Prepare with Snowflake NAS-C01 exam practice material, pass for sure

You are developing a Snowflake Native Application that needs to access data residing in the consumer's account. The application requires specific permissions to read certain tables and execute specific functions. How should you define and manage these access privileges to ensure both security and functionality?

• A. Create a new database role and grant the required permissions to the database role, later grant the database role to the application role. Use secure views for access to consumer data.
• B. Rely on the consumer to manually grant the necessary privileges to the application's service account after installation. Provide clear instructions in the application's documentation.
• C. Grant the 'ACCOUNTADMIN' role to the application. This provides unrestricted access to all resources in the consumer's account, simplifying development and deployment.
• D. Define a custom role within the application package with the minimum required privileges (e.g., 'SELECT on specific tables, 'USAGE on specific functions). The consumer then grants this role to the application during installation. Use secure views if needed.
• E. Use the 'GRANT OWNERSHIP' command to transfer ownership of the required tables and functions to the application's service account. This gives the application full control over these resources.

You're building a Streamlit application within a Snowflake Native App that uses the Permissions API (hypothetical) to control access to sensitive dat a. Your security team has mandated that any changes to data access privileges must be audited. How can you effectively log all privilege grant and revoke operations performed via the Permissions API within your Streamlit application running inside Snowflake, assuming you are given the hypothetical 'PermissionsClient' and methods as below?

• A. Implement a custom logging function that captures the API calls and their parameters. Use a try-except block around each API call, logging the details to a separate audit table in Snowflake, and pushing logs to external SIEM tools.
• B. Leverage Snowflake's built-in 'QUERY _ HISTORY' view to track all SQL commands executed by the Streamlit application. Filter for 'GRANT and 'REVOKE statements to identify privilege changes. Replicate to external storage for retention.
• C. Rely solely on the Permissions API's built-in audit trails, assuming it automatically logs all operations to a system table accessible only by Snowflake administrators.
• D. Use Snowflake's native logging capabilities in the application's setup script, logging directly to the Snowflake event log. However, these logs may require a system administrator to interpret and extract.
• E. Configure Snowflake's event tables for security to track privilege grants and revokes. Create a Streamlit function that fetches and displays these audit events within the application's admin panel. Push data into separate staging area.

A data science team within your organization is developing a Snowflake Native App that needs to access and process customer data stored in a Snowflake database. The app must only access data for customers residing in the 'USA' region. The team has created a custom role 'APP ROLE for the app to use. Which of the following is the MOST secure and efficient way to grant the app the necessary permissions to read the filtered data? Assume a secure view approach is preferred over direct table access.

• A. Create a secure view that filters customer data to include only customers in the 'USA' region and grant the SAPP ROLE the 'SELECT privilege on the secure view.
• B. Grant the SAPP ROLE the 'OWNERSHIP' privilege on the base customer data table and implement data filtering logic within the app itself.
• C. Grant the 'APP_ROLE the 'SELECT privilege on the base customer data table and rely on row-level security policies defined on that table.
• D. Grant the 'APP_ROLE the 'USAGE privilege on the database and schema containing the customer data table. Data filtering should still be handled by the app.
• E. Create a standard view (non-secure) that filters customer data to include only customers in the 'USA' region and grant the 'APP_ROLE the 'SELECT' privilege on this view.

You are developing a Snowflake Native Application intended for the Snowflake Marketplace. The application provides data transformation services, leveraging external functions (UDFs) that invoke a REST API hosted on AWS Lambd a. You need to ensure the secure and compliant invocation of this external API from your application while adhering to Snowflake's best practices. Which of the following steps represent the MOST secure and recommended approach for configuring and invoking the external function?

• A. Store the AWS Lambda function's URL and credentials (API key) in a configuration table within the Snowflake Native Application package. The external function retrieves these credentials from the configuration table at runtime. Configure an alert if the configuration table is modified.
• B. Create an API integration object in Snowflake, configuring a secure authentication mechanism such as AWS IAM roles or OAuth 2.0. Define the external function to use the API integration, providing the necessary parameters for authentication. Configure network policies and secrets (using Snowflake secrets) to secure the connection. Ensure your AWS Lambda function validates the incoming request's identity.
• C. Expose the AWS Lambda function publicly with no authentication. Configure the external function in Snowflake to point to the public Lambda URL. Document to consumers that the API has no security.
• D. Use Snowflake's built-in network rules to allow outbound traffic to all AWS IP ranges. Store the API key directly in the UDF definition as an environment variable.
• E. Create an API integration object in Snowflake that stores the AWS Lambda function's URL and credentials (API key) directly within the integration. Grant the necessary permissions to the application's roles to use the API integration. Define the external function to call the Lambda function URL directly, referencing the API key from the integration object.

You are creating a Snowflake Native Application that will be distributed to consumer accounts. As part of the installation process, you need to ensure that a specific database role, 'DATA READER, is created in the consumer account and granted 'SELECT' privileges on a specific table in the consumer's shared dat a. Which of the following code snippets, when placed within the application's setup script (install.sql), will correctly achieve this, assuming the application is granted 'CREATE DATABASE ROLE?

• A.
  
• B.
  
• C.
  
• D.
  
• E.