COF-C03 Practice Test 15 — 15 Questions

Question 1

A user with the role DATA_ANALYST has been granted the USAGE privilege on a database and schema, but when they try to query a table in that schema, they receive an error that the table does not exist. The table exists and is owned by the role DATA_ENGINEER. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DATA_ANALYST role lacks the SELECT privilege on the table.. In Snowflake, to query a table, a role must have the SELECT privilege on that table. Having USAGE on the database and schema only allows navigation and listing. Without SELECT, the table is effectively inaccessible, and Snowflake returns a 'table does not exist' error to avoid leaking information. Granting SELECT to DATA_ANALYST resolves the problem. Ownership by another role does not prevent granting privileges.

Answer

The table is owned by DATA_ENGINEER, and ownership transfers all privileges, so DATA_ANALYST cannot access it.

Answer

The DATA_ANALYST role does not have USAGE on the database and schema.

Answer

The table is a secure view, and secure views require additional privileges.

Question 2

A provider wants to share data with a consumer account, but the consumer's account is in a different Snowflake region. The provider's data is in the US West (Oregon) region, and the consumer is in the EU (Frankfurt) region. The provider needs the consumer to access the data with low latency. Which Snowflake feature should the provider use?

Accepted Answer

Use database replication to create a replica of the database in the consumer's region, then share the replica with the consumer.. Cross-region sharing with low latency requires the data to be present in the consumer's region. Snowflake database replication allows a provider to create a replica in another region, and a share can be created on that replica. Direct shares, Marketplace listings, and data exchanges do not automatically replicate data across regions, so they would not satisfy the low-latency requirement without additional replication steps.

Answer

Create a direct share and add the consumer account; Snowflake automatically replicates the data to the consumer's region.

Answer

Configure a private data exchange and add the consumer; data exchanges replicate data to all member regions automatically.

Answer

Create a listing on the Snowflake Marketplace and have the consumer request it; Marketplace listings are always served from the consumer's region.

Question 3

A governance team is designing a strategy to classify and protect data across many databases in a Snowflake account. They want a scalable approach that applies protection consistently without editing each table definition manually. Which two capabilities should the team use to accomplish this goal? (Choose two.)

Accepted Answer

Use the ACCOUNT_USAGE.TAG_REFERENCES view to audit which columns carry governance tags.. Tag-based masking and tag reference auditing together form a scalable governance pattern. Associating masking policies with tags means protection follows the tag wherever it is applied, and TAG_REFERENCES provides the visibility needed to confirm coverage and identify gaps. Manual per-column policies and broad role grants do not scale, and encryption features address a different control objective.

Answer

Grant the SECURITYADMIN role to all analysts so they can manage their own masking policies.

Answer

Apply a separate masking policy to every sensitive column using ALTER TABLE for each column.

Answer

Enable Tri-Secret Secure to automatically classify and mask sensitive columns.

Question 4

A user with the role 'SYSADMIN' wants to grant the privilege to create databases to a custom role 'DB_CREATOR'. Which command should the SYSADMIN execute?

Accepted Answer

GRANT CREATE DATABASE ON ACCOUNT TO ROLE DB_CREATOR;. The CREATE DATABASE privilege is an account-level privilege, so it must be granted with the ON ACCOUNT clause. The SYSADMIN role has the authority to grant this privilege. The correct command is GRANT CREATE DATABASE ON ACCOUNT TO ROLE DB_CREATOR;

Answer

GRANT CREATE DATABASE ON DATABASE mydb TO ROLE DB_CREATOR;

Answer

GRANT CREATE DATABASE TO ROLE DB_CREATOR;

Answer

GRANT USAGE ON DATABASE mydb TO ROLE DB_CREATOR;

Question 5

A security administrator needs to ensure that a set of sensitive columns in an existing table are automatically masked for all users except those with the role 'HR_ADMIN'. The masking must be applied without modifying the underlying data. Which Snowflake feature should be used?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking is the correct feature because it applies masking policies to columns, dynamically masking data based on the user's role at query time without altering stored data. It provides fine-grained control and is designed for this exact scenario of protecting sensitive columns from unauthorized users.

Answer

Secure Views

Answer

Object Tagging

Answer

Row Access Policies

Question 6

A security team at a healthcare company must guarantee that query results returned from a table named PATIENT_RECORDS are filtered based on the department of the user executing the query, without requiring any changes to existing SQL statements. The policy must evaluate a mapping table that lists each user and their department. Which Snowflake object should be created to meet this requirement?

