COF-C03 Data Collaboration Practice Test 3 — 15 Questions

Question 1

A data provider wants to share a subset of data with a specific consumer while ensuring the consumer cannot see any other tables in the same database. What is the most secure and efficient method to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Secure View in a dedicated share-ready schema.. Secure Views are essential for sharing specific data subsets because they hide the underlying query logic and schema structure from the consumer. By using a Secure View, the provider maintains granular control over column and row visibility, ensuring data privacy across account boundaries. This approach prevents unauthorized metadata discovery, which is critical in multi-tenant data sharing environments where isolation between different business units or external partners must be strictly maintained for compliance.

Answer

Grant usage on the entire database to the consumer's role.

Answer

Create a shared database and grant access to the base tables.

Answer

Enable Secure Data Sharing and grant SELECT on all tables.

Question 2

Which object acts as the primary container for sharing data with external Snowflake accounts?

Accepted Answer

Share. A Share is the fundamental object in Snowflake that allows a provider to grant access to specific database objects without transferring the data itself. By using Shares, organizations can securely collaborate by allowing consumers to query the provider's data as if it were local to their own account. This architecture is vital for data governance, as it prevents data duplication and ensures consistent security policies across all shared data assets within the ecosystem.

Answer

Data Warehouse

Answer

Database

Answer

Integration

Question 3

Which TWO statements are true regarding the costs associated with Data Sharing in Snowflake?

Accepted Answer

The data provider pays for the storage costs of the shared data.. Understanding the cost model is crucial for data providers. In Snowflake, the data provider pays for the storage of the shared data, as it resides in their account. However, the consumer is responsible for the compute costs incurred when running queries against that shared data. This separation of costs ensures that data providers can scale their offerings based on data volume, while consumers maintain control over their own compute spend and workload optimization efforts.

Answer

The data provider is responsible for all compute costs incurred by the consumer.

Answer

The consumer pays for the storage costs of the shared data.

Answer

Both the provider and consumer share the total compute costs equally.

Question 4

Which feature should a provider use if they need to allow a consumer to access data based on the consumer's specific identity or organizational attributes?

Accepted Answer

Row Access Policies. Row-level security, implemented via Row Access Policies, is the correct tool for filtering data dynamically based on user context. In a sharing context, the policy evaluates the current user's attributes at query time. This allows a single shared table to serve different consumers with customized views of the data, ensuring that each consumer only sees the records they are authorized to access without creating separate tables for every partner.

Answer

Standard Views

Answer

Data Masking Policies

Answer

Account-level Replication

Question 5

A provider shares a database with a consumer using a direct share. The consumer reports that queries against the shared database fail with an error indicating the database does not exist, even though the share was successfully created and granted to the consumer account. The provider confirmed that the share contains the necessary tables and that the consumer account has been added to the share. What is the most likely cause of the issue?

Accepted Answer

The consumer has not created a database from the share using CREATE DATABASE ... FROM SHARE.. For a consumer to access a direct share, they must create a database from the share using CREATE DATABASE ... FROM SHARE. The provider's role is to create the share, grant privileges on objects to the share, and add the consumer account. The consumer must then mount the share by creating a database. Without this step, the shared database is not visible, leading to errors when querying.

Answer

The provider did not grant the USAGE privilege on the database to the consumer's role.

Answer

The consumer's account is in a different region than the provider's account, and cross-region sharing is not enabled.

Answer

The provider did not include a secure view in the share, so the consumer cannot access the tables.

Question 6

A Snowflake provider wants to share a secure view with a consumer. The view is defined on a table in a different database than the one containing the view, and the provider must ensure the consumer cannot access the underlying base table directly. Which action should the provider take?

Accepted Answer

Grant USAGE on the database and schema containing the secure view, and SELECT on the secure view, to the share.. When sharing a secure view that references objects in other databases, the provider must grant USAGE on the database and schema that contain the view, and SELECT on the view, to the share. The base table's database is not shared, and the secure view's owner's rights allow access to the base table without exposing it to the consumer.

Answer

Grant USAGE on the database containing the base table to the share.

Answer

Add the base table to the share and rely on the secure view to restrict access.

Answer

Create a new role with access to the base table and grant that role to the share.

Question 7

A data provider at ACME Corp has created a share named REGIONAL_SALES_SHARE and added a secure view on the SALES table. The provider now wants to grant a specific consumer account, named CONSUMER_ACCT, access to this share. Which command should the provider use to accomplish this?

Accepted Answer

ALTER SHARE REGIONAL_SALES_SHARE ADD ACCOUNT = CONSUMER_ACCT;. To share data with a specific consumer account, the provider must add that account to the share using ALTER SHARE ... ADD ACCOUNT. This grants the consumer account the ability to create a database from the share. The other commands either have incorrect syntax or serve different purposes, such as granting privileges within an account rather than authorizing an external account.

Answer

GRANT IMPORTED PRIVILEGES ON DATABASE REGIONAL_SALES_SHARE TO ACCOUNT CONSUMER_ACCT;

Answer

GRANT USAGE ON SHARE REGIONAL_SALES_SHARE TO ACCOUNT CONSUMER_ACCT;

Answer

CREATE SHARE REGIONAL_SALES_SHARE GRANT TO ACCOUNT CONSUMER_ACCT;

Question 8

A provider wants to share data with a consumer and ensure that the consumer can only read the data but cannot create any objects in the shared database. The provider has already created a share and granted USAGE on the database and schema, and SELECT on the table. What additional step, if any, is required to enforce read-only access?

Accepted Answer

No additional step is required; the consumer automatically has read-only access to shared databases.. Shared databases in Snowflake are read-only for consumers. The provider grants USAGE on the database and schema, and SELECT on objects, which are read-only privileges. Consumers cannot create or modify objects in a shared database. No additional configuration is needed to enforce read-only access because it is the default and only behavior for shares.

Answer

The provider must grant the CREATE privilege on the schema to the share to allow the consumer to create objects.

Answer

The provider must set the share to read-only mode using the ALTER SHARE command.

Answer

The provider must revoke the USAGE privilege on the database from the share to prevent object creation.

Question 9

A provider account named PROVIDER_ACCT has created a share named PARTNER_SHARE and granted SELECT on a secure view to it. The provider now needs to make this share available to a specific consumer account named CONSUMER_ACCT. Which single command should the provider execute to accomplish this?

Accepted Answer

ALTER SHARE PARTNER_SHARE ADD ACCOUNT = CONSUMER_ACCT;. Sharing to a specific consumer requires the provider to attach the consumer's account to the share. The ALTER SHARE ... ADD ACCOUNT statement performs this binding and is executed in the provider account. Once added, the consumer sees the share as an inbound share and can create a database from it, gaining read-only access to the granted objects.

Answer

GRANT USAGE ON SHARE PARTNER_SHARE TO ACCOUNT CONSUMER_ACCT;

Answer

CREATE SHARE PARTNER_SHARE FOR ACCOUNT = CONSUMER_ACCT;

Answer

ALTER ACCOUNT CONSUMER_ACCT ADD SHARE PARTNER_SHARE;

Question 10

A consumer has created a database from a share provided by a partner. The consumer wants to query the shared data but receives an error indicating insufficient privileges. Which role must the consumer's user be granted to access the shared database?

Accepted Answer

A role with the IMPORTED PRIVILEGES privilege on the shared database. To access a shared database, the consumer must grant the IMPORTED PRIVILEGES privilege on that database to a role and then grant that role to the user. This privilege is specific to shared databases and is required for any role that needs to query the shared objects. Other roles like ACCOUNTADMIN or SYSADMIN do not have this privilege by default.

Answer

The PUBLIC role

Answer

The ACCOUNTADMIN role

Answer

The SYSADMIN role

Question 11

A provider has shared a database with a consumer. The consumer reports that they can see the shared database but cannot query any tables because they get an error about insufficient privileges. The provider used the following command to create the share: CREATE SHARE MY_SHARE; then added a database and a table to the share. The provider also granted USAGE on the database and SELECT on the table to a role named SHARE_ROLE, and then granted SHARE_ROLE to MY_SHARE. What is the most likely cause of the consumer's issue?

Accepted Answer

The provider must also grant USAGE on the schema containing the table to SHARE_ROLE.. To share a table, the provider must grant USAGE on the database, USAGE on the schema, and SELECT on the table to the share. The scenario omits the schema usage grant, which is required for the consumer to access objects within that schema. Without it, queries will fail with insufficient privileges. Adding the schema usage grant resolves the issue.

Answer

The consumer must create a database from the share before they can query the tables.

Answer

The share was not granted to the consumer account using ALTER SHARE ... ADD ACCOUNT.

Answer

The provider must use a secure view instead of a table to share data.

Question 12

A provider has created a share and added a table. The consumer reports that they can see the shared database and schema but cannot see the table. The provider confirms the table was added with ALTER SHARE ... ADD TABLE. Which additional privilege must the provider grant to the share so the consumer can query the table?

Accepted Answer

SELECT on the table, granted to the share.. When a table is added to a share, the provider must also grant SELECT on that table to the share. The consumer already has visibility of the database and schema, so the missing element is table-level read access. Granting SELECT to the share is the documented step that enables queries. Other privileges like USAGE, REFERENCES, or OWNERSHIP do not provide the needed row-level read permission.

Answer

REFERENCES on the table, granted to the share.

Answer

OWNERSHIP on the table, transferred to the share.

Answer

USAGE on the database and schema containing the table, granted to the share.

Question 13

A provider shares a secure view named SALES_VIEW with a consumer. The view references a table in the provider's database. The provider later renames the underlying table. What is the impact on the consumer's access to SALES_VIEW?

Accepted Answer

The consumer's access is unaffected because the view continues to resolve to the renamed table.. Views in Snowflake reference base objects by internal object identifiers, not by name. Renaming a table therefore does not invalidate dependent views, and a shared secure view continues to function for the consumer. The consumer's access remains intact without any action on either side, which is the key behavior tested here.

Answer

The consumer must recreate the database from the share to see the renamed table through the view.

Answer

The consumer loses access because the view definition becomes invalid and must be re-created.

Answer

The consumer sees an error only if the renamed table is also granted directly in the share.

Question 14

A provider is preparing to share a secure view that references a table in another database. The provider must ensure the consumer can query the view but cannot access the base table. Which two actions must the provider take? (Choose two.)

Accepted Answer

Grant SELECT on the secure view to the share.. To share a secure view that references a table in another database, the provider must grant USAGE on the database and schema containing the view, and SELECT on the view, to the share. These two grants allow the consumer to query the view. The base table remains private because the view executes with the owner's rights, and no privileges on the base table are granted.

Answer

Grant SELECT on the base table to the share.

Answer

Create a new role that has access to the base table and grant that role to the share.

Answer

Grant USAGE on the database and schema containing the base table to the share.

Question 15

A data provider at a healthcare analytics company wants to share live patient-readmission metrics with a partner hospital. The partner must query the data with low latency and the provider must retain full ownership and control of the underlying tables. The provider creates a share and grants USAGE on a secure view to the share. Which action must the provider perform next so the partner account can mount and query the shared data?

Accepted Answer

Add the partner's account to the share using ALTER SHARE ... ADD ACCOUNTS.. For a direct share, the provider grants object privileges to the share, then associates the consumer account with the share. The consumer then creates a database from the share to query it. Adding the account is mandatory because privileges alone do not cross account boundaries; the share must be explicitly bound to the consumer's account before it can be mounted.

Answer

Create a database from the share in the provider account and grant USAGE to the partner.

Answer

Publish the share as a listing on the Snowflake Marketplace.

Answer

Grant the CONSUME privilege on the share to the partner's account.