CertSafari

    Free Snowflake SnowPro Advanced: Administrator (ADA-C02) Sample Questions

    35 free sample questions from our bank of 361+, covering every exam domain, with answers and detailed explanations. Updated October 2026.

    Practice all 361 questions in quiz mode

    Domain 1: Snowflake Security, Role-Based Access Control (RBAC), and User Administration

    Subdomain 1.2: Given a set of business requirements, design access control framework

    1.A new team lead must be able to create users and roles for their department. The security team wants to give them only these abilities, without account-wide privilege management or the ability to create databases. Which system-defined role should be granted?

    1. A.SECURITYADMIN, which can create users and roles and also holds the global MANAGE GRANTS privilege over every object.
    2. B.USERADMIN, which holds the CREATE USER and CREATE ROLE privileges and nothing broader for object administration.
    3. C.ACCOUNTADMIN, which encapsulates SYSADMIN and SECURITYADMIN and so covers user and role creation in a single grant.
    4. D.SYSADMIN, which can create warehouses and databases and is the usual parent for custom roles that own objects.
    Show answer & explanation

    Correct answer: B — USERADMIN, which holds the CREATE USER and CREATE ROLE privileges and nothing broader for object administration.

    • A. Incorrect. SECURITYADMIN can create users and roles but also has MANAGE GRANTS, which lets it grant or revoke privileges on any object, exceeding the stated limit.
    • B. Correct. USERADMIN is dedicated to user and role administration and is the least-privileged system role that satisfies the requirement.
    • C. Incorrect. ACCOUNTADMIN is the top-level role with the broadest authority, including billing and account settings, so it violates the least-privilege requirement.
    • D. Incorrect. SYSADMIN manages objects such as databases and warehouses; it does not hold CREATE USER or CREATE ROLE and it is the opposite of the requested scope.

    Subdomain 1.2: Given a set of business requirements, design access control framework

    2.A security team requires that owners of individual tables in the CUSTOMER_DATA schema can no longer decide on their own who gets access to those tables. Only a central access team should issue grants on objects in this schema. Which approach meets this?

    1. A.Remove the OWNERSHIP privilege from every table owner role and transfer these tables to ACCOUNTADMIN, which then acts as their direct owner.
    2. B.Create or alter the schema WITH MANAGED ACCESS, so only the schema owner or a role with MANAGE GRANTS can grant privileges on its objects.
    3. C.Set the schema property DATA_RETENTION_TIME_IN_DAYS to zero so that owners cannot grant privileges that outlive their own role.
    4. D.Apply a row access policy to every table so that grant statements issued by table owners are filtered out before they take effect.
    Show answer & explanation

    Correct answer: B — Create or alter the schema WITH MANAGED ACCESS, so only the schema owner or a role with MANAGE GRANTS can grant privileges on its objects.

    • A. Incorrect. Moving objects to ACCOUNTADMIN breaks least privilege, makes the most powerful role an object owner, and is not the intended mechanism for centralizing grants.
    • B. Correct. In a managed access schema, object owners lose the ability to grant privileges; the schema owner or MANAGE GRANTS holders centralize that decision.
    • C. Incorrect. Time Travel retention governs data recovery and has no connection to who is allowed to issue grants.
    • D. Incorrect. Row access policies control which rows queries return; they do not intercept or filter GRANT statements.

    Subdomain 1.3: Given a scenario, create and manage access control.

    3.The security team suspects password-guessing attacks over the last four months. An administrator must report failed sign-in attempts per user and client IP address for that whole period. Which source is the MOST appropriate?

    1. A.The INFORMATION_SCHEMA.LOGIN_HISTORY table function, which returns login events with the client IP for each attempt
    2. B.The SNOWFLAKE.ACCOUNT_USAGE.SESSIONS view, filtered on authentication_method to isolate the sessions that were rejected
    3. C.The SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY view, filtered on is_success = 'NO', which keeps 365 days of login events
    4. D.The SNOWFLAKE.ACCOUNT_USAGE.USERS view, whose columns report last_success_login and days_to_expiry for each user
    Show answer & explanation

    Correct answer: C — The SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY view, filtered on is_success = 'NO', which keeps 365 days of login events

    • A. The table function only returns events from the last seven days, so most of the four-month window would be missing.
    • B. SESSIONS records sessions that were created. Failed authentication attempts never create a session, so they do not appear there.
    • C. ACCOUNT_USAGE.LOGIN_HISTORY retains a year of login attempts including client_ip, user_name and error_message, so a filter on is_success = 'NO' covers the full four months.
    • D. USERS holds one row per user with summary attributes. It has no per-attempt rows, so it cannot show failed attempts by IP address.

