SnowPro Advanced: Architect

A company is separating development, test, and production workloads in Snowflake. Security wants the strongest blast-radius reduction plus separate billing and administrative boundaries. Which design is best?

• AUse one account and isolate environments only with roles
• BCreate separate Snowflake accounts for each environment within the same organization
• CUse one account and separate environments with databases only
• DUse one account and separate environments with warehouses only

Which Snowflake account should organization administrators use to create or delete accounts and view organization-level usage across all member accounts?

• AAny member account with ACCOUNTADMIN
• BThe organization account with the GLOBALORGADMIN role
• CA reader account created by the provider
• DAny account that has imported the SNOWFLAKE shared database

A conglomerate has finance, marketing, and R&D teams with separate administrators, different regional residency requirements, and different cost centers. Leadership still wants a unified commercial relationship with Snowflake. Which architecture fits best?

• AUse one account and isolate each business unit with schemas
• BUse one organization with separate accounts per business unit and region
• CCreate separate organizations for each business unit and avoid shared governance
• DUse one Business Critical account and separate teams only with warehouses

Snowflake recommends that custom roles owning objects be arranged in which way?

• AGrant them directly only to users, never to roles
• BPlace the top-most custom role under SYSADMIN in the role hierarchy
• CGrant all object-owning roles directly to ACCOUNTADMIN only
• DModel all ownership using database roles only

A data platform wants domain engineers to create tables, but only a central security team should grant privileges on objects in a schema. Which design best supports that requirement?

• AUse a standard schema so each object owner controls its own grants
• BUse a managed access schema
• CUse a reader account for the domain engineers
• DUse a network policy on the schema owner role

Which Snowflake construct is best when you want least-privilege access scoped to one database and may later include those privileges in a share?

• AAccount role
• BDatabase role
• CWarehouse resource monitor
• DAuthentication policy

A login request comes from an IP address blocked by a network policy, but the authentication policy would otherwise allow the client and method. What happens?

• AThe authentication policy is evaluated first and access is allowed
• BThe network policy blocks the request before the authentication policy is applied
• CThe password policy decides whether the request is allowed
• DThe session policy overrides the block if the user recently authenticated

An account-level authentication policy allows passwords and SSO. A privileged service user also has a user-level authentication policy that allows only key-pair authentication. Which policy is enforced for that user?

• AThe account-level policy only
• BA union of the account-level and user-level policies
• CThe user-level policy
• DThe policy that was assigned first

An enterprise wants employees to sign in to Snowflake with its existing identity provider and also wants users and groups provisioned automatically. Which combination fits best?

• ALocal passwords plus manual role grants
• BSAML federation for SSO plus SCIM for provisioning
• CKey-pair authentication plus network policies
• DReader accounts plus secure shares

Okta is provisioning users and roles through SCIM, but updates stop syncing after administrators manually change ownership of the imported roles. What is the most likely cause?

• ASCIM in Snowflake supports users but not roles
• BThe SCIM provisioner role must own the imported users and roles
• CSCIM synchronization requires GLOBALORGADMIN
• DNetwork policies can block SCIM role updates only

Security wants CI/CD service accounts to avoid passwords and authenticate non-interactively to Snowflake. Which pattern is best?

• ANative password authentication with a long rotation window
• BKey-pair authentication for the service users
• CReader account credentials shared by the team
• DInteractive SAML login through a browser

You need to rotate a service user's key pair with no outage while clients gradually switch to the new private key. Which approach is correct?

• AReplace RSA_PUBLIC_KEY immediately and accept a short outage
• BSet RSA_PUBLIC_KEY_2, cut clients over, then remove the old key
• CCreate a second Snowflake user and merge query history later
• DUse SCIM to rotate the key automatically

A custom internal application needs delegated user access to Snowflake without storing Snowflake passwords in the application. Which authentication design is most appropriate?

• ALocal password authentication
• BSnowflake OAuth
• CReader account credentials
• DWarehouse-level network policies

An architect creates an authentication policy that allows only OAuth as an authentication method but also lists a SAML2 security integration as allowed. What is the main design problem?

• ASnowflake will silently fall back to password login
• BThe policy is conflicting because allowed methods and integrations must align
• CSAML2 integrations always override authentication policies
• DSnowflake OAuth can only be used with reader accounts

Which identifier can a Snowflake network rule use to allow inbound access over AWS private connectivity?

• AAWS VPC ID
• BAWS VPCE ID
• CAWS subnet ID
• DAWS route table ID

A bank requires traffic from its cloud network to Snowflake to stay off the public internet. Which option best matches that requirement?

• AAccount-level IP allowlisting only
• BAWS PrivateLink, Azure Private Link, or Google Private Service Connect
• CLarger warehouses with auto-suspend
• DKey-pair authentication

Your team already uses PrivateLink, but now wants to ensure a registered private endpoint can send traffic only to the Snowflake account that pinned it. What should you add?

• AA session policy
• BPinned private connectivity endpoints
• CDatabase roles
• DAutomatic clustering

After validating private connectivity, a company wants to disable public Snowflake service-endpoint access to its account. Which action best matches that goal?

• ACreate a warehouse resource monitor
• BCall SYSTEM$ENFORCE_PRIVATELINK_ACCESS_ONLY
• CGrant IMPORTED PRIVILEGES on the SNOWFLAKE database
• DRotate all user passwords

A security-sensitive external stage or external network access integration must reach cloud services without traversing the public internet. Which Snowflake capability should the architect use?