Accepted Answer

A row access policy attached to the PATIENT_RECORDS table that references a mapping table.. Row access policies are the Snowflake feature designed to filter rows at query time based on the execution context, such as the current user or role. Because the policy is evaluated dynamically and can join against a mapping table, it enforces per-department visibility transparently: existing SQL statements continue to work, and users see only the rows their department is authorized to view.

Answer

A secure view defined over PATIENT_RECORDS that joins the mapping table.

Answer

A masking policy applied to the DEPARTMENT column of the PATIENT_RECORDS table.

Answer

A network policy that limits access to the PATIENT_RECORDS table by department IP ranges.

Question 7

A data governance lead is configuring tag-based masking so that columns tagged with a PII classification are automatically protected. The lead creates a tag named PII_CLASSIFICATION and a masking policy, then applies the tag to several columns. Later, an analyst queries a tagged column and sees unmasked values. The masking policy was attached to the tag using ALTER TAG ... SET MASKING POLICY. What is the most likely cause?

Accepted Answer

The masking policy was attached to the tag but the tag was not applied to the specific column at the column level.. Tag-based masking requires two conditions to be satisfied: the masking policy must be associated with the tag, and the tag must be applied to the target column. If the tag was only created or applied at the table level rather than the column level, Snowflake has no tagged column to protect, so queries return the original values. Verifying the column's tag assignment resolves the issue.

Answer

Tag-based masking requires the tag to be a system tag rather than a user-defined tag.

Answer

The masking policy must be attached to the tag before the tag is created on the column, and the order was reversed.

Answer

The analyst's role has the ACCOUNTADMIN role granted, which bypasses all masking policies.

Question 8

A Snowflake account has a custom role named DATA_ENGINEER. The administrator wants to ensure that DATA_ENGINEER can create databases and warehouses but cannot manage users or roles. Which predefined role should DATA_ENGINEER be granted to achieve this?

Accepted Answer

SYSADMIN. SYSADMIN is the predefined role that provides privileges to create and manage warehouses, databases, and other objects. It does not include user or role management, which is handled by SECURITYADMIN and USERADMIN. By granting SYSADMIN to DATA_ENGINEER, the administrator ensures the role can perform its intended tasks without over-privileging it.

Answer

ACCOUNTADMIN

Answer

USERADMIN

Answer

SECURITYADMIN

Question 9

A Snowflake administrator needs to provide a data analyst with the ability to read data from a specific table but prevent the analyst from seeing any personally identifiable information (PII) columns. The administrator decides to use a masking policy. Which statement accurately describes the behavior of a masking policy in Snowflake?

Accepted Answer

A masking policy is applied at the column level and can conditionally alter the data returned based on the user's role.. Masking policies in Snowflake are column-level security objects that dynamically mask data based on the user's role. They allow the administrator to hide PII from the analyst while still granting access to the table. The policy can be conditional, so different roles see different values. This meets the requirement without altering the stored data.

Answer

A masking policy permanently replaces the sensitive data in the table with masked values for all users.

Answer

A masking policy is applied at the table level and hides entire rows that contain sensitive data.

Answer

A masking policy can only be applied to columns of type VARCHAR and not to numeric or date columns.

Question 10

A governance team needs to implement data classification and access control for a new table containing sensitive data. They want to (1) tag columns with a sensitivity level, and (2) enforce that only users with a specific role can see the unmasked data. Which two Snowflake features should they use together to achieve these goals? (Choose two.)

Accepted Answer

Object tagging. Object tagging is used to classify columns with sensitivity levels, providing metadata for governance. Masking policies enforce column-level access control by dynamically masking data based on the user's role. Together, they satisfy both requirements: tagging for classification and masking for access enforcement. Other features like row access policies or secure views do not provide the needed column-level masking and tagging combination.

Answer

Network policy

Answer

Row access policy

Answer

Secure view

Question 11

An administrator discovers that a former employee's user account still exists and is still granted the ANALYST_ROLE. The administrator needs to immediately prevent the account from authenticating while preserving the account and its historical query metadata for an ongoing audit. Which action should the administrator take?