    Subdomain 1.5: Set up and manage Snowflake authentication.

    4.A company federates all employees through SAML SSO and wants password sign-in blocked for everyone. One break-glass administrator must still be able to sign in with a password if the IdP is down. What is the BEST way to meet both needs?

    1. A.Set PASSWORD_MAX_AGE_DAYS = 1 in an account password policy so that stored passwords are always expired and users must fall back to the IdP
    2. B.Attach a network policy to every user except the break-glass administrator, so only that user can reach the password login screen from the corporate IP range
    3. C.Remove the password from every user with ALTER USER ... UNSET PASSWORD, and keep one ACCOUNTADMIN whose MUST_CHANGE_PASSWORD is set to FALSE
    4. D.Set an account authentication policy with AUTHENTICATION_METHODS = (SAML), plus a user-level policy allowing PASSWORD on the break-glass user
    Show answer & explanation

    Correct answer: D — Set an account authentication policy with AUTHENTICATION_METHODS = (SAML), plus a user-level policy allowing PASSWORD on the break-glass user

    • A. A password policy governs password rules, not allowed login methods. Expiry forces a reset prompt and does not block password sign-in or grant a break-glass exception.
    • B. Network policies filter by client IP and say nothing about the authentication method, so a user on an allowed IP could still sign in with a password.
    • C. Unsetting passwords is brittle and per-user, and it leaves the account without an enforced SAML-only rule. New users or later password resets would restore password sign-in.
    • D. Account-level policies apply to every user, and a policy set directly on a user takes precedence, so the break-glass user keeps password access while everyone else is limited to SAML.

    Subdomain 1.5: Set up and manage Snowflake authentication.

    5.A team registers a server-side web application as a custom Snowflake OAuth client that must keep sessions alive for days. Select TWO appropriate actions.(Select 2)

    1. A.Define EXTERNAL_OAUTH_ISSUER and EXTERNAL_OAUTH_JWS_KEYS_URL on the integration so that Snowflake can issue refresh tokens itself
    2. B.Read the client secret from the OAUTH_CLIENT_SECRET property in the output of DESCRIBE SECURITY INTEGRATION for that integration
    3. C.Create a TYPE = OAUTH integration with OAUTH_CLIENT = CUSTOM, a CONFIDENTIAL client type, a redirect URI and OAUTH_ISSUE_REFRESH_TOKENS = TRUE
    4. D.Call SYSTEM$SHOW_OAUTH_CLIENT_SECRETS with the integration name to retrieve the client ID and client secret for the app's configuration
    5. E.Generate a programmatic access token for each end user so that the web application can reuse it as the OAuth refresh token
    Show answer & explanation

    Correct answers: C, D — Create a TYPE = OAUTH integration with OAUTH_CLIENT = CUSTOM, a CONFIDENTIAL client type, a redirect URI and OAUTH_ISSUE_REFRESH_TOKENS = TRUE; Call SYSTEM$SHOW_OAUTH_CLIENT_SECRETS with the integration name to retrieve the client ID and client secret for the app's configuration

    • A. Incorrect. These properties belong to External OAuth, where the IdP issues tokens. Snowflake OAuth integrations do not use them.
    • B. Incorrect. DESCRIBE does not reveal client secrets. They are returned only by the dedicated system function.
    • C. Correct. A confidential custom client with a redirect URI and refresh tokens enabled lets the server-side app renew access tokens for long sessions.
    • D. Correct. This system function returns the generated client ID and secrets, which the application needs to perform the token exchange.
    • E. Incorrect. PATs are a separate credential type and are not refresh tokens of an OAuth flow.

    Subdomain 1.4: Given a scenario, fine-tune access controls.

    6.A security team enabled managed access on the schema FINANCE.REPORTING. A role that owns the table REPORTING.INVOICES then runs GRANT SELECT ON TABLE REPORTING.INVOICES TO ROLE AUDITOR. What is the result?

