COF-C03 Account Management and Data Governance — 40 Questions

Question 1

Which TWO of the following statements are true regarding the ACCOUNTADMIN role?

Accepted Answer

It can manage billing and account-level settings.. The ACCOUNTADMIN role is the highest level of administrative access in Snowflake. It is designed for critical account-level tasks, such as managing users, billing, and system-wide security settings. Restricting its use is a best practice for governance to minimize the blast radius of potential compromises. Knowing when to use it versus lower-privilege roles like SECURITYADMIN or USERADMIN is a core requirement for passing the certification exam.

Answer

It is the only role that can manage data in every database.

Answer

It should be used for daily data warehouse maintenance.

Answer

It can bypass all Row Access Policies by default.

Question 2

Which THREE of the following are valid methods for ensuring data is encrypted during transit between the client and Snowflake?

Accepted Answer

Using HTTPS for all connections.. Data in transit is protected by industry-standard encryption protocols. Snowflake requires all connections to be encrypted using TLS, regardless of the client tool being used. Understanding these security defaults is essential for governance, as it confirms that data is protected from interception as it moves across public or private networks into the Snowflake ecosystem, meeting compliance standards like SOC2 or HIPAA.

Answer

Implementing a custom SSL certificate on the client.

Answer

Disabling the use of standard drivers.

Question 3

A company requires all users to authenticate using MFA. Where is this requirement enforced within Snowflake?

Accepted Answer

By requiring the user to enroll in Duo Security.. Multi-Factor Authentication (MFA) is a critical security control in Snowflake. It can be enforced at the user level, where individual users are required to register for Duo Security, or at the network level using Network Policies. This layered approach allows administrators to enforce MFA for all users or selectively based on the network origin, ensuring that access to the platform remains secure even if passwords are compromised.

Answer

Inside the Account Configuration settings.

Answer

Using a Network Policy.

Answer

Through a database-level GRANT.

Question 4

Which THREE actions are permitted for the PUBLIC role?

Accepted Answer

It can create its own user profile settings.. The PUBLIC role is a special system role that is automatically assigned to every user in the account. By default, it holds limited permissions to allow users to interact with the platform safely. Understanding the default permissions of this role is vital for governance, as it prevents administrators from accidentally granting excessive permissions to every user in the account during initial setup.

Answer

It can view account-wide usage history.

Answer

It can drop tables in any database.

Question 5

Which of the following correctly describes the relationship between the SYSADMIN and SECURITYADMIN roles?

Accepted Answer

They both report to the ACCOUNTADMIN role.. In Snowflake's recommended security model, these roles are separate to enforce Segregation of Duties. SYSADMIN is responsible for creating warehouses, databases, and other data objects, while SECURITYADMIN is responsible for managing users and roles. By keeping these separate, no single individual has total control over both the data infrastructure and the access rights to that infrastructure, which is a fundamental requirement for secure governance and audit compliance.

Answer

SECURITYADMIN is a child of SYSADMIN.

Answer

SYSADMIN can create roles, but not grant them.

Answer

They must be merged into one role for simplicity.

Question 6

Which Snowflake feature allows an administrator to track and audit all SQL queries executed against the account over a long period?

Accepted Answer

The ACCOUNT_USAGE.QUERY_HISTORY view.. The Query History feature in Snowflake, accessible via the web interface or the 'QUERY_HISTORY' table function, provides a comprehensive audit trail. This is essential for governance and compliance, as it allows administrators to see exactly who ran which query, when it ran, and how much compute resources were consumed. Retaining this data is critical for monitoring access patterns and detecting potential security anomalies within the account.

Answer

The INFORMATION_SCHEMA.QUERY_HISTORY view.

Answer

The MASKING_POLICY_HISTORY table.

Answer

The ROLE_HISTORY function.

Question 7

A security analyst needs to determine which users have accessed a specific table in the last month. Which approach is most efficient and reliable?

Accepted Answer

Use the ACCESS_HISTORY view in the ACCOUNT_USAGE schema.. The ACCESS_HISTORY view in the ACCOUNT_USAGE schema is the definitive source for tracking object access. It logs every operation, including the specific tables, columns, and rows touched by any query. By joining this view with the USERS and ROLES views, an analyst can pinpoint exactly which identities accessed the data, providing a high-fidelity audit trail for compliance and security investigations, far exceeding the capabilities of basic query logs.

Answer

Query the QUERY_HISTORY view and parse the SQL text.

Answer

Enable object-level auditing in the UI.

Answer

Review the login history for all users.

Question 8

Which Snowflake concept ensures that data remains available and consistent even if an entire availability zone (AZ) goes offline?

