ARA-C01 Accounts and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Network policies

  Why it's wrong here

  Network policies restrict access based on IP addresses and do not prevent users from one tenant from accessing another tenant's data if they are within the allowed IP range. They are a network-level control, not a data-level isolation mechanism.

• ✓

  Separate accounts per tenant

  Why this is correct

  Using separate Snowflake accounts for each tenant provides the strongest isolation because accounts are completely independent. There is no shared metadata or access control, so users in one account cannot access data in another. This is a common pattern for multi-tenant architectures requiring strict isolation.

• ✗

  Database roles

  Why it's wrong here

  Database roles are scoped to a specific database and can be granted to account roles, but they do not inherently prevent users from one tenant from accessing another tenant's database if the same account role is granted access to both. They provide finer-grained privileges within a database, not cross-tenant isolation.

• ✗

  Secure views

  Why it's wrong here

  Secure views hide the view definition and underlying data from unauthorized users, but they do not provide tenant isolation by themselves. They are useful for restricting row-level access, but without a mechanism to filter by tenant, they cannot prevent cross-tenant access.