COF-C03 Practice Test 14 — 15 Questions

Question 1

A consumer has created a database from a share provided by a partner. The consumer wants to allow a specific role, ANALYST_ROLE, to query the shared data. Which privilege must the consumer grant to ANALYST_ROLE on the shared database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IMPORTED PRIVILEGES. To allow a role to query data in a database created from a share, the consumer must grant the IMPORTED PRIVILEGES privilege on that database to the role. This privilege grants access to the shared objects, including SELECT on tables and views. It is the correct and only privilege that enables access to shared data.

Answer

OWNERSHIP

Answer

USAGE

Answer

SELECT

Question 2

A consumer has mounted a share from a provider and wants to grant a role in their account the ability to query the shared data. What must the consumer do?

Accepted Answer

Grant USAGE on the shared database and schemas, and SELECT on the shared tables or views, to the role.. Consumers manage access to shared databases using standard GRANT statements within their own account. They grant USAGE on the database and schemas, and SELECT on the shared tables or views, to the roles that need access. Providers cannot grant privileges to consumer roles, and access is not automatic.

Answer

Ask the provider to grant SELECT directly to the consumer's role.

Answer

Create a new share in the consumer account that references the provider's share.

Answer

Nothing, because all roles in the consumer account automatically have access to shared databases.

Question 3

A provider wants to share data with a consumer but needs the shared data to reflect changes in the provider's source tables in near real time. The provider also wants to avoid granting the consumer access to the underlying base tables. Which approach best meets these requirements?

Accepted Answer

Create a secure view over the base tables and grant SELECT on the view to the share.. A secure view provides real-time access to base table data because it executes the underlying query at runtime. It also hides the view definition and base table details from consumers. Granting SELECT on the secure view to the share meets both the freshness and the access restriction requirements, unlike copies or direct table grants.

Answer

Grant SELECT on the base tables directly to the share and instruct the consumer not to modify them.

Answer

Create a materialized view over the base tables and grant SELECT on the materialized view to the share.

Answer

Copy the base tables into a separate database and grant SELECT on the copies to the share.

Question 4

A consumer wants to access a shared database from a provider. The provider has already created the share and granted the necessary privileges. What must the consumer do to access the shared data?

Accepted Answer

Create a database from the share using the CREATE DATABASE ... FROM SHARE command.. The consumer must create a database from the share using CREATE DATABASE ... FROM SHARE. This creates a read-only database in the consumer's account. The consumer then grants privileges on that database to their roles to allow users to query the data. The provider must have already added the consumer's account to the share.

Answer

Grant the USAGE privilege on the share to a role in the consumer's account.

Answer

Use the ALTER SHARE command to add the consumer's account to the share.

Answer

Request the provider to grant SELECT on the shared objects directly to the consumer's role.

Question 5

A provider has created a share and added a table. The provider now wants to revoke access for a specific consumer account without affecting other consumers. Which command should the provider use?

Accepted Answer

ALTER SHARE my_share REMOVE ACCOUNT = consumer_account;. To revoke access for a specific consumer, the provider must remove that account from the share using ALTER SHARE ... REMOVE ACCOUNT. This action only affects the specified account and leaves other consumers unaffected. Dropping the share or revoking table privileges would impact all consumers, which is not desired. The correct command is precise and reversible if needed.

Answer

DROP SHARE my_share;

Answer

REVOKE USAGE ON SHARE my_share FROM ACCOUNT consumer_account;

Answer

REVOKE SELECT ON TABLE my_table FROM SHARE my_share;

Question 6

A provider runs CREATE SHARE sales_share; then GRANT USAGE ON DATABASE sales_db TO SHARE sales_share; GRANT USAGE ON SCHEMA sales_db.public TO SHARE sales_share; GRANT SELECT ON TABLE sales_db.public.orders TO SHARE sales_share; ALTER SHARE sales_share ADD ACCOUNT = consumer_acct; A consumer in consumer_acct queries the shared database and receives results. Six months later, the provider executes REVOKE SELECT ON TABLE sales_db.public.orders FROM SHARE sales_share; What is the immediate effect for the consumer?