Accepted Answer

Account-level high availability.. Snowflake's architecture provides high availability (HA) by replicating data across multiple availability zones within a cloud region. This is transparent to the user; when an AZ fails, the platform automatically routes traffic to the remaining zones. This design ensures business continuity and data durability without requiring manual intervention, making it a cornerstone of Snowflake's enterprise-grade platform for mission-critical data governance and availability requirements.

Answer

Multi-region replication.

Answer

Data clustering on Micro-partitions.

Answer

Virtual Warehouse auto-suspend.

Question 9

If an organization wants to ensure that specific columns in a table can only be queried by users with a 'FINANCE' tag, what is the best approach?

Accepted Answer

Create a Dynamic Data Masking policy that uses tag-based conditions.. The most effective method is to use a masking policy that references the tag. By creating a policy that checks for the presence or value of a tag on an object, the organization can dynamically apply security logic. This approach is highly scalable and decouples the security logic from individual user permissions, allowing governance teams to manage access via tags rather than complex role assignments.

Answer

Use a Row Access Policy with a hardcoded list of users.

Answer

Implement column-level GRANT permissions.

Answer

Manually recreate the table for each role.

Question 10

Which TWO of the following are true regarding the behavior of 'Secure Views' in Snowflake?

Accepted Answer

The query plan is hidden from non-authorized users.. Secure Views are designed to protect underlying data and query logic from unauthorized users. When a view is marked as 'SECURE', Snowflake prevents the query plan from being visible to unauthorized users, and the engine disables certain optimizations that could reveal data patterns. This is a critical governance tool for multi-tenant or highly sensitive environments where even the structure of the data must be kept hidden from non-privileged users.

Answer

Performance optimizations are always disabled.

Answer

They automatically apply data masking to all columns.

Answer

They allow any user to see the data.

Question 11

An organization wants to restrict access to data based on the user's geographic location. Which combination of features should be used?

Accepted Answer

Use a Row Access Policy with CURRENT_USER or session variables.. Combining Row Access Policies with session variables or user attributes is the most scalable way to enforce geo-fencing in Snowflake. By setting a user-level attribute (e.g., 'REGION') and checking it against the row data in a policy, the system ensures that users only see rows matching their authorized region. This is a best-practice implementation for regulatory compliance, ensuring that local data privacy laws are upheld without requiring fragmented data storage.

Answer

Use a Dynamic Data Masking policy.

Answer

Create separate databases for each region.

Answer

Use data masking with a CASE statement.

Question 12

Which object type in Snowflake is best suited for centralizing the management of security policies and monitoring access across the entire account?

Accepted Answer

The 'SNOWFLAKE' shared database.. The 'Access History' and 'Query History' views in the Snowflake Account Usage schema provide centralized auditing and monitoring. Governance teams use these to track who accessed which sensitive data and when. Understanding where these logs are stored is crucial for compliance reporting and data protection auditing. Centralizing this information allows administrators to proactively identify unauthorized access attempts and maintain a robust posture consistent with organizational security policies.

Answer

A standard user role with 'AUDIT' permissions.

Answer

A stored procedure that runs periodically.

Answer

A resource monitor attached to the account.

Question 13

Which TWO of the following statements regarding the 'ACCOUNTADMIN' role are correct?

Accepted Answer

It can view and modify all objects within the entire Snowflake account.. The ACCOUNTADMIN role is the highest level of privilege in Snowflake, designed for account-level administrative tasks. It is essential to understand that this role has unrestricted access to all data and metadata. Because of this, security best practices dictate that it should only be used for necessary setup and maintenance tasks, and never for routine analytical or operational workloads to reduce the risk of accidental data exposure or deletion.

Answer

It is automatically assigned to all new users created in the account.

Answer

It can be renamed to a custom name like 'SUPERUSER'.

Answer

It is the only role that can create databases.

Question 14

Which THREE of the following are valid methods for managing user authentication in Snowflake?

Accepted Answer

Key-pair authentication.. Snowflake supports multiple authentication methods to balance security and usability. Managing how users enter the platform is the first line of defense in a data governance strategy. By understanding these methods, administrators can enforce multi-factor authentication (MFA) and integrate with external identity providers (IdPs), ensuring that only verified users can access the Snowflake environment while maintaining compliance with organizational standards for identity and access management.

Answer

Direct database credentials sharing.

Answer

Hard-coding passwords in source code.

Question 15

What is the consequence of dropping a database that contains objects with masking policies applied?

