ARA-C01 Accounts and Security Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. An architect attempts to connect to Snowflake from 10.0.0.5. Based on the configuration, what will happen?

Accepted Answer

The connection is rejected.. Snowflake evaluates network policies by checking the blocked list first, then the allowed list. Because the IP 10.0.0.5 falls within the 10.0.0.0/8 range defined in the blocked_ip_list, the connection request is rejected immediately. Even if the IP were also in an allowed range, the explicit block takes precedence, ensuring that known malicious or restricted subnets are denied access regardless of other configuration settings within the specific network policy applied to the account.

Answer

The connection is successful.

Answer

The connection depends on the user's role.

Answer

The connection is deferred to the secondary policy.

Question 2

An organization wants to centralize user management by integrating Snowflake with their corporate Okta instance using SCIM. Which architectural component facilitates the synchronization of user metadata between Okta and Snowflake?

Accepted Answer

Snowflake SCIM provisioning integration.. SCIM (System for Cross-domain Identity Management) is an open standard that allows for the automation of user provisioning. By using the Snowflake SCIM integration, the architect ensures that user additions, updates, and deletions in Okta are automatically reflected in Snowflake. This eliminates manual administrative overhead and reduces the risk of orphaned accounts or stale permissions, which are common security vulnerabilities in large organizations where employee turnover is high and manual tracking is prone to errors.

Answer

Snowflake Data Share.

Answer

External OAuth security integration.

Answer

Snowflake Native App.

Question 3

Which object type should an architect use to manage granular access permissions to a specific schema within a database?

Accepted Answer

Role. Role-Based Access Control (RBAC) in Snowflake relies on roles to manage privileges. By assigning specific privileges like USAGE or SELECT to a role, and then granting that role to users or other roles, the architect implements the principle of least privilege. This hierarchy allows for scalable management of security, ensuring that users only have the access they need to perform their jobs while maintaining auditability for compliance and security monitoring purposes across the entire organization.

Answer

User

Answer

Warehouse

Answer

Integration

Question 4

An architect is tasked with auditing all failed login attempts for a security investigation. Which view should be queried?

Accepted Answer

LOGIN_HISTORY. The ACCOUNT_USAGE schema provides historical metadata about account activity. Specifically, the LOGIN_HISTORY view records all login attempts, including successes and failures, the client used, and the source IP address. Querying this view is essential for security architects to identify brute-force attacks or anomalous behavior, allowing them to take proactive measures such as updating network policies or flagging compromised accounts, thereby maintaining the overall integrity and security posture of the Snowflake environment.

Answer

QUERY_HISTORY

Answer

ACCESS_HISTORY

Answer

SESSIONS

Question 5

When designing a role hierarchy, what is the primary benefit of granting one role to another role instead of directly to users?

Accepted Answer

It simplifies privilege management through inheritance.. Role inheritance simplifies privilege management by allowing an architect to create a logical hierarchy. When a parent role inherits a child role, it automatically gains all the child's privileges. This reduces administrative overhead, as permission changes only need to be made once at the child level to propagate upwards. It also improves visibility and auditability, allowing for a clearer mapping between job functions and the access required to perform those functions efficiently across the organization.

Answer

It increases query performance.

Answer

It enables automatic data encryption.

Answer

It bypasses the need for MFA.

Question 6

Which TWO of the following are true regarding the use of Snowflake Data Shares for security purposes?

Accepted Answer

Data shares eliminate the need for data duplication.. Data Shares provide a secure way to share data without copying it. The provider account retains full control over the data objects, and the consumer account gets read-only access. This architecture is inherently more secure than traditional ETL-based data transfer methods because it eliminates the movement of data, reduces the risk of data leakage during transit, and ensures that the consumer is always querying the most up-to-date version of the data provided by the source.

Answer

Data shares allow consumers to write back to the source.

Answer

Data shares automatically copy data to the consumer.

Answer

Shares require public internet access.

Question 7

Which of the following describes the correct behavior of a Masking Policy applied to a column that is also referenced in a Row Access Policy?

Accepted Answer

The Row Access Policy is evaluated first.. Snowflake enforces policies in a specific sequence. When both Row Access and Masking Policies are present, the Row Access Policy is evaluated first to determine the visible rows, and then the Masking Policy is applied to the visible data. This ensures that the security constraints are applied logically and cumulatively. This behavior is crucial for preventing information leakage, ensuring that users cannot bypass row-level filters by using column-level masking logic or vice versa, providing a consistent security model.

Answer

The Masking Policy is evaluated first.

Answer

Only the Masking Policy is applied.

Answer

Only the Row Access Policy is applied.

Question 8

A global enterprise is consolidating multiple Snowflake accounts into a single Organization to optimize billing and data sharing. They need to move a large production database from an account in 'aws_us_east_1' to an account in 'azure_west_us'. What is the most efficient architectural approach to achieve this while maintaining data consistency?

Accepted Answer

Enable database replication between the source AWS account and the target Azure account within the Organization.. Consolidating multiple Snowflake accounts into a single Organization requires a strategy for moving data across regions. Snowflake's cross-region database replication is the primary mechanism for this, as it handles the underlying cloud provider differences and ensures data integrity through asynchronous synchronization. This architectural approach minimizes downtime and prevents the complexities of manual export/import processes while maintaining a single source of truth.

Answer

Unload data to a cross-region S3 bucket and use the COPY INTO command to load it into the Azure account.

Answer

Use Snowflake Data Sharing to share the database from the AWS account to the Azure account directly.

Answer

Create a Clone of the database and use the Snowflake CLI to push the metadata to the Azure account.

