COF-C03 Data Collaboration — Timed 20 Questions

Question 1

A financial services company based in the US-East region needs to share a large scale dataset with a partner who operates solely in the EU-West region. What is the standard Snowflake procedure to facilitate this cross-region data sharing?

20 minute time limit — choose an answer to begin.

Accepted Answer

The provider must replicate the data to a secondary account in the partner's region and create the share from that account.. Snowflake's direct sharing mechanism requires the provider and consumer accounts to reside within the same cloud region to ensure data locality and performance. To collaborate across different regions or cloud providers, the provider must first replicate the data to a secondary account in the consumer's region. This architectural requirement ensures that the actual data sharing event occurs locally, maintaining low-latency access and compliance.

Answer

The provider must enable 'Global Sharing' on the specific share object and provide the consumer's account locator.

Answer

The partner must create a Reader Account within the provider's US-East region to access the data without replication.

Answer

The provider should use the Snowflake Marketplace to list the data as 'Private' which automatically handles cross-region movement.

Question 2

Which TWO statements accurately describe the functionality and benefits of Snowflake Marketplace listings compared to Direct Sharing?

Accepted Answer

Marketplace listings allow providers to reach all Snowflake customers globally without manual account-to-account configuration.. The Snowflake Marketplace provides a centralized platform that enhances discoverability and simplifies the acquisition of third-party data. Unlike Direct Sharing, which is a point-to-point relationship managed manually by the provider, the Marketplace allows providers to reach thousands of Snowflake customers simultaneously. It also offers automated provisioning and standardized metadata, making it easier for consumers to evaluate and integrate external data sources.

Answer

Marketplace listings require consumers to pay for the data using Snowflake credits directly from their account balance.

Answer

Marketplace listings provide automatic data replication to all regions where Snowflake has a presence.

Answer

Marketplace listings are the only way to share Secure User-Defined Functions (UDFs) with external accounts.

Question 3

A data provider wants to share a view that joins a table in DATABASE_A with a table in DATABASE_B. Both tables contain sensitive information. What is the most critical security configuration the provider must implement to ensure the share works for a consumer?

Accepted Answer

The provider must ensure the view is created as a SECURE VIEW and that all referenced databases are added to the share.. When sharing data that spans multiple databases, or when sharing views, Snowflake requires that those views be 'Secure Views'. Secure views prevent consumers from using optimization techniques to reverse-engineer underlying data they aren't authorized to see. Furthermore, all objects referenced by the view must be contained within the same share, or the provider must manage cross-database permissions carefully within the share's context.

Answer

The provider must create a single database and move both tables into it before sharing, as Snowflake shares cannot span databases.

Answer

The provider must grant the consumer account the 'ACCOUNTADMIN' role to resolve cross-database permission conflicts.

Answer

The provider must disable the 'Data Optimization' flag on the consumer's account to allow the cross-database join to execute.

Question 4

Which THREE types of objects can be explicitly added to a Snowflake Share for consumption by another account?

Accepted Answer

Tables. Snowflake shares are containers for specific database objects. To share data, a provider must include the parent containers (Database and Schema) and then the actual data objects. Supported objects include Tables, Secure Views, and Secure User-Defined Functions (UDFs). These objects allow the provider to share raw data, transformed data, or even complex logic and computations with the consumer.

Answer

Internal Stages

Answer

Virtual Warehouses

Question 5

A provider updates the data in a table that is currently part of an active share. When will the consumer see these updates in their own account?

Accepted Answer

The consumer will see the updates immediately as there is no data movement involved.. One of the primary advantages of Snowflake's architecture is that data sharing is metadata-based. There is no actual data movement or copying involved. When a provider updates a table, the metadata is updated instantly. Since the consumer's shared database is simply a reference to the provider's data files, the consumer sees the changes immediately upon the next query execution.

Answer

The consumer will see the updates after the provider manually executes a 'REFRESH SHARE' command.

Answer

The updates will be visible after the next scheduled metadata synchronization, which occurs every 24 hours.