    1. A.The grant fails, because in a managed access schema only the schema owner or a MANAGE GRANTS role can grant on its objects.
    2. B.The grant succeeds, because object owners always keep the ability to grant privileges on objects they own in any schema.
    3. C.The grant succeeds only if the table owner has USAGE WITH GRANT OPTION on the schema and the database that contain the table.
    4. D.The grant is queued and applied once the schema owner approves it, since managed access requires a second approval step.
    Show answer & explanation

    Correct answer: A — The grant fails, because in a managed access schema only the schema owner or a MANAGE GRANTS role can grant on its objects.

    • A. Correct. Managed access schemas centralize grant management: object owners lose the ability to grant privileges, leaving that to the schema owner or MANAGE GRANTS holders.
    • B. Incorrect. That is true in regular schemas, but managed access removes the object owner's grant ability.
    • C. Incorrect. Grant options on the containers do not restore the object owner's ability to grant in a managed access schema.
    • D. Incorrect. Snowflake has no approval queue for grants; the statement is simply rejected for roles that are not authorized.

    Subdomain 1.1: Manage administrative roles

    7.An ORGADMIN renames the account ACME_PROD to ACME_PROD2 with the statement below. Dashboards that connect with the old account URL begin failing immediately. ``` ALTER ACCOUNT acme_prod RENAME TO acme_prod2 SAVE_OLD_URL = FALSE; ``` Which change would have let the old URL keep working during the migration?

    1. A.Creating a replication group in the account first, because replication keeps the source account identifier resolvable after a rename.
    2. B.Running the statement as ACCOUNTADMIN, since the account owner role can preserve the existing hostname while ORGADMIN always replaces it.
    3. C.Setting SAVE_OLD_URL = TRUE in the statement, which keeps the original URL usable for connections until that old URL is dropped.
    4. D.Adding a network policy on the account before the rename, which pins the original hostname to the previously allowed IP address ranges.
    Show answer & explanation

    Correct answer: C — Setting SAVE_OLD_URL = TRUE in the statement, which keeps the original URL usable for connections until that old URL is dropped.

    • A. Incorrect. Replication copies objects between accounts and does not keep a pre-rename URL resolvable.
    • B. Incorrect. Renaming accounts is an ORGADMIN operation, and running it with a different role does not change how URLs are handled.
    • C. Correct. The SAVE_OLD_URL parameter controls whether the original URL remains usable after the rename, so setting it to TRUE gives clients time to move.
    • D. Incorrect. Network policies filter client IP addresses; they have no influence on which hostnames resolve to the account.

    Subdomain 1.1: Manage administrative roles

    8.An ORGADMIN dropped the account ACME_SANDBOX yesterday and has just learned that a team still needed it. The drop used the default grace period. What is the MOST appropriate way to get the account back?

    1. A.Run UNDROP ACCOUNT for ACME_SANDBOX as ORGADMIN while the grace period is still active, restoring the account together with its objects.
    2. B.Create a new account with CREATE ACCOUNT under the same name, then ask support to reattach the old storage during the Fail-safe period.
    3. C.Restore the account from the most recent replication group refresh, since dropped accounts can only be rebuilt from replicated databases.
    4. D.Ask an ACCOUNTADMIN of the dropped account to query it with Time Travel, because dropped accounts keep their own retention window.
    Show answer & explanation

    Correct answer: A — Run UNDROP ACCOUNT for ACME_SANDBOX as ORGADMIN while the grace period is still active, restoring the account together with its objects.

    • A. Correct. DROP ACCOUNT has a grace period (7 days by default), and during it the ORGADMIN can run UNDROP ACCOUNT to restore the account.
    • B. Incorrect. Creating a new account with the same name gives an empty account, and reattaching old storage through Fail-safe is not how account recovery works.
    • C. Incorrect. Replication might preserve copies of some databases, but it is not the mechanism for restoring a dropped account, which UNDROP ACCOUNT handles directly.
    • D. Incorrect. Time Travel applies to objects inside a working account; users of the dropped account cannot log in to run such queries.

    Subdomain 1.6: Set up and manage network and private connectivity.

