different advantages and disadvantages. The recommended order of priority is based on the following factors: * Security: The authentication method should provide a high level of security and protection against unauthorized access or data breaches. The authentication method should also support multi-factor authentication (MFA) or single sign-on (SSO) for additional security. * Convenience: The authentication method should provide a smooth and easy user experience, without * requiring complex or manual steps. The authentication method should also support seamless integration with external identity providers or applications. * Flexibility: The authentication method should provide a range of options and features to suit different use cases and scenarios. The authentication method should also support customization and configuration to meet specific requirements. Based on these factors, the recommended order of priority is: * OAuth (either Snowflake OAuth or External OAuth): OAuth is an open standard for authorization that allows applications to access Snowflake resources on behalf of a user, without exposing the user's credentials. OAuth provides a high level of security, convenience, and flexibility, as it supports MFA, SSO, token-based authentication, and various grant types and scopes. OAuth can be implemented using either Snowflake OAuth or External OAuth, depending on the identity provider and the application12. * External browser: External browser is an authentication method that allows users to log in to Snowflake using a web browser and an external identity provider, such as Okta, Azure AD, or Ping Identity. External browser provides a high level of security and convenience, as it supports MFA, SSO, and federated authentication. External browser also provides a consistent user interface and experience across different platforms and devices34. * Okta native authentication: Okta native authentication is an authentication method that allows users to log in to Snowflake using Okta as the identity provider, without using a web browser. Okta native authentication provides a high level of security and convenience, as it supports MFA, SSO, and federated authentication. Okta native authentication also provides a native user interface and experience for Okta users, and supports various Okta features, such as password policies and user management56. * Key Pair Authentication: Key Pair Authentication is an authentication method that allows users to log in to Snowflake using a public-private key pair, without using a password. Key Pair Authentication provides a high level of security, as it relies on asymmetric encryption and digital signatures. Key Pair Authentication also provides a flexible and customizable authentication option, as it supports various key formats, algorithms, and expiration times. Key Pair Authentication is mostly used for service account users, such as applications or scripts that connect to Snowflake programmatically7 . * Password: Password is the simplest and most basic authentication method that allows users to log in to Snowflake using a username and password. Password provides a low level of security, as it relies on symmetric encryption and is vulnerable to brute force attacks or phishing. Password also provides a low level of convenience and flexibility, as it requires manual input and management, and does not support MFA or SSO. Password is the least recommended authentication method, and should be used only as a last resort or for testing purposes . References: * Snowflake Documentation: Snowflake OAuth * Snowflake Documentation: External OAuth * Snowflake Documentation: External Browser Authentication * Snowflake Blog: How to Use External Browser Authentication with Snowflake * Snowflake Documentation: Okta Native Authentication * Snowflake Blog: How to Use Okta Native Authentication with Snowflake * Snowflake Documentation: Key Pair Authentication * [Snowflake Blog: How to Use Key Pair Authentication with Snowflake] * [Snowflake Documentation: Password Authentication] * [Snowflake Blog: How to Use Password Authentication with Snowflake]
Question 205
Which of the below operations are allowed on an inbound share data?