Answer

The consumer must drop and recreate the shared database to see any new data changes.

Question 6

Which TWO system-defined roles have the inherent ability to create and manage Shares by default, or can be granted the necessary privileges to do so?

Accepted Answer

ACCOUNTADMIN. In Snowflake, the ACCOUNTADMIN role has full control over all account-level objects, including shares. Additionally, the SECURITYADMIN role, which is responsible for managing grants and security, also has the necessary permissions. Other roles can be granted the 'CREATE SHARE' privilege by an ACCOUNTADMIN, but these two roles are the primary administrative roles involved in sharing.

Answer

SYSADMIN

Answer

USERADMIN

Answer

PUBLIC

Question 7

A company is using Data Exchanges to collaborate with multiple partners. They need to ensure that data sets are automatically updated for consumers without the provider manually pushing changes. How can this be accomplished?

Accepted Answer

Update the underlying base tables directly in the shared database.. Data Exchanges facilitate automated data sharing through listings that reference live database objects. When a provider updates the data in the underlying base table, those changes are immediately visible to the consumer as soon as the transaction commits. This real-time visibility eliminates the need for manual ETL pipelines to push files, drastically reducing latency and operational overhead while maintaining a single source of truth for all participating organizations within the data ecosystem.

Answer

Configure a Snowpipe instance to push data to the consumer's account.

Answer

Use a Data Marketplace listing with a scheduled replication task.

Answer

Export data to a cloud bucket and share the bucket URI.

Question 8

Which THREE actions are required for an organization to consume data from a provider via a Private Data Exchange?

Accepted Answer

The consumer must be explicitly added to the Private Data Exchange by the administrator.. To consume data from a Private Data Exchange, the account must be invited to the exchange, then the user must find the desired listing, and finally, create a local database from that share. This workflow ensures secure governance, as the provider explicitly controls who has access to the exchange, and the consumer maintains control over which shared assets they import into their own Snowflake environment for their internal reporting and analysis needs.

Answer

The consumer must provide their cloud storage credentials to the provider.

Answer

The consumer must run a replication job to copy the data locally.

Question 9

A data provider has created a share and granted SELECT on a table to it. The provider now wants to revoke the consumer's access to a specific column containing personally identifiable information (PII) without removing the entire table from the share. What should the provider do?

Accepted Answer

Create a secure view that excludes the PII column and grant SELECT on the view to the share.. To exclude a column from a share, the provider must create a secure view that selects only the permitted columns, grant SELECT on that view to the share, and revoke SELECT on the base table from the share. This way, the consumer can access the view but cannot see the PII column. Secure views hide the underlying table and view definition.

Answer

Apply a masking policy to the PII column that returns NULL for the consumer's role.

Answer

Use column-level security by granting SELECT on only the non-PII columns to the share.

Answer

Revoke SELECT on the table from the share and re-grant SELECT on all columns except the PII column.

Question 10

A data provider at ACME Corp wants to share a secure view with a partner. The secure view reads from a table that is not included in the share. After creating the share and adding the secure view, what must be configured to allow the consumer to query the view successfully?

Accepted Answer

Grant the SHARE object the SELECT privilege on the underlying table using a role that owns the table.. Sharing a secure view over a private table requires the share to be granted the privileges the view needs on its base objects. Granting SELECT on the underlying table to the share is the correct, least-privilege mechanism. The consumer only sees the view, not the table. Other options either invent features, attempt account-to-role grants that are impossible, or expose data unnecessarily.

Answer

Create a database role in the provider account, grant it to the consumer, and add the database role to the share.

Answer

Enable the share to use the provider's account-level privileges by setting the share to 'privileged mode'.

Answer

Grant the consumer account's role the SELECT privilege on the underlying table.

Question 11

A Snowflake provider wants to share a secure view with a consumer, but the view is defined on a table that is not included in the share. The view's owner has the necessary privileges on the underlying table. What is the minimum additional step required for the consumer to query the view successfully?