    9.An account has a network policy that allows only `203.0.113.0/24`, set with `ALTER ACCOUNT SET NETWORK_POLICY`. The service user `SVC_ETL` has its own user-level policy that allows only `198.51.100.0/24`. A job connects as `SVC_ETL` from `203.0.113.15`. What happens?

    1. A.The login is rejected, because only the user-level policy is evaluated for SVC_ETL and `203.0.113.15` is outside its allowed range.
    2. B.The login succeeds, because Snowflake accepts a connection that satisfies the allowed list of either the account policy or the user policy.
    3. C.The login succeeds, because the account-level policy has higher precedence and always overrides any policy attached to a single user.
    4. D.The login is rejected, because Snowflake requires the source IP to fall inside the allowed ranges of both the account and user policies at once.
    Show answer & explanation

    Correct answer: A — The login is rejected, because only the user-level policy is evaluated for SVC_ETL and `203.0.113.15` is outside its allowed range.

    • A. Correct. A user-level network policy replaces the account-level policy for that user; the two are never merged, so the source IP is judged only against the user's allowed range.
    • B. Incorrect. Snowflake does not take the union of the policies. When a user policy exists, the account policy is not consulted for that user at all.
    • C. Incorrect. Precedence runs the other way: the user-level policy is the most specific and takes priority over the security integration and account levels.
    • D. Incorrect. Intersection logic is not how Snowflake evaluates policies. Only one policy applies to a given user, so a connection never has to satisfy both.

    Subdomain 1.7: Set up and manage security administration and authorization.

    10.Provisioning from Okta worked for months. Suddenly every SCIM request is rejected with an authentication error, although the integration still exists and ENABLED is TRUE. What is the MOST likely cause and fix?

    1. A.The Okta service account password synced through SYNC_PASSWORD expired, so the integration must be recreated with a new initial password for provisioning.
    2. B.Network rules block Okta, so the integration's NETWORK_POLICY must be altered to unset the allowed IP list covering the IdP's published ranges.
    3. C.The SCIM access token expired after six months, so generate a new one with SYSTEM$GENERATE_SCIM_ACCESS_TOKEN and update it in the IdP.
    4. D.The provisioner role lost its CREATE USER privilege during a periodic access review, so it must be re-granted before the IdP token works again.
    Show answer & explanation

    Correct answer: C — The SCIM access token expired after six months, so generate a new one with SYSTEM$GENERATE_SCIM_ACCESS_TOKEN and update it in the IdP.

    • A. SCIM calls do not authenticate with a user password. SYNC_PASSWORD only controls whether passwords are pushed with user records.
    • B. A blocked network would show as connectivity or policy denial and the stem says nothing changed there. Removing a policy is also not a fix for an expired credential.
    • C. SCIM access tokens are valid for six months. Generating a replacement for the same role and storing it in the IdP restores provisioning.
    • D. A missing privilege would cause authorization failures on specific operations, not authentication errors on every request. The token is the likelier cause.

    Domain 2: Account Management and Data Governance

    Subdomain 2.2: Implement and manage data governance in Snowflake.

    11.An admin sets tag `pii_level = 'high'` on database `crm`. A new table `crm.public.contacts` is later created in that database. What is the effect on the new table and its columns?

    1. A.The new table is blocked from creation until the tag is explicitly applied to the table, since tagged databases require a tag on every child object
    2. B.The new table receives the tag only after the admin runs ALTER TABLE ... SET TAG, because tags attached to a database never reach child objects
    3. C.The new table inherits the tag, but its columns do not, since inheritance stops at the table level in the securable object hierarchy
    4. D.The new table and its columns inherit the tag through the object hierarchy, so they show `pii_level = 'high'` unless a lower level overrides it
    Show answer & explanation

    Correct answer: D — The new table and its columns inherit the tag through the object hierarchy, so they show `pii_level = 'high'` unless a lower level overrides it

    • A. Creation is not blocked. Tagging does not impose a requirement on child objects.
    • B. Tag inheritance is automatic, and no extra SET TAG is needed for children, including objects created afterwards.
    • C. Inheritance continues beyond tables to columns, so the new columns also resolve to the inherited value.
    • D. Tags are inherited down the securable-object hierarchy: database to schema to table to column. A value set at a lower level takes precedence over the inherited one.

    Subdomain 2.2: Implement and manage data governance in Snowflake.

