Snowflake NAS-C01 Value Pack (Frequently Bought Together)

A provider is developing a Snowflake Native Application that shares event data with consumers. The provider wants to ensure that specific columns in the event data are obfuscated for certain consumer accounts, while remaining visible to others. Which of the following approaches is the MOST secure and maintainable way to achieve this?

• A. Implement conditional logic within the event table function to obfuscate data based on the consumer's APP_INSTANCE_ID().
• B. Implement dynamic data masking policies on the sensitive columns using the CURRENT_ACCOUNT() function to determine which accounts receive obfuscated data.
• C. Use a stored procedure to query the event data, applying obfuscation logic based on the consumer's APP INSTANCE ID() before returning the results.
• D. Data masking is not supported in Native Apps. The provider must rely on consumer-side masking implementations.
• E. Create a separate view for each consumer account with the sensitive columns masked using a CASE statement based on the CURRENT_ACCOUNT() function.

You are creating a Snowflake Native App using the Native Apps Framework. Your application needs to perform a task that must execute on a regular schedule (e.g., daily data refresh). Which Snowflake feature(s) can you leverage to achieve this, and what considerations are important when using them within the Native App context?

• A. Snowflake Streams should be used to track data changes and trigger the refresh process. The Stream must be defined in the application package, and a separate task can be configured to consume the stream data.
• B. Snowflake Pipes are the preferred method for scheduled data ingestion within Native Apps, as they are designed for continuous data loading from external sources.
• C. Snowflake Tasks can be used directly within the Native App, but you must ensure the task definition is part of the application package and the task is resumed upon installation in the consumer account. The task must use the APPLICATION role.
• D. You should implement an external scheduler (e.g., AWS Lambda, Azure Functions) that triggers a Snowflake Stored Procedure via the Snowflake API. The Stored Procedure should be owned by the APPLICATION role.
• E. Use Snowflake Alerts with a cron schedule to trigger a stored procedure owned by the APPLICATION role. The procedure executes any scheduled task.

A Snowflake Native App provider wants to implement row-level security (RLS) in an event table to ensure that consumers only receive events pertaining to their specific organization, even if they have been granted USAGE on the event table function. How can this be achieved?

• A. Row-level security cannot be enforced on event tables shared through Snowflake Native Apps due to security limitations.
• B. Create a view on top of the event table that includes a WHERE clause filtering by APP INSTANCE ID() and grant access to the view instead of the base table.
• C. Create a row access policy that filters rows in the event table based on the APP_INSTANCE_ID() function, ensuring each consumer only sees events related to their application instance.
• D. Create a masking policy that filters rows in the event table based on the CURRENT_ACCOUNT() function to match the consumer's account ID.
• E. Implement a custom stored procedure that acts as a proxy for accessing the event table, filtering data based on the consumer's user ID.

You are developing a Snowflake Native Application that requires fine-grained control over data access for its users. You plan to use Streamlit within the application and leverage the Permissions API to manage these privileges. Assume you have successfully established a connection to Snowflake within your Streamlit app. Which of the following code snippets accurately demonstrate how to grant the 'SELECT privilege on a table named 'APP DATA in the application's schema to a specific role, 'APP USER, using the Permissions API, and then verify if that privilege has been granted?

• A.
  
• B.
  
• C.
  
• D.
  
• E.
  

A data engineer, Alice, is developing a Snowflake Native Application that exposes a stored procedure, 'calculate_aggregate' , within the application schema 'app_schema'. She initially granted privilege on the application database to the 'analyst_role' and EXECUTE privilege on 'calculate_aggregate' to the same role. Later, due to a security audit, she needs to revoke the 'EXECUTE privilege from 'analyst_role' but wants to ensure users assigned to 'analyst_role' can still access other objects in the application database (but not execute this specific stored procedure). Which of the following actions achieves this goal MOST efficiently and securely?

• A.
  
• B.
  
• C.
  
• D.
  
• E.