ARA-C01 Accounts and Security Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. What is the primary purpose of this row access policy when applied to a sales table?

Accepted Answer

It enforces data localization by restricting access based on the user's current role.. Row Access Policies provide fine-grained access control by filtering which rows are visible to a user based on their role or other session attributes. This specific policy implements a dynamic lookup against a mapping table, ensuring that sales managers can only see data for the regions they are assigned to manage.

Answer

It prevents any user from deleting rows in the sales table.

Answer

It masks the sales_region column for unauthorized users.

Answer

It optimizes query performance by partitioning the table by sales_region.

Question 2

In a Snowflake organization with multiple accounts, what is the unique capability of the ORGADMIN role?

Accepted Answer

It is the only role that can create and manage new Snowflake accounts within the organization.. The ORGADMIN role is a special system role introduced with the Organization feature to manage account-level resources across the entire organization. It provides a centralized point of control for creating new accounts, monitoring usage across the organization, and managing the replication of data between different accounts.

Answer

It can view and modify data in any table across all accounts in the organization.

Answer

It replaces the ACCOUNTADMIN role for security management within each account.

Answer

It must be manually granted to a user by Snowflake Support.

Question 3

Which TWO session parameters can be adjusted to control user session timeouts and security in Snowflake?

Accepted Answer

CLIENT_SESSION_KEEP_ALIVE. Managing session timeouts is a critical part of maintaining a secure environment, as it prevents idle sessions from remaining open indefinitely. Architects can configure these parameters at the account, user, or session level to align with their organization's security policies and compliance requirements for data access.

Answer

DATA_RETENTION_TIME_IN_DAYS

Answer

NETWORK_POLICY_BYPASS_TIMEOUT

Answer

MAX_CONCURRENT_QUERIES

Question 4

An architect is designing an authentication strategy for a large organization. Which TWO options are required to enable Key-Pair authentication for a service user?

Accepted Answer

Assign the public key to the user via ALTER USER.. Key-Pair authentication improves security for automated tasks by eliminating the need for hard-coded passwords. The process requires generating a private/public key pair, associating the public key with the Snowflake user, and then configuring the client to use the private key for signing authentication requests. This method is considered a best practice for service accounts to minimize the risk of credential theft compared to traditional username/password authentication methods used in legacy systems.

Answer

Set the user's password to NULL.

Answer

Store the private key in a Snowflake stage.

Answer

Enable MFA for the service user.

Question 5

Which THREE actions are necessary to implement a secure, multi-layered data access model using row-level security and column-level masking?

Accepted Answer

Apply a Row Access Policy to the table.. Implementing fine-grained access control requires a combination of Row Access Policies and Masking Policies. Row Access Policies filter which rows are returned in a query result, while Masking Policies obfuscate sensitive column values. Combining these with a structured Role-Based Access Control model ensures that even if users have broad access, the data they see is restricted to what they are explicitly authorized to view, satisfying privacy regulations and internal security requirements effectively.

Answer

Enable Always Encrypted on the driver.

Answer

Grant the PUBLIC role ownership of the policy.

Question 6

An organization requires that all data stored in internal stages be encrypted with their own managed keys. Which Snowflake feature should the architect enable?

Accepted Answer

Tri-Secret Secure.. Tri-Secret Secure uses a combination of Snowflake-managed keys and customer-managed keys (CMK) stored in a supported cloud provider's Key Management Service (KMS). This ensures that the customer retains control over the encryption of their data. This feature is essential for highly regulated sectors like healthcare or finance, where data sovereignty and control are required, providing an additional layer of security by ensuring that even without access to the cloud provider, Snowflake cannot decrypt the data independently.

Answer

Object Tagging.

Answer

Network Policies.

Answer

Access History.

Question 7

Refer to the exhibit. Which privileges does 'jdoe' have access to?

Accepted Answer

Privileges of both the analyst and data_scientist roles.. In Snowflake, role inheritance means that a user granted a child role receives all privileges assigned to that child. Furthermore, if that child role is granted to a parent role, the parent role inherits the child's permissions. Here, since 'analyst' is granted to 'data_scientist', and 'data_scientist' is granted to 'jdoe', 'jdoe' effectively holds both the analyst and data_scientist roles simultaneously when the data_scientist role is active. This cascading permission structure is the foundation of efficient RBAC.

Answer

Only privileges of the analyst role.

Answer

Only privileges of the data_scientist role.

Answer

No privileges until ACCOUNTADMIN is assigned.

Question 8

An organization wants to restrict access to the ACCOUNTADMIN role to only two authorized individuals. What is the best practice for achieving this?

Accepted Answer

Grant the role only to the two specific users.. The ACCOUNTADMIN role is the highest level of privilege and should be used sparingly. By creating a custom role hierarchy where only specific users are granted the role, and ensuring that no other roles are granted to the ACCOUNTADMIN role, you maintain a strict security posture. Regularly auditing users who possess this role is essential to minimize the risk of accidental or malicious configuration changes that could impact the entire platform's security and operational status.

Answer

Rename the ACCOUNTADMIN role.

Answer

Use a Network Policy for ACCOUNTADMIN.

Answer

Enable two-factor authentication for the role.

Question 9

An architect needs to track changes made to table permissions for security compliance. Which feature should be used?

