COF-C03 Account Management and Data Governance — Timed 15 Questions

Question 1

Which TWO of the following statements are true regarding the ACCOUNTADMIN role?

Accepted Answer

It can manage billing and account-level settings.. The ACCOUNTADMIN role is the highest level of administrative access in Snowflake. It is designed for critical account-level tasks, such as managing users, billing, and system-wide security settings. Restricting its use is a best practice for governance to minimize the blast radius of potential compromises. Knowing when to use it versus lower-privilege roles like SECURITYADMIN or USERADMIN is a core requirement for passing the certification exam.

Answer

It is the only role that can manage data in every database.

Answer

It should be used for daily data warehouse maintenance.

Answer

It can bypass all Row Access Policies by default.

Question 2

Which THREE of the following are valid methods for ensuring data is encrypted during transit between the client and Snowflake?

Accepted Answer

Using HTTPS for all connections.. Data in transit is protected by industry-standard encryption protocols. Snowflake requires all connections to be encrypted using TLS, regardless of the client tool being used. Understanding these security defaults is essential for governance, as it confirms that data is protected from interception as it moves across public or private networks into the Snowflake ecosystem, meeting compliance standards like SOC2 or HIPAA.

Answer

Implementing a custom SSL certificate on the client.

Answer

Disabling the use of standard drivers.

Question 3

A company requires all users to authenticate using MFA. Where is this requirement enforced within Snowflake?

Accepted Answer

By requiring the user to enroll in Duo Security.. Multi-Factor Authentication (MFA) is a critical security control in Snowflake. It can be enforced at the user level, where individual users are required to register for Duo Security, or at the network level using Network Policies. This layered approach allows administrators to enforce MFA for all users or selectively based on the network origin, ensuring that access to the platform remains secure even if passwords are compromised.

Answer

Inside the Account Configuration settings.

Answer

Using a Network Policy.

Answer

Through a database-level GRANT.

Question 4

Which THREE actions are permitted for the PUBLIC role?

Accepted Answer

It can create its own user profile settings.. The PUBLIC role is a special system role that is automatically assigned to every user in the account. By default, it holds limited permissions to allow users to interact with the platform safely. Understanding the default permissions of this role is vital for governance, as it prevents administrators from accidentally granting excessive permissions to every user in the account during initial setup.

Answer

It can view account-wide usage history.

Answer

It can drop tables in any database.

Question 5

Which of the following correctly describes the relationship between the SYSADMIN and SECURITYADMIN roles?

Accepted Answer

They both report to the ACCOUNTADMIN role.. In Snowflake's recommended security model, these roles are separate to enforce Segregation of Duties. SYSADMIN is responsible for creating warehouses, databases, and other data objects, while SECURITYADMIN is responsible for managing users and roles. By keeping these separate, no single individual has total control over both the data infrastructure and the access rights to that infrastructure, which is a fundamental requirement for secure governance and audit compliance.

Answer

SECURITYADMIN is a child of SYSADMIN.

Answer

SYSADMIN can create roles, but not grant them.

Answer

They must be merged into one role for simplicity.

Question 6

Which Snowflake feature allows an administrator to track and audit all SQL queries executed against the account over a long period?

Accepted Answer

The ACCOUNT_USAGE.QUERY_HISTORY view.. The Query History feature in Snowflake, accessible via the web interface or the 'QUERY_HISTORY' table function, provides a comprehensive audit trail. This is essential for governance and compliance, as it allows administrators to see exactly who ran which query, when it ran, and how much compute resources were consumed. Retaining this data is critical for monitoring access patterns and detecting potential security anomalies within the account.

Answer

The INFORMATION_SCHEMA.QUERY_HISTORY view.

Answer

The MASKING_POLICY_HISTORY table.

Answer

The ROLE_HISTORY function.

Question 7

A security analyst needs to determine which users have accessed a specific table in the last month. Which approach is most efficient and reliable?

Accepted Answer

Use the ACCESS_HISTORY view in the ACCOUNT_USAGE schema.. The ACCESS_HISTORY view in the ACCOUNT_USAGE schema is the definitive source for tracking object access. It logs every operation, including the specific tables, columns, and rows touched by any query. By joining this view with the USERS and ROLES views, an analyst can pinpoint exactly which identities accessed the data, providing a high-fidelity audit trail for compliance and security investigations, far exceeding the capabilities of basic query logs.

Answer

Query the QUERY_HISTORY view and parse the SQL text.

Answer

Enable object-level auditing in the UI.

Answer

Review the login history for all users.

Question 8

Which Snowflake concept ensures that data remains available and consistent even if an entire availability zone (AZ) goes offline?

