COF-C03 Data Loading, Unloading, and Connectivity Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Set the STORAGE_ALLOWED_LOCATIONS parameter in the storage integration to restrict access to specific S3 paths.

  Why it's wrong here

  While STORAGE_ALLOWED_LOCATIONS is a good security practice to limit access, it is not strictly required for the integration to function. The integration will work without it, though it may allow access to any location the IAM role can access. The required actions are creating the IAM role and granting permissions. This parameter is optional but recommended for least privilege.

• ✓

  Grant the IAM role permissions to access the S3 bucket, such as s3:GetObject, s3:PutObject, s3:ListBucket, and s3:GetBucketLocation.

  Why this is correct

  This is correct because the IAM role must have a policy that allows the necessary S3 actions on the bucket and its objects. At minimum, read and write permissions like s3:GetObject, s3:PutObject, s3:ListBucket, and s3:GetBucketLocation are required for loading and unloading. Without these permissions, Snowflake will receive access denied errors when attempting to read or write data.

• ✓

  Create an IAM role in AWS with a trust policy that allows Snowflake's AWS account to assume the role.

  Why this is correct

  This is correct because a storage integration requires an IAM role in AWS that Snowflake can assume. The trust policy must specify Snowflake's AWS account ID and an external ID generated by Snowflake. This allows Snowflake to securely access the S3 bucket without storing AWS credentials. Without this trust relationship, Snowflake cannot assume the role and access the bucket.

• ✗

  Store AWS access keys and secret keys in the storage integration definition for authentication.

  Why it's wrong here

  This is incorrect because storage integrations are designed to avoid storing long-term credentials. Instead, they use IAM role assumption with temporary credentials. Storing access keys is less secure and not the recommended method. Snowflake generates an external ID and uses it with the trust policy. Therefore, this is not a required action and should be avoided.

• ✗

  Configure the S3 bucket policy to allow public access so Snowflake can read the data.

  Why it's wrong here

  This is incorrect and insecure. Public access is not required and is a security risk. Snowflake accesses the bucket using the IAM role, not public access. The bucket policy should instead allow the IAM role to perform actions. Making the bucket public could expose data to unauthorized users. Therefore, this is not a required action and is strongly discouraged.