• ASecure views
• BOutbound private connectivity endpoints
• CReader accounts
• DSession policies

What does Tri-Secret Secure add to Snowflake's standard encryption model?

• AOnly larger warehouses for encrypted workloads
• BA dual-key model combining a Snowflake-managed key and a customer-managed key
• CClient-side encryption of every SQL result
• DA requirement to use reader accounts

An architect has registered a new customer-managed key for Tri-Secret Secure self-service and verified connectivity. What must happen before activating it?

• AActivate immediately to avoid key expiration
• BWait the required 72-hour period, then call SYSTEM$ACTIVATE_CMK_INFO
• COpen a support case to rotate the key manually
• DShare the account with a Business Critical consumer first

Your cloud KMS automatically rotated the backing version of the existing CMK used for Tri-Secret Secure. How should Snowflake be told to rekey with the latest version of that same CMK?

• ACreate a brand-new Snowflake account
• BCall SYSTEM$ACTIVATE_CMK_INFO with REKEY_SAME_CMK
• CDrop and recreate all encrypted tables
• DSwitch users to password authentication first

A company already has an active Tri-Secret Secure CMK and now wants private connectivity to the KMS endpoint without performing a data rekey. Which sequence is correct?

• AProvision the private endpoint, approve it, register the CMK for private connectivity, th…
• BDrop the CMK, create a new account, and reload the data
• CRun REKEY_SAME_CMK twice and wait 72 hours each time
• DAttach a network policy to the warehouse

The chief data governance team wants one place to analyze access history across every Snowflake account in the organization. What is the best source?

• AACCOUNT_USAGE.ACCESS_HISTORY in one member account
• BORGANIZATION_USAGE views in the organization account
• CINFORMATION_SCHEMA in each database only
• DThe READER_ACCOUNT_USAGE schema only

Which built-in view is commonly used to audit user access to objects within a Snowflake account?

• AACCOUNT_USAGE.ACCESS_HISTORY
• BINFORMATION_SCHEMA.TABLES
• CORGANIZATION_USAGE.ACCOUNTS
• DWAREHOUSE_LOAD_HISTORY

A platform team wants one governance pattern that automatically masks columns based on business tags instead of attaching separate masking policies to each column. What should they use?

• ANetwork rules
• BTag-based masking policies
• CReader accounts
• DWarehouse replication

Compliance requires discovering likely PII first and then applying consistent protection controls based on those findings. Which Snowflake capability combination best supports that design?

• AAuto-suspend plus multi-cluster warehouses
• BSensitive data classification with tags and policy-based controls
• CReader accounts with resource monitors
• DExternal functions with public internet access

A healthcare company uses a Business Critical account with Tri-Secret Secure for PHI, but it also needs to share de-identified data with external partners on non-Business Critical accounts. What is the best architectural approach?

• AShare PHI directly from the Business Critical account to any consumer
• BCreate a separate non-Business Critical account for the less sensitive dataset and share…
• CDowngrade the healthcare account to Enterprise Edition
• DUse reader accounts so edition no longer matters

Which statement about Snowflake Secure Data Sharing is correct?

• AData is physically copied into the consumer account before query
• BShared objects are read-only for consumers
• CConsumers must create ETL jobs to refresh shared tables
• DProviders cannot share views

A provider wants to share data but minimize the risk of exposing sensitive base-table logic or unintended columns. What is the recommended pattern?

• AShare raw tables directly whenever possible
• BShare secure views or secure UDFs instead of direct base tables
• CCreate larger warehouses for consumers
• DRequire all consumers to use reader accounts

You need a shared secure view that returns different rows to different consumer accounts. Which function should the provider use inside the view logic?

• ACURRENT_ROLE()
• BCURRENT_USER()
• CCURRENT_ACCOUNT()
• DCURRENT_WAREHOUSE()

Before adding a consumer account to a share, the provider wants to test exactly which rows that consumer would see through a secure view. What should the team use?

• AA resource monitor
• BThe SIMULATED_DATA_SHARING_CONSUMER session parameter
• CA reader account only
• DSYSTEM$ALLOWLIST

A provider wants consumers to see masked or row-filtered data based on roles shipped with the shared database itself. Which pattern best supports that requirement?

• AProvider account roles automatically appear in the consumer account
• BShared database roles referenced in the policy logic
• CNetwork policies on the consumer warehouse
• DOnly reader accounts can consume policy-protected data

When is a reader account the best fit?

• AThe consumer already has a full Snowflake footprint and wants to share data back
• BThe provider needs to share data with a party that is not yet a Snowflake customer
• CThe provider wants to bypass governance controls
• DThe consumer needs write access to the provider tables

Your company offers reader accounts to many customers. Finance is worried that one reader account warehouse could run indefinitely and consume credits billed to the provider. What should you implement?

• AOnly masking policies
• BResource monitors on reader account warehouses
• CDatabase roles in the provider account
• DCustom account locators

A data provider expects to onboard dozens of Snowflake customer accounts over time and wants a repeatable packaging and request workflow instead of manually tracking every direct share. Which option fits best?

• ASeparate warehouses for each consumer
• BA listing backed by a secure share
• CA reader account for every consumer, even existing Snowflake customers
• DPassword authentication only