COF-C03 Account Management and Data Governance Practice Test 3 — 15 Questions

Question 1

A security administrator needs to grant a custom role the ability to view the definitions of all objects in a database without granting the ability to read the data inside those objects. Which single privilege should be granted at the database level?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MONITOR. The MONITOR privilege at the database level is purpose-built for metadata visibility, allowing a role to see object definitions without reading data. USAGE only enables traversal, SELECT exposes row contents, and OWNERSHIP grants full control. For a governance auditor who must inspect definitions but not data, MONITOR is the correct least-privilege choice.

Answer

OWNERSHIP

Answer

USAGE

Answer

SELECT

Question 2

A Snowflake administrator needs to grant a user the ability to create and manage users and roles, but not have full account administration privileges. Which role should be granted to the user?

Accepted Answer

SECURITYADMIN. The SECURITYADMIN role is specifically designed to manage users and roles, including creating, altering, and dropping them, as well as granting privileges on these objects. It does not have the broader account-level privileges of ACCOUNTADMIN. USERADMIN is more limited and cannot grant privileges. SYSADMIN manages other objects but not users and roles. Thus, SECURITYADMIN is the correct choice for this scenario.

Answer

USERADMIN

Answer

SYSADMIN

Answer

ACCOUNTADMIN

Question 3

An administrator wants to ensure that a set of sensitive tables in a schema cannot be modified or dropped by any role except the schema owner, while still allowing other roles to query them. Which approach best enforces this governance requirement?

Accepted Answer

Use a database role granted to the querying roles with only SELECT on the schema, and keep the tables owned by a dedicated owner role.. Using a database role with only SELECT on the schema and keeping ownership with a dedicated role centralizes read access while reserving modification rights for the owner. This scales as new tables are added and avoids per-table grants. Secure views, masking tags, and manual revokes do not structurally prevent modification, so they fail the requirement.

Answer

Grant SELECT on the tables to the querying roles and revoke all other privileges.

Answer

Create a secure view over each table and grant SELECT on the views instead of the tables.

Answer

Apply a tag to the tables and create a tag-based masking policy.

Question 4

A company is implementing Snowflake data governance and needs to track all data access for auditing purposes. They want to capture every query executed against tables containing sensitive data, including the user, role, and query text. Which Snowflake feature should they use to meet this requirement?

Accepted Answer

Enable Access History in the ACCOUNT_USAGE schema to capture all queries and their accessed objects.. Access History in the ACCOUNT_USAGE schema is specifically designed to track data access, including which columns were read or written by each query. It records user, role, query ID, and objects accessed. This provides a comprehensive audit trail for governance and compliance. Other options either provide limited scope or are not intended for auditing. Access History is the correct feature for tracking sensitive data access.

Answer

Use the QUERY_HISTORY view in the INFORMATION_SCHEMA to see all queries executed in the account.

Answer

Implement Snowflake Audit Logs by enabling the AUDIT_LOGGING parameter at the account level.

Answer

Configure a Snowflake event table to log all SQL statements executed and their results.

Question 5

A data governance team is setting up row-level security for a table containing employee records. They want to create a row access policy that restricts access based on the user's department. The policy should allow users to see only rows where the 'department' column matches their own department, which is stored in a mapping table. Which two statements are true regarding the implementation and behavior of row access policies in Snowflake? (Choose two.)

Accepted Answer

A row access policy can reference a mapping table to determine the user's department by using a subquery within the policy definition.. Row access policies can include subqueries to reference mapping tables, enabling dynamic, data-driven access control. They are evaluated at query runtime, so mapping table changes are reflected immediately. When applied to a table, the policy also applies to views on that table, ensuring consistent enforcement. These two statements accurately describe key behaviors. The other options describe incorrect limitations or bypass mechanisms.

Answer

A row access policy can only be applied to a table if the table has a clustering key defined on the columns used in the policy condition.

Answer

Row access policies are evaluated only at query compilation time, so changes to the mapping table require a new session to take effect.

Answer

A row access policy can be bypassed by users with the ACCOUNTADMIN role, as they have the MANAGE GRANTS privilege.

Question 6

A company needs to ensure that a data analyst role can query only rows from the ORDERS table where the REGION column equals 'APAC'. The security team wants the filter to be enforced automatically without modifying the analyst's queries. Which Snowflake feature should be used?

Accepted Answer

A secure view that selects from ORDERS with a WHERE clause filtering REGION = 'APAC', with the analyst granted access to the view instead of the table.. A secure view is the appropriate feature when the requirement is to encapsulate a row filter and expose only filtered data to a role. The analyst queries the view, not the base table, so the WHERE clause is enforced transparently. This pattern is common for row-level security when a row access policy is not the chosen mechanism.

Answer

A tag named REGION_FILTER applied to the REGION column with a value of 'APAC'.

Answer

A row access policy attached to the ORDERS table that allows rows when the current role is DATA_ANALYST and REGION = 'APAC'.

Answer

A masking policy applied to the REGION column that returns NULL for rows where REGION is not 'APAC'.

Question 7

A security administrator wants to classify columns containing passport numbers and social security numbers so that a policy can automatically apply masking to any column with that classification, regardless of which table it appears in. The tagging must be reusable across many tables in different databases. Which approach should the administrator use?

Accepted Answer

Create a tag named PII_CLASSIFICATION and apply it to each sensitive column using ALTER TABLE ... MODIFY COLUMN ... SET TAG.. Object tagging lets you attach a classification to a column and reuse that same tag across many tables and databases. When a masking policy is associated with the tag, any column carrying that tag is masked automatically, which satisfies the requirement for classification that follows the data rather than being redefined per table.