Accepted Answer

The masking policies remain in the account but the tables are gone.. In Snowflake, dropping a container object like a database automatically drops all contained objects, including schemas and tables, regardless of the policies attached to them. This behavior highlights the importance of governance over object deletion permissions. Only highly privileged roles should have the authority to drop databases, as the action is destructive and can lead to significant data loss and the permanent removal of associated security policy configurations that might be required for compliance.

Answer

The drop operation is blocked until policies are detached.

Answer

Masking policies are automatically deleted.

Answer

The user receives a warning that policies exist.

Question 16

A Snowflake administrator wants to enforce that only users with the role PAYROLL_ADMIN can view unmasked values in the SALARY column of the HR.EMPLOYEES table, while all other users see a fixed value. The administrator creates a masking policy and applies it to the SALARY column. Which statement accurately describes how the masking policy must be written to meet this requirement?

Accepted Answer

The policy must use CURRENT_ROLE() in a CASE expression to return the unmasked value when CURRENT_ROLE() = 'PAYROLL_ADMIN' and a masked value otherwise.. The correct approach is to embed role-based logic inside the masking policy. Snowflake masking policies evaluate the context of the querying user, so using CURRENT_ROLE() in a CASE expression allows the policy to return the original value for PAYROLL_ADMIN and a masked value for everyone else. This directly enforces the requirement without needing special privileges or separate policy assignments.

Answer

The policy must grant the PAYROLL_ADMIN role the MASKING EXEMPT privilege so that role bypasses all masking policies on the SALARY column.

Answer

The policy must use IS_ROLE_IN_SESSION() to check if PAYROLL_ADMIN is active, returning the unmasked value if true and a masked value otherwise.

Answer

The policy must be applied only to the PAYROLL_ADMIN role using an ALTER MASKING POLICY command, so that only that role sees unmasked data.

Question 17

A security administrator wants to enforce that all new tables created in the database 'SENSITIVE_DB' must have a tag 'DATA_CLASSIFICATION' applied with a value of 'CONFIDENTIAL'. Existing tables should not be affected. Which Snowflake feature should be used to achieve this?

Accepted Answer

Tag-based governance policy. Tag-based governance policies in Snowflake enable administrators to enforce that certain tags are applied to objects when they are created. By defining a policy that requires the 'DATA_CLASSIFICATION' tag with a value of 'CONFIDENTIAL' for tables in 'SENSITIVE_DB', the administrator ensures that all new tables comply. Existing tables are not modified, aligning with the requirement.

Answer

Object tagging with allowed values

Answer

Tag propagation

Answer

Tag-based masking policy

Question 18

A Snowflake administrator needs to grant the privilege to create and manage users and roles to a new security team member. Which role should be granted to this user to provide the necessary privileges while following the principle of least privilege?

Accepted Answer

SECURITYADMIN. SECURITYADMIN is the predefined role that includes the MANAGE GRANTS privilege and can create and manage users and roles. It provides the necessary capabilities without the broad permissions of ACCOUNTADMIN. This aligns with the principle of least privilege, as it limits the user to security administration tasks rather than full account control.

Answer

SYSADMIN

Answer

ACCOUNTADMIN

Answer

USERADMIN

Question 19

A company wants to implement data governance using Snowflake tags. Which two statements are true regarding tag-based masking policies? (Choose two.)

Accepted Answer

Tag-based masking policies require the tag to be assigned to the column before the masking policy can be applied.. Tag-based masking policies leverage tags to apply masking consistently across columns. When a tag is assigned to a column, the associated masking policy is enforced. This allows a single policy to protect many columns with the same tag, and the tag must be present for the policy to apply. These policies operate at the column level and can be configured to exempt certain roles.

Answer

Tag-based masking policies automatically mask data for all users, including those with the ACCOUNTADMIN role.

Answer

A tag-based masking policy can be applied to a table to mask all columns at once.

Answer

Tag-based masking policies can be used to enforce row-level security.

Question 20

A security administrator wants to allow a group of users to query only the columns in the CUSTOMERS table that contain non-sensitive data, while preventing them from seeing the SSN and CREDIT_CARD columns. The users still need to be able to run SELECT * queries. Which Snowflake feature should be used?

Accepted Answer

Secure view with column projection. A secure view that projects only the non-sensitive columns allows users to run SELECT * against the view without exposing SSN or CREDIT_CARD. Because the view is secure, its definition is hidden, and users cannot see the underlying table. Column-level masking would still expose the columns (with masked values), and row access policies filter rows, not columns. Tags alone do not enforce access control.

Answer

Row access policy

Answer

Column-level masking policy

Answer

Object tagging with a sensitivity tag