Accepted Answer

Ensure the share contains the secure view and that the view owner has the required privileges on the underlying table.. Secure views allow sharing derived data without exposing base tables. The view executes with the owner's rights, so the consumer only needs access to the view itself. The provider must add the secure view to the share and ensure the view owner has the necessary privileges on the underlying objects. This provides controlled, secure access.

Answer

Add the underlying table to the share.

Answer

Grant the consumer's role SELECT on the underlying table.

Answer

Create a database role that owns the view and grant it to the consumer.

Question 12

A provider wants to share data with a consumer but needs to ensure that the consumer can only see a subset of rows based on the consumer's account. The provider has a table SALES with a column REGION. The provider wants to create a secure view that filters rows based on the consumer's account name. Which approach should the provider use?

Accepted Answer

Create a secure view with a WHERE clause that uses CURRENT_ACCOUNT() to filter rows, and add the view to the share.. The provider should create a secure view that uses CURRENT_ACCOUNT() to filter rows based on the consumer's account. Secure views are required for sharing and prevent exposure of underlying data. This approach dynamically restricts data without additional mapping tables, ensuring each consumer sees only their relevant subset. The other options either use insecure views or grant excessive access.

Answer

Create a secure view and grant SELECT on the underlying table to the consumer's role.

Answer

Create a secure view that uses a mapping table to map account names to regions, and add the view to the share.

Answer

Create a regular view with a WHERE clause that uses CURRENT_ACCOUNT() to filter rows, and add the view to the share.

Question 13

A provider wants to share data with a consumer using a direct share. The provider has created the share and added a database and a secure view to it. Which two additional steps must the provider perform to make the share accessible to the consumer? (Choose two.)

Accepted Answer

Grant USAGE on the database and schema to the share.. To make a share accessible, the provider must grant the necessary privileges on the shared objects to the share and add the consumer account to the share. Specifically, granting USAGE on the database and schema allows the consumer to navigate the database, and adding the consumer account authorizes access. These two steps, along with granting SELECT on the view (which is assumed already done), complete the sharing setup.

Answer

Grant SELECT on the secure view to the share.

Answer

Grant USAGE on the share to the consumer's role.

Answer

Create a reader account for the consumer.

Question 14

A consumer has created a database from a share and wants to grant a role in their account the ability to query the shared data. Which privilege must the consumer grant to the role on the shared database?

Accepted Answer

GRANT USAGE ON DATABASE shared_db TO ROLE analyst_role;. A consumer role needs USAGE on the shared database and schema, plus SELECT on the shared tables or views. The first step is granting USAGE on the database. IMPORTED PRIVILEGES is relevant when the provider grants privileges to the share, but USAGE is the foundational grant for visibility. Ownership cannot be granted on a shared database.

Answer

GRANT IMPORTED PRIVILEGES ON DATABASE shared_db TO ROLE analyst_role;

Answer

GRANT SELECT ON DATABASE shared_db TO ROLE analyst_role;

Answer

GRANT OWNERSHIP ON DATABASE shared_db TO ROLE analyst_role;

Question 15

A data provider at a healthcare company has created a share called PATIENT_SHARE and granted USAGE on the database PATIENT_DB and the schema CLAIMS to the share. They now need to share a secure view named CLAIMS_SUMMARY that is owned by the role ANALYST_ROLE but resides in the CLAIMS schema. The provider's current active role is PROVIDER_ROLE, which has been granted the global privilege to create shares. What must the provider do to make the view available to consumers?

Accepted Answer

Grant SELECT on the view to the share, ensuring the share is granted the necessary privileges on the view.. To share a view, the provider must grant SELECT on that view to the share. Database and schema USAGE grants are prerequisites but do not by themselves expose the view. The share needs the SELECT privilege on the view so that consumer accounts can query it. Without this grant, the view remains inaccessible even if the share exists and other privileges are in place.

Answer

Grant REFERENCES on the view to the share, then grant SELECT on the view to the share.