Accepted Answer

Account-level high availability.. Snowflake's architecture provides high availability (HA) by replicating data across multiple availability zones within a cloud region. This is transparent to the user; when an AZ fails, the platform automatically routes traffic to the remaining zones. This design ensures business continuity and data durability without requiring manual intervention, making it a cornerstone of Snowflake's enterprise-grade platform for mission-critical data governance and availability requirements.

Answer

Multi-region replication.

Answer

Data clustering on Micro-partitions.

Answer

Virtual Warehouse auto-suspend.

Question 9

If an organization wants to ensure that specific columns in a table can only be queried by users with a 'FINANCE' tag, what is the best approach?

Accepted Answer

Create a Dynamic Data Masking policy that uses tag-based conditions.. The most effective method is to use a masking policy that references the tag. By creating a policy that checks for the presence or value of a tag on an object, the organization can dynamically apply security logic. This approach is highly scalable and decouples the security logic from individual user permissions, allowing governance teams to manage access via tags rather than complex role assignments.

Answer

Use a Row Access Policy with a hardcoded list of users.

Answer

Implement column-level GRANT permissions.

Answer

Manually recreate the table for each role.

Question 10

Which TWO of the following are true regarding the behavior of 'Secure Views' in Snowflake?

Accepted Answer

The query plan is hidden from non-authorized users.. Secure Views are designed to protect underlying data and query logic from unauthorized users. When a view is marked as 'SECURE', Snowflake prevents the query plan from being visible to unauthorized users, and the engine disables certain optimizations that could reveal data patterns. This is a critical governance tool for multi-tenant or highly sensitive environments where even the structure of the data must be kept hidden from non-privileged users.

Answer

Performance optimizations are always disabled.

Answer

They automatically apply data masking to all columns.

Answer

They allow any user to see the data.

Question 11

An organization wants to restrict access to data based on the user's geographic location. Which combination of features should be used?

Accepted Answer

Use a Row Access Policy with CURRENT_USER or session variables.. Combining Row Access Policies with session variables or user attributes is the most scalable way to enforce geo-fencing in Snowflake. By setting a user-level attribute (e.g., 'REGION') and checking it against the row data in a policy, the system ensures that users only see rows matching their authorized region. This is a best-practice implementation for regulatory compliance, ensuring that local data privacy laws are upheld without requiring fragmented data storage.

Answer

Use a Dynamic Data Masking policy.

Answer

Create separate databases for each region.

Answer

Use data masking with a CASE statement.

Question 12

Which object type in Snowflake is best suited for centralizing the management of security policies and monitoring access across the entire account?

Accepted Answer

The 'SNOWFLAKE' shared database.. The 'Access History' and 'Query History' views in the Snowflake Account Usage schema provide centralized auditing and monitoring. Governance teams use these to track who accessed which sensitive data and when. Understanding where these logs are stored is crucial for compliance reporting and data protection auditing. Centralizing this information allows administrators to proactively identify unauthorized access attempts and maintain a robust posture consistent with organizational security policies.

Answer

A standard user role with 'AUDIT' permissions.

Answer

A stored procedure that runs periodically.

Answer

A resource monitor attached to the account.

Question 13

Which TWO of the following statements regarding the 'ACCOUNTADMIN' role are correct?

Accepted Answer

It can view and modify all objects within the entire Snowflake account.. The ACCOUNTADMIN role is the highest level of privilege in Snowflake, designed for account-level administrative tasks. It is essential to understand that this role has unrestricted access to all data and metadata. Because of this, security best practices dictate that it should only be used for necessary setup and maintenance tasks, and never for routine analytical or operational workloads to reduce the risk of accidental data exposure or deletion.

Answer

It is automatically assigned to all new users created in the account.

Answer

It can be renamed to a custom name like 'SUPERUSER'.

Answer

It is the only role that can create databases.

Question 14

Which THREE of the following are valid methods for managing user authentication in Snowflake?

Accepted Answer

Key-pair authentication.. Snowflake supports multiple authentication methods to balance security and usability. Managing how users enter the platform is the first line of defense in a data governance strategy. By understanding these methods, administrators can enforce multi-factor authentication (MFA) and integrate with external identity providers (IdPs), ensuring that only verified users can access the Snowflake environment while maintaining compliance with organizational standards for identity and access management.

Answer

Direct database credentials sharing.

Answer

Hard-coding passwords in source code.

Question 15

What is the consequence of dropping a database that contains objects with masking policies applied?

Accepted Answer

The masking policies remain in the account but the tables are gone.. In Snowflake, dropping a container object like a database automatically drops all contained objects, including schemas and tables, regardless of the policies attached to them. This behavior highlights the importance of governance over object deletion permissions. Only highly privileged roles should have the authority to drop databases, as the action is destructive and can lead to significant data loss and the permanent removal of associated security policy configurations that might be required for compliance.

Answer

The drop operation is blocked until policies are detached.

Answer

Masking policies are automatically deleted.

Answer

The user receives a warning that policies exist.