Accepted Answer

Run ALTER USER ... SET DISABLED = TRUE.. Disabling a user with ALTER USER ... SET DISABLED = TRUE immediately blocks authentication while keeping the account, its grants, and its metadata available for audit. Dropping the user or altering credentials does not preserve the account in the desired state, and revoking a role only removes one privilege path rather than blocking sign-in.

Answer

Run DROP USER on the former employee's account.

Answer

Run ALTER USER ... SET PASSWORD = NULL.

Answer

Run REVOKE ROLE ANALYST_ROLE FROM USER on the former employee's account.

Question 12

A data governance team wants to classify data in a table using tags. They create a tag 'PII' and apply it to the 'ssn' column. Later, they need to ensure that only users with the 'PII_READER' role can see the actual values, while all other users see a masked value. They decide to use a tag-based masking policy. Which statement accurately describes how tag-based masking policies work in Snowflake?

Accepted Answer

A tag-based masking policy is applied to a tag, and any column with that tag automatically inherits the masking policy, provided the tag is set at the column level and the policy is attached to the tag.. Tag-based masking policies provide a scalable way to protect sensitive data by associating a masking policy with a tag. When a column is tagged, the policy automatically applies. This decouples the masking logic from individual column alterations. The policy attached to the tag defines the masking condition, often using IS_ROLE_IN_SESSION to allow specific roles to see unmasked data. This approach simplifies governance across many tables and columns.

Answer

A tag-based masking policy is only enforced when the tag is set on the column and the user querying the data has the APPLY TAG privilege on the tag.

Answer

A tag-based masking policy requires that the tag be applied at the table level, and the policy then masks all columns in the table that contain sensitive data.

Answer

A tag-based masking policy can only be used with tags that are defined at the account level, not at the schema or database level.

Question 13

A Snowflake user executes a complex query that joins a large fact table with several dimension tables. The query takes longer than expected. The user notices that the query plan shows a significant amount of data being spilled to local disk. The warehouse size is currently MEDIUM. What is the most likely cause of the spillage, and what is the recommended action?

Accepted Answer

The query is too complex for the MEDIUM warehouse; increasing the warehouse size to LARGE will provide more memory and reduce spillage.. Spillage to local disk indicates that the query's intermediate results exceed the available memory in the warehouse. Increasing the warehouse size provides more memory per node, which can accommodate larger working sets and reduce spillage. This is the recommended action when spillage is observed on a MEDIUM warehouse for a complex query.

Answer

The query is experiencing contention due to multiple concurrent queries; setting the warehouse to multi-cluster will reduce spillage.

Answer

The query is spilling due to a lack of local disk space on the warehouse; increasing the warehouse size will provide more local disk.

Answer

The query is spilling because the result cache is disabled; enabling the result cache will prevent spillage.

Question 14

A security administrator for a Snowflake account needs to grant the role FINANCE_ANALYST to a user named Priya. The administrator also wants Priya to be able to grant FINANCE_ANALYST to other users in the future. Which SQL statement should the administrator execute?

Accepted Answer

GRANT ROLE FINANCE_ANALYST TO USER priya WITH GRANT OPTION;. Delegating role administration requires the WITH GRANT OPTION clause on a GRANT ROLE statement directed at the user. This lets the grantee grant that specific role onward without needing SECURITYADMIN or USERADMIN. Simply granting the role or altering the default role does not confer grant authority.

Answer

GRANT ROLE FINANCE_ANALYST TO USER priya;

Answer

ALTER USER priya SET DEFAULT_ROLE = FINANCE_ANALYST;

Answer

GRANT ROLE FINANCE_ANALYST TO ROLE priya;

Question 15

A governance team is implementing data classification in Snowflake and wants to use tags to drive both discovery and enforcement. Which TWO capabilities are provided by Snowflake tags in this context? (Choose two.)

Accepted Answer

Tags can be attached to tables, columns, and other objects to record classification metadata.. Snowflake tags record classification metadata on objects such as tables and columns, supporting discovery and reporting. They also integrate with masking policies through tag-based masking, so any column carrying the tag is automatically protected. Tags do not encrypt data, do not grant privileges, and cannot filter rows in a query, making those options incorrect for this governance use case.

Answer

Tags replace the need for role-based access control by granting privileges to users automatically.

Answer

Tags automatically encrypt the underlying column data at rest.

Answer

Tags can be used in the WHERE clause of a query to filter rows based on the tag value.