Answer

Grant USAGE on the database and schema to the share, then grant SELECT on the view to the share.

Answer

Grant USAGE on the view to the share. Views do not require SELECT privileges to be shared.

Question 16

A provider wants to share a table with a partner but must ensure the partner can query the data while the provider can continue to update it, and the partner must not be able to see any rows outside an approved region. The provider has created a secure view that filters by region and joins a lookup table. Which TWO grants must the provider include on the share for the consumer to query the secure view successfully? (Choose two.)

Accepted Answer

USAGE on the database and schema containing the lookup table.. To query a shared secure view, the consumer needs SELECT on the view, and because the view joins a lookup table, the share must also include USAGE on the database and schema containing that table. Granting SELECT on the base table or transferring ownership would break the region filter or the provider's control, so those privileges must be excluded.

Answer

SELECT on the underlying base table.

Answer

REFERENCES on the lookup table.

Answer

OWNERSHIP on the secure view.

Question 17

A provider has created a share and added a table. The consumer reports that they can see the shared database but cannot query the table. The provider verifies that the table is listed in the share. Which action should the provider take to resolve the issue?

Accepted Answer

Grant USAGE on the database and schema to the share.. A share must include USAGE privileges on the database and schema that contain the shared table. Without these, the consumer cannot query the table even if it appears in the share. The provider must grant USAGE on the database and schema to the share. This ensures the consumer has the necessary access path.

Answer

Add the database and schema to the share.

Answer

Grant SELECT on the table to the consumer's role.

Answer

Recreate the share and add the table again.

Question 18

A provider wants to share a secure view named sales_db.public.regional_summary with a consumer account. The view joins sales_db.public.orders with sales_db.public.customers and includes a WHERE clause that filters rows based on CURRENT_ACCOUNT(). The provider also wants to prevent the consumer from seeing the view definition or the underlying tables. Which two actions must the provider perform? (Choose two.)

Accepted Answer

Create the view as a secure view so its definition is hidden and its internal logic is protected.. Sharing a secure view requires the standard container grants (USAGE on database and schema) plus SELECT on the view itself. The view must be created as SECURE to hide its definition. Base table privileges are not granted to the consumer because the view executes with the owner's rights, and REFERENCES is irrelevant to view resolution. Adding the consumer account is necessary for consumption but is not one of the two actions that satisfy the hiding requirement.

Answer

Add the consumer account to the share using ALTER SHARE ... ADD ACCOUNT.

Answer

Grant REFERENCES on the base tables to the share so the view can be validated.

Answer

Grant SELECT on the base tables orders and customers to the share so the view can resolve.

Question 19

A provider wants to share data with a consumer account using a share. The provider has created the share and granted SELECT on a table to the share. Which TWO additional steps must the provider perform to complete the sharing setup? (Choose two.)

Accepted Answer

Add the table to the share using ALTER SHARE ... ADD TABLE.. To complete sharing, the provider must add the table to the share and add the consumer account to the share. Granting SELECT on the table is necessary but not sufficient. Adding the table makes it part of the share, and adding the account establishes the relationship. The consumer then creates a database from the share. Other options are either consumer-side actions or invalid commands.

Answer

Grant USAGE on the database and schema to the share.

Answer

Create a database from the share in the consumer account.

Answer

Grant the SHARE object the USAGE privilege on the consumer account.

Question 20

A data provider wants to share data with a consumer, but the consumer must not be able to re-share the data with others. Which Snowflake feature should the provider use?

Accepted Answer

A share that does not grant the consumer the ability to create shares.. Snowflake shares are read-only for consumers, and by default, consumers cannot re-share data. The provider does not need to take any special action beyond not granting re-share capabilities. The consumer can query the shared data but cannot create new shares from it unless explicitly allowed. This satisfies the requirement.

Answer

A share with the GRANT OPTION disabled.

Answer

Secure Data Sharing with a direct share.

Answer

A read-only database created from a share.