Free Snowflake SnowPro Specialty: Native Apps Sample Questions

Correct answer: B — The offering needs to run provider-authored stored procedures against consumer data inside the consumer's own account while protecting the provider's source code

• A. Incorrect: simple read-only table exposure to a small number of partners is a textbook Secure Data Sharing scenario and does not justify the overhead of a full app.
• B. Correct: running provider logic against consumer data inside the consumer's account while keeping the source code protected is precisely the use case the Native App Framework is designed to solve, since a share cannot execute provider procedures against consumer-side data with IP protection.
• C. Incorrect: sharing within the same account between schemas does not require any cross-account distribution mechanism at all.
• D. Incorrect: an offering with no logic or UI needs is better served by simple data sharing rather than the added complexity of an application framework.

Correct answer: C — A Native App built using Snowpark Container Services alongside SQL objects

• A. Incorrect: a SQL/Snowpark-only app has no mechanism for running custom container images or GPU-accelerated workloads.
• B. Incorrect: declarative sharing supports notebooks and simple code objects but is not designed for custom containerized, GPU-backed inference services.
• C. Correct: Snowpark Container Services within the Native App Framework is specifically designed to run custom container images, including GPU-backed compute pools, alongside the app's SQL-based objects.
• D. Incorrect: Secure Data Sharing has no application logic or container execution capability, and external functions to outside compute fall outside its scope.

Correct answer: B — The requirement now includes packaged, executable logic rather than pure data access

• A. Incorrect: growth in consumer count alone does not require moving to the Native App Framework, since Secure Data Sharing scales to many consumers on its own.
• B. Correct: the moment a requirement shifts from pure data access to needing packaged, executable provider logic running against the data, that is the defining signal to move to the Native App Framework, since shares cannot bundle executable logic.
• C. Incorrect: a marketing name change is a business decision unrelated to the technical architecture needed for distribution.
• D. Incorrect: increased data volume is a scaling concern that Secure Data Sharing can generally still handle; it does not by itself require application logic packaging.

Correct answer: A — Request the object as a reference so the consumer selects and grants access to the specific table at install time

• A. References are designed precisely for this scenario: the exact object is unknown until install time, and the consumer scopes access to only the specific table they choose, keeping the request minimal.
• B. Hardcoding a fixed table name and forcing consumers to rename their tables is impractical and does not solve the underlying need to discover an object dynamically with minimal privilege.
• C. Requesting OWNERSHIP on an entire schema to search for the right table grants far broader access than the app needs and abandons least privilege for convenience.
• D. Requiring the consumer to copy their data into a provider-owned table moves data out of the consumer's isolation boundary unnecessarily, which is not a least-privilege or isolation-friendly design.

Correct answers: A, B, C — INTERNAL distribution is recommended for iterative development before release; EXTERNAL distribution triggers a security scan before the package can be listed for consumers; Maintaining separate INTERNAL and EXTERNAL packages is a recommended practice

• A. INTERNAL distribution is the recommended mode for iterative development, letting the provider test changes without going through consumer-facing review each time.
• B. EXTERNAL distribution is the path that triggers the security scanning consumers rely on before an app is made available for installation from a listing.
• C. Keeping a development package on INTERNAL distribution and a production package on EXTERNAL distribution is the recommended practice for separating iteration from consumer release.
• D. EXTERNAL distribution does not disable manifest privilege requirements; those requirements still apply and are in fact part of what gets reviewed during the scan.
• E. INTERNAL distribution is for development use, not a requirement for every consumer installation; Marketplace and direct consumer installs use EXTERNAL distribution.
• F. Security scanning is associated with EXTERNAL distribution for consumer release, not INTERNAL distribution, so this statement reverses the actual relationship.

Correct answer: A — CREATE INTEGRATION on the account and CREATE NETWORK RULE on the schema that will hold the rule

• A. Creating an external access integration requires the account-level CREATE INTEGRATION privilege along with CREATE NETWORK RULE on the schema where the rule will be defined, which together authorize both objects involved.
• B. USAGE on a database alone does not grant the ability to create integration or network rule objects, so it is not sufficient for this task.
• C. OWNERSHIP on queried tables is unrelated to the privileges required to create an integration or network rule, which govern network access objects rather than table data.
• D. SELECT on an information schema is a read privilege for metadata and does not grant the ability to create integration or network rule objects.

Correct answer: A — A service, created with CREATE SERVICE referencing a service specification and a compute pool, so the container starts running and can be reached through its endpoints

• A. CREATE SERVICE, run in the setup script, references a service specification file (with image and endpoint definitions) plus a compute pool, and this is what actually launches the container and exposes its endpoints.
• B. Materialized views operate over table data and have no mechanism for starting containers; they are unrelated to service execution.
• C. Stored procedures cannot start a container via a JDBC connection string; container execution is managed through CREATE SERVICE and the compute pool, not procedural JDBC calls.
• D. A stage is used for file storage and staging data, not for mounting or browsing a running container's file system, and it does not start the service.

Correct answer: A — It is the Snowflake-managed storage location where the provider's container images are pushed so the service definition can reference them when the service starts

• A. The image repository is a Snowflake object that stores the container images a provider builds and pushes, and the service specification points to images there when a service is created.
• B. A catalog of installed apps is a Marketplace or account-level consumer concept, not something the image repository provides; the repository only stores container images.
• C. Query result caching is unrelated to the image repository, which exclusively holds container images rather than query output.
• D. Versioned schemas hold SQL-defined objects like procedures and UDFs; they are a separate concept from the image repository, which is specific to container image storage.

Correct answer: A — Add the table to the application package as private content, then create a secure view over it in the setup script and grant consumer-facing access only to the view

• A. Objects added to an application package are private by default; creating a secure view in the setup script and granting access only to the view is the standard way to expose derived data while shielding the underlying table's raw contents and logic.
• B. Granting SELECT directly on the raw table would let consumers query it in full, defeating the goal of protecting the proprietary pricing data from direct visibility.
• C. manifest.yml is a YAML metadata file for declaring artifacts and configuration, not a mechanism for shipping table data; it cannot hold a queryable dataset.
• D. A readme file is documentation text, not a queryable object, so this would prevent the application's own logic from using the data at all, which fails the stated use case.

Correct answers: A, B, C — Use CREATE APPLICATION ROLE to define a role that consumers can be granted access through; Use GRANT SELECT ON a secure view TO APPLICATION ROLE to expose only curated columns to that role; Use GRANT APPLICATION ROLE app_role TO ACCOUNT ROLE consumer_role in the consumer account to assign the role to a consumer's account role

• A. Creating the application role is the starting point for building a consumer-facing permission boundary inside the app.
• B. Granting SELECT on a secure view to the application role is the standard way to expose only curated columns rather than raw underlying tables.
• C. This is how a provisioned application role gets assigned to a consumer's own account role so their users can use it, and it is executed on the consumer side after installation.
• D. Setup scripts run inside the application's own context and cannot create account-level roles in the consumer's account; account roles are managed by the consumer.
• E. Debug mode is a troubleshooting capability for providers and has nothing to do with granting consumers access to app data.
• F. Setup scripts grant privileges to application roles, not directly to individual consumer users, which keeps access control manageable and role-based.

Correct answer: A — Debug mode, enabled on the development-mode instance

• A. Debug mode uses the provider's primary role to give visibility into all objects in the app, including ones never granted to an application role.
• B. Plain development-mode testing is limited to what application roles expose, which is exactly the restriction this scenario needs to get past.
• C. A consumer installation only ever sees objects granted to application roles and does not provide provider-level full visibility.
• D. Event sharing configuration governs telemetry sharing and has nothing to do with a provider's ability to inspect ungranted objects.

Correct answer: A — Session debug mode is scoped to a single session and must be re-enabled each time, reducing exposure compared to the persistent setting

• A. Because session debug mode only lasts for the current session and must be started again for future sessions, it limits how long elevated visibility remains active compared to a persistent setting.
• B. Persistent debug mode stays enabled until it is explicitly turned off with another ALTER APPLICATION statement; it does not disable itself automatically.
• C. The two modes differ meaningfully in duration and scope, so they do not carry identical risk profiles.
• D. Session debug mode is scoped to the session and ends when the session ends, which is the opposite of being impossible to turn off.

Correct answer: A — Patch 2, because Snowflake auto-increments the patch number when it is omitted.

• A. Correct: when the patch number is left out of ADD PATCH, Snowflake auto-increments from the highest existing patch number for that version, so patch 2 follows patches 0 and 1.
• B. Incorrect: omitting the patch number does not restart numbering at zero; it continues the sequence forward from the existing highest patch.
• C. Incorrect: the patch number is optional in this command precisely so that Snowflake can auto-increment it.
• D. Incorrect: reusing an existing patch number would overwrite it rather than add a new patch, which is not the auto-increment behavior.

Correct answer: A — Create a custom release directive scoped to those specific accounts with ACCOUNTS = (...) VERSION = V3 PATCH = 0, leaving the channel's default directive on V2.

• A. Correct: a custom release directive scoped to specific accounts lets those accounts receive a different version and patch than the channel-wide default, exactly matching a staged pilot rollout.
• B. Incorrect: changing the default directive would push V3 to every consumer, the opposite of limiting it to a pilot group, and manual downgrades are not a supported workflow.
• C. Incorrect: the QA channel restricts visibility to the provider's own organization; it does not automatically deliver a specific version to named consumer accounts.
• D. Incorrect: channel assignment alone does not guarantee any account always tracks the newest patch; the release directive within the channel still controls that.

Correct answer: A — FORCE

• A. Correct: the FORCE option lets the provider atomically reassign an account that is already targeted by a different release directive.
• B. Incorrect: OVERRIDE is not a recognized keyword for release directive account reassignment.
• C. Incorrect: CASCADE is unrelated to release directives; it is not part of this command's syntax.
• D. Incorrect: REPLACE is not the keyword used for forcing account reassignment between directives.

Correct answer: A — EXECUTE TASK with a description explaining the scheduled workload

• A. EXECUTE TASK is the account-level privilege that lets an app run tasks in the consumer account, which is exactly what a recurring scheduled workload needs.
• B. CREATE WAREHOUSE only lets the app create new warehouses; it does not grant permission to run tasks and would not satisfy the scheduling requirement by itself.
• C. MANAGE WAREHOUSES governs the ability to resize, suspend, or resume existing warehouses, which is unrelated to executing scheduled tasks.
• D. IMPORTED PRIVILEGES ON SNOWFLAKE DB exposes usage and cost metadata to the app and has no bearing on running tasks.

Correct answer: A — SHOW PRIVILEGES IN APPLICATION app_name

• A. This command lists the privileges an installed app has declared it needs, along with the provider's description for each, letting the consumer review before granting.
• B. This command returns general metadata about the application object, such as its package and version, not the list of requested privileges.
• C. This command shows privileges already granted to the application, not the privileges it has requested but not yet received.
• D. This command lists feature policies currently restricting the app, which is a separate governance mechanism unrelated to viewing requested privileges.

Correct answer: A — Application roles are created with CREATE APPLICATION ROLE and can be organized into a hierarchy where one role is granted to another

• A. CREATE APPLICATION ROLE defines roles inside the setup script, and roles can be granted to other application roles to build a hierarchy, similar to how account roles can be nested.
• B. Consumers typically grant application roles to their own account roles, which lets many users inherit access through their existing role assignments rather than requiring per-user grants.
• C. An app can define many application roles, up to a documented maximum of 1000 per app, far more than a fixed two-role model.
• D. Application roles are created and granted using SQL statements executed in the setup script, not declared as manifest.yml fields.

Correct answer: A — Create a private listing that targets those two accounts by organization and account identifier

• A. A private listing is scoped to specified consumer accounts using their organization and account identifiers, and it never appears in the Marketplace catalog, which matches the requirement to reach only two named accounts.
• B. Public Marketplace listings are visible to any consumer in the enabled regions; restricting a region does not limit visibility to two specific accounts, so this still exposes the listing to the wrong audience.
• C. Limited Trial is an access type for public Marketplace listings and controls trial duration, not which accounts can see the listing, so it does not meet the private-targeting requirement.
• D. Paid access with Stripe billing is a monetization setting for public Marketplace listings and does not restrict the listing to specific consumer accounts.

Correct answer: A — At least once per quarter

• A. Snowflake recommends reviewing and updating third-party libraries at least quarterly so known vulnerabilities are addressed before they can block a scan.
• B. Waiting for a consumer complaint is reactive and does not match the recommended proactive quarterly review cadence.
• C. An annual cadence is less frequent than the recommended quarterly review and leaves dependencies exposed for longer.
• D. Limiting reviews to major version releases ignores patches and minor updates that may need dependency fixes in between.

Correct answers: A, B, C — The CVE has a confirmed fix available according to the National Vulnerability Database; The CVE has a high integrity impact as defined by the Common Vulnerability Scoring System; The CVE has an EPSS score of 10 percent or higher

• A. A CVE with a confirmed fix listed in the National Vulnerability Database is one of the conditions that triggers automatic rejection, since a secure version is available to adopt.
• B. A CVE with a high integrity impact under the CVSS scoring model is treated as serious enough to block the app version until it is remediated.
• C. An EPSS score of 10 percent or higher indicates a meaningfully elevated likelihood of exploitation, and Snowflake uses that threshold to automatically reject the version.
• D. The age of a CVE by itself is not one of Snowflake's stated rejection criteria; older CVEs without a fix, high impact, or high EPSS score are not automatically blocking.
• E. Whether the vulnerable code path is invoked at runtime is not part of the documented automated criteria; the scan does not evaluate reachability in this way.
• F. Any CVSS base score above zero is far too broad a threshold; Snowflake's criteria specifically require a high integrity impact, not merely a nonzero score.

Correct answer: A — The app must automatically create its compute pools and request the needed privileges during installation, and the pool name must match the name configured in Provider Studio

• A. Correct. Documentation specifies the app must automatically create compute pools and request privileges at install time, and the pre-configured pool name in Provider Studio must match the name used in the app for tracking and billing to work.
• B. Incorrect. A Streamlit UI is unrelated to whether compute pool surcharge billing functions; surcharges are metered and shown on the Marketplace invoice regardless of UI.
• C. Incorrect. Compute pool surcharges can be configured for both private and public paid listings; there is no requirement restricting the feature to private listings only.
• D. Incorrect, because the app itself is responsible for automatically creating the compute pool during installation, not the consumer manually pre-creating it.

Correct answers: A, B — A provider can set the surcharge to $0 for a compute pool that should be displayed on the invoice without an added charge; Providers configure the surcharge in Provider Studio by entering the compute pool name and an amount to bill per credit in USD

• A. Correct. Setting the amount to $0 lets a compute pool appear on the consumer's statement for visibility while not actually charging anything extra.
• B. Correct. Provider Studio's Pricing & Trial section requires the pre-configured compute pool name and a per-credit USD billing amount to set up the surcharge.
• C. Incorrect. Compute pool surcharges are usage-based charges and are only combinable with base usage charges, not with subscription-based pricing plans.
• D. Incorrect. Surcharge billing is denominated in US dollars only; providers cannot select an arbitrary currency.
• E. Incorrect. Recurring subscription pricing is a separate model from usage-based pricing, and compute pool surcharges cannot be combined with a subscription plan on the same listing.

Correct answer: A — The consumer must bind the table reference using SYSTEM$REFERENCE after install, and any external network access requires an external access integration authorized for the app.

• A. References to consumer-owned objects are bound after installation via SYSTEM$REFERENCE and a callback procedure, and outbound network access for the app must be explicitly authorized through an external access integration in the consumer account.
• B. References cannot resolve automatically because the package only defines the shape of the reference; the consumer must still supply and bind the actual object after installation.
• C. Network policies are account-specific and are not inherited across accounts, so the consumer must configure its own external access integration for the app.
• D. Application installation does not require establishing a database replication group between the provider and consumer accounts; that mechanism is unrelated to Native App installation.

Correct answers: A, B, C — Required event definitions activate automatically at install time when the provider included them in the manifest.; Optional event definitions remain disabled after installation until the consumer explicitly turns them on.; Enabling event sharing requires the consumer to hold the MANAGE EVENT SHARING global privilege, which ACCOUNTADMIN has by default.

• A. Required event definitions listed in the manifest are activated automatically when the app is installed, without needing a separate consumer action.
• B. Optional event definitions do not activate on their own; the consumer must explicitly turn them on after installation.
• C. Enabling event sharing depends on the MANAGE EVENT SHARING global privilege, which is held by ACCOUNTADMIN by default and can be granted to other roles.
• D. Once event sharing is authorized for a provider, that authorization cannot be revoked by the consumer, so this statement misrepresents the actual, permanent behavior.
• E. Event sharing choices are not frozen at install; the consumer can toggle event types afterward through Snowsight's Events and Logs settings or via ALTER APPLICATION.
• F. Optional event types are toggled individually per event type, so enabling one does not cascade to enable every other optional event type.

Correct answers: A, D, E — The role used for installation lacks the IMPORT SHARE or CREATE DATABASE privilege needed to access the listing.; A required privilege declared in the manifest was denied by the administrator during the installation review step.; The listing remains in draft state because the provider has not yet completed the publishing process.

• A. Without IMPORT SHARE and CREATE DATABASE, the role cannot access the underlying share or create the application object, which is a common and genuine cause of installation failure.
• B. References to consumer objects are bound after the application object already exists, so an unbound reference is a post-install configuration step, not a cause of the installation itself failing.
• C. Warehouse auto-suspend timing affects idle compute cost, not whether the application object can be created, so it is not a plausible cause of install failure.
• D. If the administrator denies a privilege the manifest declares as required, the installation cannot complete, making this a genuine and directly relevant failure cause.
• E. A listing that has not finished the provider's publishing workflow is not yet available for consumers to install, which would surface as an installation failure.
• F. There is no mechanism by which a failed installation attempt silently renames the application's default role; this is not a real failure pathway.

Correct answer: A — MANAGE RELEASES

• A. MANAGE RELEASES is the privilege that bundles the ability to enable release channels, register or deregister versions and patches, and set release directives on an application package.
• B. This is incorrect because MANAGE VERSIONS is a narrower global privilege focused on modifying versions and release directives, and does not by itself cover enabling release channels.
• C. This is incorrect because MANAGE GRANTS relates to managing privilege grants generally, not the specific release management actions described here.
• D. This is incorrect because CREATE APPLICATION governs installing application instances from a package, not managing the package's release channels and versions.

Correct answer: A — The global MANAGE VERSIONS privilege

• A. Modifying a release directive requires either ownership of the application package or the global MANAGE VERSIONS privilege, so granting that global privilege lets a non-owning role perform the action.
• B. This is incorrect because SELECT is a read privilege relevant to data objects and does not authorize modifying release directives on an application package.
• C. This is incorrect because USAGE on a database only allows referencing objects within it and does not grant release management capability.
• D. This is incorrect because MONITOR is an observability privilege for viewing account activity, not a privilege that authorizes changing release directives.

Correct answers: A, B, C, E — The first patch created for a new version defaults to patch 0; A patch requires its own manifest file and setup script, just like a version does; Patches are intended for smaller updates such as fixes rather than major feature additions; A version can have up to 130 patches

• A. Correct: when a version is first created, its initial patch defaults to patch 0 unless the provider explicitly overrides it.
• B. Correct: each patch, like each version, requires its own manifest file and setup script since it represents a distinct set of application files.
• C. Correct: patches are meant for smaller changes such as bug fixes, while larger feature work belongs in a new version.
• D. Incorrect: a patch does not automatically gain channel assignment just because its parent version is on a channel; the release directive determines which patch of that version consumers actually receive.
• E. Correct: a version supports up to 130 patches, giving ample room for incremental fixes.
• F. Incorrect: dropping a patch does not drop the parent version; patches and versions are managed independently, and a version can continue to exist with its remaining patches.

Correct answer: A — The consumer can no longer manually trigger upgrades once the automatic process has started for that instance.

• A. Once Snowflake's automated upgrade process has started for an app instance, the provider's process takes precedence and manual upgrade attempts are no longer available for that instance.
• B. There is no rollback-and-replace mechanic; the framework simply blocks new manual upgrade attempts once the automatic process has taken over.
• C. A prior manual upgrade does not cancel a later automatic upgrade; the two are sequential, not mutually cancelling.
• D. Snowflake does not run two upgrade paths concurrently for the same instance; only one upgrade process is active on an instance at a time.

Correct answers: A, B, C — UPGRADE_AFTER; UPGRADE_IN_MAINTENANCE_WINDOW; UPGRADE_DEADLINE

• A. UPGRADE_AFTER sets the earliest timestamp at which the automatic upgrade is allowed to begin.
• B. UPGRADE_IN_MAINTENANCE_WINDOW tells Snowflake to delay the automatic upgrade until the consumer's maintenance policy window, if one is set.
• C. UPGRADE_DEADLINE sets the mandatory cutoff by which the upgrade must occur, working alongside UPGRADE_IN_MAINTENANCE_WINDOW.
• D. There is no UPGRADE_RETRY_COUNT parameter on a release directive; retry behavior is not configured this way.
• E. MAINTENANCE_SCHEDULE is not a release directive parameter; the schedule itself lives on the consumer's maintenance policy object, not the directive.
• F. GRACE_PERIOD is not a recognized release directive parameter in the Native App Framework.

Correct answers: A, B, C — Setting a consumer-controlled maintenance policy that delays automatic upgrades until a scheduled window.; Running ALTER APPLICATION ... UPGRADE manually before the automatic process starts.; Creating a scheduled task that runs ALTER APPLICATION ... UPGRADE on a CRON schedule.

• A. A maintenance policy is the built-in mechanism for a consumer to delay automatic upgrades to a schedule they control.
• B. Manually upgrading ahead of the automatic process lets a consumer choose their own timing, as long as the automatic process has not already begun.
• C. A scheduled task that periodically issues the manual upgrade command gives consumers a way to control upgrade timing using their own automation.
• D. Consumers do not have write access to the provider's application package or its manifest file; this is not an available control mechanism.
• E. UPGRADE_AFTER is a release directive parameter set on the application package by the provider, not something a consumer configures on the application object.
• F. Application roles govern object access within the app and have no effect on pausing or scheduling upgrade timing.

Correct answer: A — As part of a new version, since patches should avoid state modifications like adding required columns, while versions are meant for such structural changes

• A. Adding a required column with no default is a structural, state-changing modification, which is the kind of change that should be scoped to a new version rather than a patch.
• B. Idempotency alone does not make a state-changing schema modification appropriate for a patch; patches are meant to stay limited to bug fixes and minor additions.
• C. The change is possible, it is simply better scoped to a version release rather than being disallowed entirely.
• D. Restricting a structural change to QA forever would prevent it from ever reaching production consumers, which does not address how the change should actually be released.

Correct answer: A — UPGRADE_AFTER, which specifies the earliest date and time an upgrade is allowed to begin

• A. UPGRADE_AFTER on a release directive sets the earliest point in time an upgrade may start, letting the provider stage a two-day delay before the maintenance window.
• B. The QA channel is scoped to internal testing consumers and has no fixed 48-hour delay behavior of its own.
• C. The manifest's log_level setting controls logging verbosity and has no bearing on upgrade timing.
• D. Application role hierarchy depth governs privilege structure within the app and is unrelated to scheduling upgrade timing.

Correct answer: A — A version initializer callback that attempts to start or upgrade the services and can react if the attempt fails

• A. A version initializer is the recommended place to start or upgrade services during an upgrade, since it can detect a failed start and react accordingly, unlike relying solely on the setup script.
• B. There is no mechanism for chaining a second independent setup script; the setup script is a single script per version, and service management is better handled via a version initializer.
• C. Increasing log verbosity only affects diagnostic output and does not control or confirm service startup during an upgrade.
• D. Application roles govern privileges within the app and are not the mechanism used to confirm or manage service startup during an upgrade.