Accepted Answer

Query History.. The Query History and Access History views allow for comprehensive tracking of all DDL and DML operations. By auditing GRANT and REVOKE statements, an architect can maintain a trail of who modified permissions, when they did it, and what the change involved. This is vital for meeting regulatory requirements and internal security policies, as it ensures accountability and provides evidence of permission modifications in the event of an audit or investigation into unauthorized access changes.

Answer

Object Tagging.

Answer

Data Masking.

Answer

Network Policies.

Question 10

What is the primary function of the 'Snowflake' role in the context of account security?

Accepted Answer

To perform administrative tasks on system objects.. The role hierarchy in Snowflake is designed to provide systemic management capabilities. The 'Snowflake' role (often referred to in the context of built-in roles like ORGADMIN or ACCOUNTADMIN) provides the platform with the ability to manage system-level objects. Understanding the purpose of each built-in role is critical for an architect to ensure that permissions are correctly delegated and that the account security model remains robust, preventing privilege escalation and maintaining proper separation of duties across all administrative functions.

Answer

To manage all user data.

Answer

To store database credentials.

Answer

To automatically encrypt storage.

Question 11

A security architect is implementing SCIM for a Snowflake account using Okta. During the initial sync, several users fail to provision. Upon investigation, the architect finds that the Snowflake account already has existing users with the same login names created manually. How does Snowflake handle this conflict during SCIM provisioning?

Accepted Answer

The SCIM service takes ownership of the existing user if the login_name matches the identity provider's username.. Effective identity management in Snowflake relies on the SCIM (System for Cross-domain Identity Management) protocol to automate user provisioning. When a conflict occurs between an existing manual user and a SCIM-provisioned user, Snowflake provides specific mechanisms to ensure the transition is seamless without creating duplicate identities or causing authentication failures, which is critical for maintaining a clean security posture.

Answer

The SCIM sync will fail and report a conflict error until the manual users are deleted from Snowflake.

Answer

Snowflake creates a new user with a unique suffix like '_SCIM' to avoid naming collisions with manual users.

Answer

Snowflake ignores the SCIM request for existing users and only provisions new users that do not exist.

Question 12

A company requires strict network isolation for their Snowflake environment. They have configured a network policy at the account level to allow only specific corporate IP ranges. Which TWO statements accurately describe the behavior when additional network policies are applied at the user level or to security integrations?

Accepted Answer

A network policy applied to a specific user always overrides the account-level network policy for that user.. Network policies in Snowflake follow a specific precedence logic that allows architects to layer security. Understanding how user-level and integration-level policies override or supplement account-level policies is vital for designing secure access patterns for both human users and automated services, ensuring that the most granular policy takes effect without leaving unintentional security gaps.

Answer

User-level network policies are additive to the account-level policy, requiring a match on both lists to allow access.

Answer

The account-level policy acts as a global blocklist that cannot be bypassed by any user-level network policy.

Answer

Network policies applied to a Role will restrict all users who have that role as their primary session role.

Question 13

A healthcare provider uses Snowflake to store HIPAA-regulated data. They need to ensure that data is encrypted using a combination of Snowflake-managed keys and their own master key managed in AWS KMS. Which Snowflake feature must be enabled to support this dual-key encryption architecture?

Accepted Answer

Tri-Secret Secure. Snowflake provides various levels of encryption management to meet compliance requirements. For organizations needing more control over their data, Tri-Secret Secure is a critical security feature. It combines a Snowflake-managed key, a customer-managed key, and a user's credentials to ensure that data cannot be decrypted without the customer's explicit control over their key management system.

Answer

Periodic Rekeying

Answer

Client-Side Encryption

Answer

End-to-End Encryption

Question 14

A data steward is implementing Object Tagging to track PII across a complex schema. They apply a tag named 'sensitivity_level' with a value of 'highly_confidential' to a specific schema. Which TWO statements correctly describe how this tag interacts with objects within that schema?

Accepted Answer

All tables created within the schema automatically inherit the 'highly_confidential' tag value.. Object tagging in Snowflake provides a powerful metadata layer for governance. Understanding tag inheritance is essential for architects to minimize manual tagging efforts. When a tag is applied to a container like a schema, it flows down to the objects within it, but these inherited values can be managed or overridden to provide precise control over data classification.

Answer

Tags applied to a schema override any tags applied directly to individual columns within that schema.

Answer

Inherited tags are only visible when querying the TAG_REFERENCES account usage view with a special override flag.

Answer

Applying a tag to a schema will automatically apply the same tag to the parent database object.

Question 15

An organization is using Azure AD as an External OAuth provider for Snowflake. They want to ensure that when a user authenticates, Snowflake automatically assigns them a specific session role based on a claim in the JWT. Which configuration parameter in the Security Integration is required to enable this role-switching behavior?

Accepted Answer

EXTERNAL_OAUTH_ANY_ROLE_MODE = 'ENABLE'. For advanced security architectures, mapping identity provider attributes to Snowflake session attributes is essential. By configuring the `ANY_ROLE` mode or using specific scope mapping, architects can ensure that users are placed into the correct security context automatically upon login, reducing manual role switching and improving the user experience for integrated applications like Power BI or custom portals.

Answer

EXTERNAL_OAUTH_DEFAULT_ROLE_MODE = 'REQUIRED'

Answer

EXTERNAL_OAUTH_SCOPE_DELIMITER = ','

Answer

EXTERNAL_OAUTH_ISSUER = 'AZURE_AD'