Answer

Create a secure view over each table and exclude the sensitive columns from the view definition.

Answer

Grant the SELECT privilege on the sensitive columns only to a dedicated role and revoke it from all other roles.

Answer

Use a row access policy on each table and filter rows where the sensitive columns are non-null.

Question 8

An administrator is designing a governance model for a new Snowflake account. The requirement is to ensure that object owners cannot remove or alter masking policies that protect sensitive columns, and that changes to policies are auditable. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Create masking policies in a dedicated schema owned by a security role and grant only the APPLY MASKING POLICY privilege to other roles.. Keeping masking policies in a security-owned schema and relying on policy ownership restrictions ensures object owners cannot remove protections. Granting only the APPLY MASKING POLICY privilege lets others use the policy without controlling it. Auditing is supported because policy changes are recorded in account usage views and can be reviewed by the security role.

Answer

Grant the SECURITYADMIN role to all object owners so they can manage policies centrally.

Answer

Grant the object owners the OWNERSHIP privilege on the masking policies so they can manage them.

Answer

Use the ACCOUNT_USAGE.QUERY_HISTORY view to monitor all queries that reference the protected tables.

Question 9

A data administrator needs to identify which users have failed to log in successfully over the last 30 days due to authentication errors. Which Snowflake object should they query?

Accepted Answer

The LOGIN_HISTORY view.. The LOGIN_HISTORY table function in the ACCOUNT_USAGE schema provides a detailed audit trail of all connection attempts to the account. By filtering for the IS_SUCCESS column set to 'NO' and specifying the timeframe, the administrator can effectively monitor for potential brute-force attempts or configuration errors. This is a critical component for maintaining a robust security posture and ensuring compliance with organizational access monitoring policies.

Answer

The ACCESS_HISTORY view.

Answer

The QUERY_HISTORY view.

Answer

The SESSIONS view.

Question 10

Refer to the exhibit. User 'jdoe' holds the 'manager' role. Which privileges does 'jdoe' possess regarding roles and data access?

Accepted Answer

jdoe has the privileges of the manager and analyst roles.. Snowflake's role-based access control (RBAC) supports hierarchy. When 'analyst' is granted to 'manager', and 'manager' is granted to 'jdoe', 'jdoe' inherits all privileges assigned to both the 'manager' and 'analyst' roles. This inheritance model allows for complex organizational structures while keeping grant management simple. It is crucial for governance, as it prevents over-privileging by allowing admins to nest permissions logically rather than assigning every individual role directly to users.

Answer

jdoe has the privileges of the manager role only.

Answer

jdoe must explicitly switch to the analyst role to see its data.

Answer

jdoe only has access to objects created by the analyst role.

Question 11

A security administrator needs to ensure that all data loaded into Snowflake is encrypted using a customer-managed key. Which feature should be configured?

Accepted Answer

Tri-Secret Secure.. Tri-Secret Secure is the Snowflake feature that enables customers to maintain control over their data encryption keys. By combining a customer-managed key with a Snowflake-managed key, the organization ensures that data is encrypted at the storage layer while allowing for key rotation and revocation. This is a vital component for high-compliance industries requiring total control over the data lifecycle and access to encrypted storage buckets.

Answer

Snowflake-managed keys with automatic rotation.

Answer

Always Encrypted feature.

Answer

Column-Level Security encryption.

Question 12

Which feature in Snowflake allows you to track and audit all SQL queries executed across the entire account?

Accepted Answer

QUERY_HISTORY.. The QUERY_HISTORY table function and the ACCOUNT_USAGE.QUERY_HISTORY view are the primary methods for auditing query activity. These objects record every query submitted, who submitted it, the warehouse used, and the execution time. This is critical for data governance because it provides a forensic trail for compliance, troubleshooting, and understanding how data is accessed and modified over time by different users.

Answer

ACCESS_HISTORY.

Answer

SESSION_HISTORY.

Answer

DATA_TRANSFER_HISTORY.

Question 13

Refer to the exhibit. If a user with the 'ANALYST' role queries a table protected by this policy, what will they see?

Accepted Answer

The string '***@***.com'.. The MASKING POLICY uses the CURRENT_ROLE() function to determine visibility. Since the 'ANALYST' role is not included in the 'IN' clause of the CASE statement, the query will evaluate to the ELSE condition. Consequently, the sensitive email data will be replaced by the literal string '***@***.com'. This demonstrates how attribute-based access control works in Snowflake, ensuring that sensitive data exposure is restricted based on the user's active role.

Answer

The actual email addresses.

Answer

An error message indicating insufficient privileges.

Answer

NULL values.

Question 14

An administrator wants to ensure that a specific role can only access Snowflake from the corporate office IP range. Which tool should they use?

Accepted Answer

Network Policies.. Network Policies are the mechanism to restrict access by IP address. By creating a policy and applying it to a specific user or the entire account, administrators can ensure that connections only succeed from authorized locations. This is a foundational governance practice to protect against unauthorized access from external or insecure network locations, effectively creating a perimeter around the data platform.

Answer

Row Access Policies.

Answer

Granting specific network privileges.

Answer

Setting a Session Policy.

Question 15

A user is assigned the 'SECURITYADMIN' role. Which of the following tasks can this user perform?

Accepted Answer

Grant and revoke privileges to other roles.. The SECURITYADMIN role is specifically designed for managing security objects such as roles, grants, and users. This role has the power to grant and revoke privileges to other roles. Keeping this role separate from SYSADMIN (which manages warehouses and databases) is a key governance practice known as Segregation of Duties, ensuring that no single person has unchecked control over both security and data.

Answer

Create and manage warehouses.

Answer

Modify account-level billing settings.

Answer

Drop databases without restriction.