Snowflake SnowPro Specialty - Native Apps Sample Questions:

1. You are designing a Snowflake Native App that interacts with sensitive customer dat a. You need to ensure that the application only accesses the data it absolutely needs and adheres to the principle of least privilege. Which of the following strategies are crucial for maintaining data security within your application?

A) Create specific roles with granular access privileges (e.g., 'SELECT on specific columns) and grant these roles to the application's managed service account.
B) Grant the application role the 'OWNERSHIP' privilege on all tables containing customer data.
C) Store sensitive customer data directly within the application package to avoid external access.
D) Implement data masking policies to redact sensitive information before it's accessed by the application.
E) Utilize Snowflake's secure UDFs with invoker's rights to perform data transformations and access control based on the user's role.

2. You are developing a Snowflake Native Application and need to track changes made to the application code across different versions. You want to leverage Snowflake's built-in capabilities for version control and auditing. Which of the following approaches is the MOST suitable and efficient for achieving this?

A) Use Snowflake's Streams feature to capture changes made to application code objects and store them in a separate change table for auditing.
B) Manually maintain a change log in a separate Snowflake table, documenting each code modification with associated version numbers and timestamps.
C) Integrate with an external version control system (e.g., Git) and store application code and deployment scripts in the repository. Use CI/CD pipelines to manage deployments to Snowflake.
D) Utilize Snowflake's Information Schema views (e.g., 'INFORMATION_SCHEMA.PROCEDURES, 'INFORMATION SCHEMA.FUNCTIONS) in conjunction with Time Travel to query historical metadata and code definitions.
E) Use Snowflake's Time Travel feature to query historical versions of application code objects (e.g., stored procedures, UDFs) and compare differences between versions.

3. You are developing a Snowflake Native Application that leverages user-defined functions (UDFs) and stored procedures. During the security scanning process before listing on the Snowflake Marketplace, you encounter a 'Failed to Detect Secrets' error. After investigation, you determine that the error stems from hardcoded API keys within a Python UDF that are being used to interact with a third-party service. Which of the following strategies would be MOST effective and secure to resolve this issue and pass the security scan?

A) Replace the hardcoded API keys with references to Snowflake secrets and grant the necessary privileges to the application role. Access the secrets within the UDF using the 'SYSTEM$GET SECRET function.
B) Obfuscate the API keys within the Python UDF using a string manipulation technique. This will make it harder for unauthorized users to discover the keys.
C) Store the API keys in a separate, secured table within the application's data container and access them dynamically within the Python UDF using SQL queries.
D) Remove the Python UDF entirely and rewrite the logic in SQL stored procedures. Store the API keys as environment variables within the stored procedure's definition.
E) Encrypt the API keys within the Python UDF using a symmetric encryption algorithm and store the encryption key in a secure string within the application package.

4. A Snowflake Native Application developer, Bob, is using Snowsight to manage access to the application. He has created a custom role, , and wants to grant this role the ability to grant and revoke privileges on all objects within the application's schema, app_data'. Which of the following Snowsight actions (or sequence of actions) is the MOST effective and secure way to achieve this?
(Assume Bob is logged in as a user with 'ACCOUNTADMIN' role).

A) Grant the the 'APPLY MASKING POLICY privilege globally at the account level using Snowsight.
B) In Snowsight, write and execute the following SQL command:
C) Within Snowsight, navigate to the 'app_data' schema, select 'Grant Privileges', and grant the 'OWNERSHIP' privilege to the .
D) Within Snowsight, navigate to the application database, select 'Grant Privileges', and grant the 'USAGE' privilege to the .
E) Within Snowsight, navigate to the 'app_data' schema, select 'Grant Privileges', grant the 'USAGE privilege to the and then individually grant 'SELECT, 'INSERT, 'UPDATE' , and "DELETE privileges on each table and view within the schema.

5. A consumer installs a Snowflake Native App that collects usage statistics. The app uses an internal stage to store temporary data before aggregating it and sending it to the provider. The consumer notices that the internal stage is consuming a significant amount of storage and wants to understand if they are being charged for this storage. As a consumer, what level of visibility and control do you have over the storage costs associated with the internal stage created and managed by the installed Snowflake Native App?

A) The consumer has no visibility into the stage's storage consumption or control over its lifecycle. All costs are borne by the application provider.
B) The consumer can view the overall storage consumption of the application but cannot differentiate between the internal stage and other data stored by the application.
C) The consumer has full visibility into the stage's storage consumption through the Snowflake web interface and can directly manage the stage's lifecycle to control costs.
D) The consumer is billed for the storage used by the internal stage, but they have no direct visibility into its usage or control over its lifecycle. The provider manages the stage's lifecycle.
E) The consumer can only see the stage's metadata but cannot see the data residing in it.

Solutions: