COF-C03 Data Collaboration Practice Test 4 — 15 Questions

Question 1

A provider wants to share a database with a consumer account. After creating the share and granting the necessary privileges, which command must the provider run to make the share available to the consumer account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ALTER SHARE share_name ADD ACCOUNT = consumer_account_locator;. The provider makes a share available to a consumer by adding the consumer's account to the share with ALTER SHARE ... ADD ACCOUNT. This is the standard account-to-account sharing step. Other commands either invent syntax, reverse the direction, or misunderstand how shares are granted. Once the account is added, the consumer can create a database from the share.

Answer

ALTER ACCOUNT consumer_account ADD SHARE share_name;

Answer

CREATE SHARE share_name WITH ACCOUNT = consumer_account;

Answer

GRANT USAGE ON SHARE share_name TO ACCOUNT consumer_account;

Question 2

A provider wants to share data with a consumer using a Direct Share. Which two statements accurately describe the consumer's experience after the share is mounted? (Choose two.)

Accepted Answer

The consumer can view the share's objects without any additional storage cost for the shared data.. With Direct Sharing, the consumer mounts a read-only database and queries it using their own compute. Storage remains with the provider, so the consumer incurs no storage cost for the shared data. The consumer cannot modify shared objects or add objects inside the shared database, which distinguishes sharing from copying data.

Answer

The consumer can modify the shared data directly because they own the mounted database.

Answer

The consumer must copy the shared data into their own tables before querying it.

Answer

The consumer can create their own tables in the same schema as the shared objects.

Question 3

A retail provider shares a secure view that joins a table in its SALES database with a table in its INVENTORY database. A consumer reports that queries against the shared view fail with an authorization error, even though the view itself is granted to the share. The provider confirms both underlying tables exist and the view definition is valid. Which issue most likely explains the failure?

Accepted Answer

The provider did not grant USAGE on the databases and schemas containing the underlying tables to the share.. When a shared view references objects in multiple databases, the share must carry USAGE on every database and schema that contains a referenced object, plus SELECT on the view. Granting only the view leaves the underlying containers inaccessible, so the consumer's query cannot be authorized. Adding the missing container grants resolves the error without changing the view.

Answer

The consumer must be granted the ACCOUNTADMIN role to query cross-database views.

Answer

The share was not associated with the consumer account.

Answer

Secure views cannot reference objects in more than one database.

Question 4

A consumer wants to access a shared database from a provider. The provider has already created the share and granted the necessary privileges. What must the consumer do to access the shared data?

Accepted Answer

Create a database from the share using the CREATE DATABASE ... FROM SHARE command.. The consumer must create a database from the share using CREATE DATABASE ... FROM SHARE. This creates a read-only database in the consumer's account. The consumer then grants privileges on that database to their roles to allow users to query the data. The provider must have already added the consumer's account to the share.

Answer

Grant the USAGE privilege on the share to a role in the consumer's account.

Answer

Use the ALTER SHARE command to add the consumer's account to the share.

Answer

Request the provider to grant SELECT on the shared objects directly to the consumer's role.

Question 5

A provider runs CREATE SHARE sales_share; then GRANT USAGE ON DATABASE sales_db TO SHARE sales_share; GRANT USAGE ON SCHEMA sales_db.public TO SHARE sales_share; GRANT SELECT ON TABLE sales_db.public.orders TO SHARE sales_share; ALTER SHARE sales_share ADD ACCOUNT = consumer_acct; A consumer in consumer_acct queries the shared database and receives results. Six months later, the provider executes REVOKE SELECT ON TABLE sales_db.public.orders FROM SHARE sales_share; What is the immediate effect for the consumer?

Accepted Answer

The consumer immediately loses the ability to query the table and receives an authorization error.. Shares expose live provider data and enforce privileges at query time, so revoking SELECT on a table from a share removes access immediately. The consumer does not need to unmount the database, and cached results do not preserve authorization. The share object and other granted objects remain intact; only the revoked table becomes inaccessible, with a standard insufficient privileges error on the next attempt.

Answer

The consumer keeps access but can no longer see the table in SHOW TABLES output.

Answer

The consumer can still query the shared table because the share was already mounted and the data is cached locally.

Answer

The consumer retains read access until the share is dropped or the account is removed from the share.

Question 6

A consumer has mounted a share from a provider and wants to grant a role in their account the ability to query the shared data. What must the consumer do?

Accepted Answer

Grant USAGE on the shared database and schemas, and SELECT on the shared tables or views, to the role.. Consumers manage access to shared databases using standard GRANT statements within their own account. They grant USAGE on the database and schemas, and SELECT on the shared tables or views, to the roles that need access. Providers cannot grant privileges to consumer roles, and access is not automatic.

Answer

Ask the provider to grant SELECT directly to the consumer's role.

Answer

Create a new share in the consumer account that references the provider's share.

Answer

Nothing, because all roles in the consumer account automatically have access to shared databases.

Question 7

A consumer has created a database from a share provided by a partner. The consumer wants to allow a specific role, ANALYST_ROLE, to query the shared data. Which privilege must the consumer grant to ANALYST_ROLE on the shared database?

Accepted Answer

IMPORTED PRIVILEGES. To allow a role to query data in a database created from a share, the consumer must grant the IMPORTED PRIVILEGES privilege on that database to the role. This privilege grants access to the shared objects, including SELECT on tables and views. It is the correct and only privilege that enables access to shared data.

Answer

OWNERSHIP

Answer

USAGE

Answer

SELECT

Question 8

A provider wants to share data with a consumer but needs the shared data to reflect changes in the provider's source tables in near real time. The provider also wants to avoid granting the consumer access to the underlying base tables. Which approach best meets these requirements?

Accepted Answer

Create a secure view over the base tables and grant SELECT on the view to the share.. A secure view provides real-time access to base table data because it executes the underlying query at runtime. It also hides the view definition and base table details from consumers. Granting SELECT on the secure view to the share meets both the freshness and the access restriction requirements, unlike copies or direct table grants.

Answer

Grant SELECT on the base tables directly to the share and instruct the consumer not to modify them.

Answer

Create a materialized view over the base tables and grant SELECT on the materialized view to the share.

Answer

Copy the base tables into a separate database and grant SELECT on the copies to the share.

Question 9

A provider has created a share and added a table. The provider now wants to revoke access for a specific consumer account without affecting other consumers. Which command should the provider use?

Accepted Answer

ALTER SHARE my_share REMOVE ACCOUNT = consumer_account;. To revoke access for a specific consumer, the provider must remove that account from the share using ALTER SHARE ... REMOVE ACCOUNT. This action only affects the specified account and leaves other consumers unaffected. Dropping the share or revoking table privileges would impact all consumers, which is not desired. The correct command is precise and reversible if needed.

Answer

DROP SHARE my_share;

Answer

REVOKE USAGE ON SHARE my_share FROM ACCOUNT consumer_account;

Answer

REVOKE SELECT ON TABLE my_table FROM SHARE my_share;

Question 10

A provider wants to share data with a consumer but needs to ensure that the consumer cannot see the underlying table structure or any data beyond what is explicitly exposed. The provider also wants to prevent the consumer from using the shared data to infer sensitive information. Which Snowflake feature should the provider use?

Accepted Answer

Secure views. Secure views are specifically designed to share data without revealing the underlying table structure or allowing inference. They hide the view definition from unauthorized users and prevent the use of certain optimizations that could leak information. For sharing sensitive data with external consumers, secure views are the recommended feature.

Answer

Dynamic data masking

Answer

Row access policies

Answer

Materialized views

Question 11

A provider is preparing to share data with a consumer via a direct share. The provider wants to ensure that the consumer can access the data but cannot see the underlying table structure or any other objects in the database. Which two actions should the provider take? (Choose two.)

Accepted Answer

Ensure the share contains only the secure view and no other objects.. To share data while hiding the underlying structure, the provider should create a secure view and add it to the share, and ensure the share contains only that view. Secure views prevent consumers from seeing the base table definitions, and limiting the share to the view ensures no other objects are exposed. Other options involve direct table access or ineffective grants that do not meet the security requirements.

Answer

Grant USAGE on the database to the consumer's role.

Answer

Create a database role and grant it to the consumer.

Answer

Add the table directly to the share and grant SELECT on the table to the consumer.

Question 12

A consumer account has created a database from a share provided by a partner. The consumer wants to ensure that when the provider adds new tables to the share, those tables become available in the consumer's shared database without any manual intervention. Which statement accurately describes the behavior of shared databases in Snowflake?

Accepted Answer

New tables added to the share by the provider are automatically available in the consumer's shared database.. Shared databases are automatically updated when the provider adds new objects to the share. The consumer does not need to refresh, recreate, or grant additional privileges. The provider's grant of SELECT on a new table to the share makes it immediately available in the consumer's shared database. This real-time propagation is a fundamental characteristic of Snowflake Data Sharing.

Answer

The consumer must recreate the shared database to see new tables added by the provider.

Answer

The consumer must grant SELECT on the new tables to their own roles before they can be queried.

Answer

The consumer must run ALTER DATABASE ... REFRESH to pull new objects from the share.

Question 13

A provider's account is named PROVIDER_ACCT and it has created a share named PARTNER_SHARE that already contains a secure view. The provider now runs: ALTER SHARE PARTNER_SHARE ADD ACCOUNTS = CONSUMER_ACCT; What is the effect of this command in the provider's environment?

Accepted Answer

It grants CONSUMER_ACCT the ability to read the share, but a database must still be created in CONSUMER_ACCT before any shared data is visible there.. A share is only an authorization container; adding a consumer account simply permits that account to see an inbound share. Consumers must then create a database from the share with a role that has CREATE DATABASE before any tables become queryable. The provider cannot perform that step on the consumer's behalf, which is why the data is not instantly usable after the ALTER SHARE command.

Answer

It fails because the ADD ACCOUNTS clause is only valid at share creation time and cannot be used on an existing share.

Answer

It immediately creates a read-only database in CONSUMER_ACCT containing all objects in the share, usable without any further consumer action.

Answer

It converts the share into a listing that is publicly discoverable on the Snowflake Marketplace by all Snowflake accounts.

Question 14

A provider uses a reader account to share data with a client that does not have its own Snowflake account. The client now reports that it cannot see newly added tables that the provider granted to the share. The provider confirms the new tables were added to the share with SELECT grants. Which statement explains why the client cannot see the new tables?

Accepted Answer

The provider must grant USAGE on the schema containing the new tables to the share.. For any table to be visible through a share, the share needs USAGE on the table's database and schema in addition to SELECT on the table. If the new tables reside in a schema that was never granted to the share, the consumer cannot see them. Granting the missing schema-level USAGE makes the new tables appear to the reader account without recreating anything.

Answer

The reader account's shared database must be recreated to pick up new tables.

Answer

Reader accounts require a separate share for each new table.

Answer

Reader accounts can only query tables that existed when the reader account was created.

Question 15

A provider wants to share data with a consumer but must ensure that the consumer cannot see the underlying base tables, only an aggregated subset. The provider decides to use a secure view. Which statement is true regarding the use of secure views in a share?

Accepted Answer

Secure views can be shared, and the consumer can query them without having direct access to the base tables.. Secure views are ideal for sharing because they allow consumers to query a defined subset of data without exposing the underlying tables or the view definition. The consumer only needs SELECT on the secure view. This ensures that sensitive base data remains protected while enabling controlled data sharing.

Answer

Secure views cannot be shared; only regular views can be included in a share.

Answer

Sharing a secure view requires granting the consumer SELECT on the base tables as well.

Answer

Secure views automatically encrypt the data, so consumers cannot read it without a decryption key.