    12.A governance team wants sensitive columns tagged `sensitivity = 'pii'` to be masked automatically wherever the tag appears, including columns created later. Select TWO steps required to implement a tag-based masking policy.(Select 2)

    1. A.Schedule a task that runs every hour to re-apply the masking policy to columns that received the tag since the previous task run.
    2. B.Run ALTER TAG sensitivity SET MASKING POLICY pii_mask so that every column carrying the tag, directly or by inheritance, is protected.
    3. C.Create a masking policy whose body calls SYSTEM$GET_TAG_ON_CURRENT_COLUMN('sensitivity') to decide whether to mask the value for the current role.
    4. D.Attach the masking policy to each table column individually, because tags only record labels and cannot carry policy attachments.
    5. E.Enable the tag-based masking feature in the account parameters using ALTER ACCOUNT SET ENABLE_TAG_MASKING = TRUE before creating policies.
    Show answer & explanation

    Correct answers: B, C — Run ALTER TAG sensitivity SET MASKING POLICY pii_mask so that every column carrying the tag, directly or by inheritance, is protected.; Create a masking policy whose body calls SYSTEM$GET_TAG_ON_CURRENT_COLUMN('sensitivity') to decide whether to mask the value for the current role.

    • A. No scheduler is needed because the attachment through the tag is automatic for newly tagged columns.
    • B. Binding the masking policy to the tag makes it apply to all tagged columns of matching data type, including inherited ones and new ones.
    • C. The policy can read the tag value of the column being queried through SYSTEM$GET_TAG_ON_CURRENT_COLUMN, enabling logic that depends on the tag.
    • D. Per-column attachment defeats the purpose and scales poorly. Tag-based masking exists to avoid it.
    • E. There is no such account parameter. Tag-based masking works by setting the policy on the tag itself.

    Subdomain 2.1: Manage organizations and accounts.

    13.A platform team is weighing whether to move six existing Snowflake accounts into a single organization. Which TWO statements about the benefits of doing so are accurate? Select TWO.(Select 2)

    1. A.Credit, storage and data transfer usage for all member accounts can be queried together through the ORGANIZATION_USAGE schema views
    2. B.Tables in any member account become readable from every other account in the organization without sharing or replication being set up
    3. C.Organization administrators can create, rename and drop member accounts themselves with SQL rather than raising a support case for each change
    4. D.Every account in the organization automatically shares one set of users, roles and network policies maintained by the organization administrator
    5. E.Every member account inherits the highest Snowflake edition that was purchased by any one account inside the same organization
    Show answer & explanation

    Correct answers: A, C — Credit, storage and data transfer usage for all member accounts can be queried together through the ORGANIZATION_USAGE schema views; Organization administrators can create, rename and drop member accounts themselves with SQL rather than raising a support case for each change

    • A. The ORGANIZATION_USAGE views report metering, storage and transfer for every account in one place, which supports central cost reporting. This is a documented organization capability.
    • B. Organization membership does not open data access between accounts. Cross-account reads still need secure data sharing or replication.
    • C. ORGADMIN runs CREATE ACCOUNT, ALTER ACCOUNT RENAME and DROP ACCOUNT, so lifecycle changes no longer depend on Snowflake Support. This is a core benefit of using an organization.
    • D. Users, roles and network policies are defined inside each account and are not shared by organization membership. Each account keeps its own security configuration.
    • E. Edition is chosen per account, so a Standard account and a Business Critical account can live in the same organization. Nothing is inherited between them.

    Subdomain 2.1: Manage organizations and accounts.

    14.An organization administrator is planning a new account for a Canadian subsidiary and needs to see which Snowflake regions can be chosen for accounts created in the organization. Which approach should be used?

    1. A.Run SELECT CURRENT_REGION() so the account reports every region that its cloud provider offers to the organization for new accounts
    2. B.Run SELECT SYSTEM$ALLOWLIST() to retrieve the cloud regions that the organization is permitted to deploy additional accounts into
    3. C.Run SHOW REGIONS to list the available regions, then pass the chosen region identifier in the REGION parameter of CREATE ACCOUNT
    4. D.Run SHOW ORGANIZATION ACCOUNTS and read the REGION column to see the full set of regions that are still unused by the organization
    Show answer & explanation

    Correct answer: C — Run SHOW REGIONS to list the available regions, then pass the chosen region identifier in the REGION parameter of CREATE ACCOUNT

    • A. CURRENT_REGION returns only the region of the current session's account. It cannot enumerate other regions.
    • B. SYSTEM$ALLOWLIST returns hostnames and ports that network firewalls must allow, and has no information about deployable regions.
    • C. SHOW REGIONS lists the Snowflake regions across cloud platforms, and the region identifier it returns is the value supplied to CREATE ACCOUNT. This is the documented way to choose a region.
    • D. SHOW ORGANIZATION ACCOUNTS lists existing accounts and the regions they already use, not the regions available for new ones. Unused regions never appear.

    Subdomain 2.3: Given a scenario, manage account identifiers.

    15.An architect reads that Snowflake groups regions into region groups and wants to know what the PUBLIC region group contains. Which statement is accurate?

    1. A.It holds only the AWS regions, because each cloud platform has its own dedicated region group in Snowflake
    2. B.It holds every region including government and Virtual Private Snowflake deployments, giving one global group
    3. C.It holds all multi-tenant commercial regions on every cloud, while government regions sit in separate groups
    4. D.It holds the regions that share one account locator prefix, which is how locators are kept unique per group
    Show answer & explanation

    Correct answer: C — It holds all multi-tenant commercial regions on every cloud, while government regions sit in separate groups

    • A. Region groups are security and compliance boundaries, not per-cloud groupings.
    • B. Government and VPS deployments sit outside PUBLIC in their own groups.
    • C. PUBLIC covers all multi-tenant commercial regions on every cloud, and government regions each get their own group.
    • D. Region groups have nothing to do with locator prefixes.

    Subdomain 2.3: Given a scenario, manage account identifiers.

    16.An administrator needs the organization name and the account name of the current account to build a client connection string. Select TWO functions that return these values.(Select 2)

    1. A.`CURRENT_ACCOUNT_NAME()`, which returns the account name that is unique within the organization
    2. B.`CURRENT_REGION()`, which returns the account name together with the region group of the account
    3. C.`CURRENT_CLIENT()`, which returns the identifier the connected driver should use as its account parameter
    4. D.`CURRENT_ORGANIZATION_NAME()`, which returns the name of the organization that the current account belongs to
    5. E.`CURRENT_ACCOUNT()`, which returns the organization and account name in `orgname-account_name` form
    Show answer & explanation

    Correct answers: A, D — `CURRENT_ACCOUNT_NAME()`, which returns the account name that is unique within the organization; `CURRENT_ORGANIZATION_NAME()`, which returns the name of the organization that the current account belongs to

    • A. This function returns the account name, the second half of the preferred identifier.
    • B. It returns the region of the current account, not the account name.
    • C. It returns client version information and says nothing about identifiers.
    • D. This function returns the organization name, the first half of the preferred identifier.
    • E. This function returns the legacy account locator, not the account name.

    Domain 3: Data and Object Management

    Subdomain 3.1: Given business requirements, design, manage, and maintain virtual warehouses.

    17.An ETL pipeline is running a 40-minute transformation on a MEDIUM warehouse when an administrator executes: ALTER WAREHOUSE etl_wh SET WAREHOUSE_SIZE = 'XLARGE'; What is the effect on the running transformation?

    1. A.The running query is paused and restarted from the beginning on the larger warehouse nodes, so it finishes much sooner.
    2. B.The running query is cancelled with an error, and the pipeline must resubmit it once the resize has fully completed.
    3. C.The running query keeps its original resources and finishes as it was, while only newly submitted queries use XLARGE.
    4. D.The running query migrates its intermediate results to the new nodes and continues, using the added compute at once.
    Show answer & explanation

    Correct answer: C — The running query keeps its original resources and finishes as it was, while only newly submitted queries use XLARGE.

    • A. Incorrect. Snowflake does not restart in-flight queries after a resize.
    • B. Incorrect. Resizing does not cancel anything and does not wait for queries to be resubmitted.
    • C. Correct. Resizing affects only queries submitted after the change, and the added nodes are provisioned for new work while existing queries complete unchanged.
    • D. Incorrect. Intermediate results are not moved to new nodes mid-query, so running queries cannot benefit from the extra compute.

    Subdomain 3.1: Given business requirements, design, manage, and maintain virtual warehouses.