Accepted Answer

The consumer immediately loses the ability to query the table and receives an authorization error.. Shares expose live provider data and enforce privileges at query time, so revoking SELECT on a table from a share removes access immediately. The consumer does not need to unmount the database, and cached results do not preserve authorization. The share object and other granted objects remain intact; only the revoked table becomes inaccessible, with a standard insufficient privileges error on the next attempt.

Answer

The consumer keeps access but can no longer see the table in SHOW TABLES output.

Answer

The consumer can still query the shared table because the share was already mounted and the data is cached locally.

Answer

The consumer retains read access until the share is dropped or the account is removed from the share.

Question 7

A provider wants to share data with a consumer but needs to ensure that the consumer cannot see the underlying table structure or any data beyond what is explicitly exposed. The provider also wants to prevent the consumer from using the shared data to infer sensitive information. Which Snowflake feature should the provider use?

Accepted Answer

Secure views. Secure views are specifically designed to share data without revealing the underlying table structure or allowing inference. They hide the view definition from unauthorized users and prevent the use of certain optimizations that could leak information. For sharing sensitive data with external consumers, secure views are the recommended feature.

Answer

Dynamic data masking

Answer

Row access policies

Answer

Materialized views

Question 8

A provider wants to share data with a consumer but must ensure that the consumer cannot see the underlying base tables, only an aggregated subset. The provider decides to use a secure view. Which statement is true regarding the use of secure views in a share?

Accepted Answer

Secure views can be shared, and the consumer can query them without having direct access to the base tables.. Secure views are ideal for sharing because they allow consumers to query a defined subset of data without exposing the underlying tables or the view definition. The consumer only needs SELECT on the secure view. This ensures that sensitive base data remains protected while enabling controlled data sharing.

Answer

Secure views cannot be shared; only regular views can be included in a share.

Answer

Sharing a secure view requires granting the consumer SELECT on the base tables as well.

Answer

Secure views automatically encrypt the data, so consumers cannot read it without a decryption key.

Question 9

A consumer account has created a database from a share provided by a partner. The consumer wants to ensure that when the provider adds new tables to the share, those tables become available in the consumer's shared database without any manual intervention. Which statement accurately describes the behavior of shared databases in Snowflake?

Accepted Answer

New tables added to the share by the provider are automatically available in the consumer's shared database.. Shared databases are automatically updated when the provider adds new objects to the share. The consumer does not need to refresh, recreate, or grant additional privileges. The provider's grant of SELECT on a new table to the share makes it immediately available in the consumer's shared database. This real-time propagation is a fundamental characteristic of Snowflake Data Sharing.

Answer

The consumer must recreate the shared database to see new tables added by the provider.

Answer

The consumer must grant SELECT on the new tables to their own roles before they can be queried.

Answer

The consumer must run ALTER DATABASE ... REFRESH to pull new objects from the share.

Question 10

A security administrator has created a masking policy that replaces the value of a column with a SHA2 hash for users without the role 'HR_ROLE'. The policy is applied to the 'SSN' column of the 'EMPLOYEES' table. A user with the role 'ANALYST_ROLE' queries the table and sees the hashed values. However, when the same user runs a query that includes the 'SSN' column in a WHERE clause, the query returns no results even though matching records exist. What is the most likely cause of this behavior?

Accepted Answer

The masking policy is applied to the column, but the user does not have the privilege to see the original values, so the WHERE clause is evaluated against the masked values, which do not match the search condition.. The correct answer is that the WHERE clause is evaluated against masked values. Masking policies transform data at query time, so any filtering or joining on the masked column uses the masked representation. This is a critical concept: masking does not prevent the column from being used in predicates, but it changes the data used for those predicates, which can lead to unexpected results if the user expects to filter on original values.

Answer

The user lacks the SELECT privilege on the table, so the query returns no rows.

Answer

The masking policy is not applied to the WHERE clause, so the original values are used for filtering, but the user cannot see them, resulting in an error.

Answer

The user's role has not been granted the USAGE privilege on the masking policy, so the policy is bypassed and the original values are used, but the user cannot see them due to column-level security.