Question 9

Refer to the exhibit. Based on the security integration definition provided, what is the primary purpose of the 'token_user_field' parameter in this specific configuration?

Accepted Answer

It defines the field in the OAuth token that Snowflake uses to match against the login_name of a Snowflake user.. External OAuth allows third-party identity providers like Microsoft Entra ID to authorize access to Snowflake. The `token_user_field` is a critical configuration parameter that tells Snowflake which claim in the incoming JWT (JSON Web Token) should be used to identify the Snowflake user. In this exhibit, setting it to 'upn' ensures the user identity is mapped correctly from the Microsoft environment.

Answer

It specifies the Snowflake role that the user will be assigned when they connect via the OAuth provider.

Answer

It identifies the public key used to verify the digital signature of the incoming OAuth access token.

Answer

It determines the audience for which the token was issued to prevent token substitution attacks.

Question 10

Refer to the exhibit. An administrator has executed a 'SHOW GRANTS TO ROLE ANALYST_ROLE' command. Based on the output, what is the significance of the 'grant_option' value for the 'SELECT' privilege on the 'SALES_DATA' table?

Accepted Answer

The ANALYST_ROLE can grant the SELECT privilege on the SALES_DATA table to other roles in the account.. The 'grant_option' in Snowflake access control determines if a grantee has the authority to pass privileges to other roles. Understanding this output is crucial for architects to audit security and ensure that the principle of least privilege is maintained, as the ability to further delegate access can lead to unauthorized permission expansion if not strictly controlled.

Answer

The ANALYST_ROLE is a managed access role and cannot modify any privileges on the SALES_DATA table.

Answer

The SELECT privilege is automatically granted to any role that is a child of the ANALYST_ROLE.

Answer

The ANALYST_ROLE can only grant the SELECT privilege if they also have the OWNERSHIP privilege on the table.

Question 11

A security team is designing a Snowflake deployment where they need to centrally manage user access to a set of databases across multiple accounts in an organization. They want to define a set of privileges once and grant them to roles in each account without recreating the roles in every account. Which Snowflake feature should they use?

Accepted Answer

Organization roles. Organization roles allow centralized management of privileges across multiple accounts within a Snowflake organization. They are defined once and can be granted to accounts, eliminating the need to recreate roles in each account. This provides a scalable and consistent way to manage access, which is exactly what the security team needs.

Answer

Account roles

Answer

Application roles

Answer

Database roles

Question 12

A financial services firm uses Snowflake with Tri-Secret Secure. They have integrated AWS KMS with Snowflake and manage their own key. During a security audit, the auditor asks how Snowflake ensures that data cannot be decrypted if the customer revokes access to their key. Which statement accurately describes the behavior?

Accepted Answer

If the customer revokes the key, Snowflake immediately loses the ability to decrypt data, and data becomes inaccessible.. Tri-Secret Secure uses a composite master key consisting of a Snowflake-managed key and a customer-managed key. If the customer revokes access to their key, Snowflake cannot reconstruct the composite key, making data undecryptable. This provides a strong security control where the customer retains ultimate control over data access. Other options incorrectly suggest Snowflake retains a copy or can bypass the customer key.

Answer

Revoking the key only prevents new data from being encrypted, but existing data remains accessible.

Answer

Snowflake stores a copy of the customer's key in an encrypted vault to ensure availability.

Answer

Snowflake can still decrypt data using its internal key, but the customer's key is required for auditing.

Question 13

A Snowflake architect is designing a multi-tenant environment where each tenant has its own database. The architect wants to ensure that tenant administrators can manage roles and users within their own database but cannot affect other tenants. Which Snowflake feature should be used to achieve this isolation?

Accepted Answer

Database roles. Database roles are scoped to a specific database and allow for granular privilege management within that database. By granting a tenant administrator a database role with the ability to create and manage other database roles, you enable them to manage access within their database without affecting other databases. Account roles are too broad and would not provide the needed isolation.

Answer

Network policies

Answer

Resource monitors

Answer

Account roles

Question 14

A healthcare company stores PHI in a Snowflake database and must ensure that only authorized roles can decrypt the data at rest. They want an additional layer of protection so that even Snowflake cannot access the data without a customer-held key. Which Snowflake feature should the architect implement?

Accepted Answer

Tri-Secret Secure. Tri-Secret Secure is designed to give customers control over a key that is part of the encryption hierarchy. By combining a customer-managed key with Snowflake's key, it ensures that data cannot be decrypted without the customer's key, providing an extra layer of protection. This directly addresses the need for customer-controlled encryption at rest.

Answer

Network policies with private connectivity

Answer

Column-level security with masking policies

Answer

Client-side encryption with Snowflake's ENCRYPT function

Question 15

A security architect at a financial services company needs to ensure that all data stored in Snowflake is encrypted with keys that the company controls and can revoke at any time. They have already enabled Tri-Secret Secure. Which additional configuration is required to meet this requirement?

Accepted Answer

Configure the account to use a customer-managed key (CMK) stored in a supported cloud KMS.. Tri-Secret Secure requires a customer-managed key (CMK) in a supported cloud KMS to give the customer control over encryption keys. By configuring the CMK, the company can revoke access by disabling the key. The other options do not provide key control: rekeying is automatic and not customer-controlled, network policies are unrelated to encryption, and there is no Snowflake privilege to manage encryption keys directly.

Answer

Create a custom role with the MANAGE ENCRYPTION KEYS privilege and assign it to the security team.

Answer

Set up a network policy that restricts access to the Snowflake account to only the company's IP ranges.

Answer

Enable periodic rekeying of the Snowflake-managed key through the ACCOUNTADMIN role.