Question 11

A provider wants to share a dynamic table with a consumer. The dynamic table is defined on a base table that is not shared. What must the provider ensure for the consumer to query the dynamic table?

Accepted Answer

The dynamic table must be added to the share, and the dynamic table owner must have the necessary privileges on the base table.. Dynamic tables can be shared directly. The consumer queries the dynamic table, which executes with the owner's privileges. The provider must add the dynamic table to the share and ensure the owner has SELECT on the base table. The consumer does not need any privileges on the base table. This allows sharing of transformed data without exposing the source.

Answer

The provider must grant SELECT on the base table to the share.

Answer

The dynamic table must be refreshed before sharing.

Answer

The consumer must be granted the ability to refresh the dynamic table.

Question 12

A provider has created a share and granted SELECT on a table to the share. The provider now wants to allow the consumer to query the table but also wants to ensure that the consumer cannot see the table's columns that contain personal data. The provider decides to create a secure view that excludes the sensitive columns and grants SELECT on the view to the share. The provider does NOT grant SELECT on the base table to the share. What will the consumer experience when querying the shared view?

Accepted Answer

The consumer can query the view successfully and will see only the non-sensitive columns.. A shared secure view executes with the owner's privileges, so the consumer does not need privileges on the base table. The view definition excludes sensitive columns, and the secure property hides that definition. As a result, the consumer can query the view and see only the non-sensitive columns. Granting SELECT on the base table is unnecessary and would actually expose the sensitive data.

Answer

The consumer must be granted SELECT on the base table for the view to return results, but this would expose the sensitive columns.

Answer

The consumer will receive an error because they lack privileges on the base table referenced by the view.

Answer

The consumer can query the view but will also be able to see the sensitive columns because the view is not secure.

Question 13

A provider is preparing to share data with a consumer using a direct share. The provider wants to ensure that the consumer can query a specific table and also see any future columns added to that table without additional grants. Which two actions must the provider take? (Choose two.)

Accepted Answer

Grant USAGE on the database and schema containing the table to the share.. To share a table and automatically include future columns, the provider must grant USAGE on the database and schema to the share, and grant SELECT on the table to the share. SELECT on a table applies to all columns, including those added later. No column-level grants are needed. A secure view is not required for this purpose.

Answer

Grant REFERENCES on the table to the share to allow future columns to be visible.

Answer

Grant SELECT on each future column to the share as they are added.

Answer

Create a secure view that selects all columns from the table and grant SELECT on the view to the share.

Question 14

A consumer account has mounted a shared database from a provider. The consumer's role CONSUMER_ROLE has been granted USAGE on the shared database and its schemas. However, when the consumer tries to query a table in the shared database, they receive an error that the table does not exist. What is the most likely cause?

Accepted Answer

The provider has not granted SELECT on the table to the share.. The most likely cause is that the provider has not granted SELECT on the table to the share. Consumers cannot grant privileges on shared objects; they rely on the provider's grants. Without SELECT granted to the share, the table is not accessible, leading to a 'table does not exist' error. The consumer's USAGE grants on the database and schema are necessary but not sufficient.

Answer

The consumer's role lacks the USAGE privilege on the table.

Answer

The consumer needs to grant SELECT on the table to CONSUMER_ROLE.

Answer

The shared database has not been refreshed after the provider added the table.

Question 15

A Snowflake administrator is configuring a new virtual warehouse for a team of data scientists who will run ad-hoc queries with varying concurrency. The administrator wants to ensure optimal performance and cost-efficiency. Which two configurations should the administrator consider? (Choose two.)

Accepted Answer

Set the warehouse to auto-suspend after 5 minutes of inactivity to reduce credit consumption.. For ad-hoc queries with varying concurrency, a multi-cluster warehouse with a min of 1 and max of 3 clusters handles concurrency spikes efficiently, while auto-suspend after 5 minutes reduces credits during idle periods. These two settings balance performance and cost, making them the best choices.

Answer

Disable the query result cache to ensure queries always use the latest data.

Answer

Set the warehouse to run 24/7 without auto-suspend to avoid startup latency.

Answer

Increase the warehouse size to 4X-Large to ensure queries run as fast as possible.