    18.A shared warehouse suffers from two problems: ad-hoc queries that run for hours, and queries waiting for many minutes in the queue. The administrator wants Snowflake to cancel statements that run longer than 30 minutes or queue longer than 2 minutes. Which TWO parameters should be set on the warehouse? Select TWO.(Select 2)

    1. A.`STATEMENT_TIMEOUT_IN_SECONDS = 1800`, which aborts any statement that has been executing on the warehouse for longer than that value.
    2. B.`STATEMENT_QUEUED_TIMEOUT_IN_SECONDS = 120`, which cancels any statement that has waited in the warehouse queue longer than that value.
    3. C.`AUTO_SUSPEND = 120`, which suspends the warehouse and cancels all queued statements when it has been idle for that time.
    4. D.`MAX_CONCURRENCY_LEVEL = 120`, which limits queued statements to that many seconds before they are rejected from the queue.
    5. E.`MIN_CLUSTER_COUNT = 30`, which forces any query running past thirty minutes to move onto an additional cluster.
    Show answer & explanation

    Correct answers: A, B — `STATEMENT_TIMEOUT_IN_SECONDS = 1800`, which aborts any statement that has been executing on the warehouse for longer than that value.; `STATEMENT_QUEUED_TIMEOUT_IN_SECONDS = 120`, which cancels any statement that has waited in the warehouse queue longer than that value.

    • A. Correct. This parameter limits execution time, so runaway statements are cancelled after 30 minutes.
    • B. Correct. This parameter limits time in the queue, so statements waiting longer than 2 minutes are cancelled.
    • C. Incorrect. Auto-suspend only applies when no queries are running, so it neither limits execution time nor cancels queued work.
    • D. Incorrect. Concurrency level is a count of simultaneous statements, not a time limit.
    • E. Incorrect. The minimum cluster count sets how many clusters run and never moves running queries between clusters.

    Subdomain 3.2: Given a scenario, manage databases, tables, and views.

    19.An analytics team wants to run SQL directly over Parquet files in an Amazon S3 external stage without loading them into Snowflake. Select TWO statements that accurately describe external tables.(Select 2)

    1. A.External tables support INSERT and UPDATE for roles with OWNERSHIP, and Snowflake writes those changes back into the files in the stage.
    2. B.Time Travel and Fail-safe protect the staged files, so rows removed from the bucket can be recovered with UNDROP or an AT clause.
    3. C.At creation, Snowflake copies the Parquet files into its own micro-partition storage so that later queries no longer touch the bucket.
    4. D.Each row exposes a VALUE variant column holding the file record, and METADATA$FILENAME identifies the staged file it came from.
    5. E.A materialized view can be created over the external table to speed up repeated queries against the staged files in S3.
    Show answer & explanation

    Correct answers: D, E — Each row exposes a VALUE variant column holding the file record, and METADATA$FILENAME identifies the staged file it came from.; A materialized view can be created over the external table to speed up repeated queries against the staged files in S3.

    • A. Incorrect. External tables are read-only, so DML statements are rejected and the staged files can only be changed outside Snowflake.
    • B. Incorrect. The data stays in your cloud storage outside Snowflake's control, so Time Travel and Fail-safe do not apply to external table contents.
    • C. Incorrect. External tables only store file metadata in Snowflake, and each query still reads the files from the external stage location.
    • D. Correct. External tables always return the semi-structured VALUE column plus pseudocolumns such as METADATA$FILENAME, which let queries trace rows back to files.
    • E. Correct. Materialized views are supported on external tables and store precomputed results inside Snowflake, which improves performance for repeated queries.

    Subdomain 3.2: Given a scenario, manage databases, tables, and views.

    20.A team plans to clone the production database PROD_DB to create a development environment. Select TWO statements that accurately describe the behavior of `CREATE DATABASE dev_db CLONE prod_db`.(Select 2)

    1. A.Grants on the cloned database itself are not copied from PROD_DB, so roles need new privileges on DEV_DB; child objects keep theirs.
    2. B.A clone of a transient table can be created as a permanent table so the new copy gains a Fail-safe period for the development data.
    3. C.The clone is metadata-only and shares existing micro-partitions, so extra storage accrues only as data in either database diverges over time.
    4. D.The operation needs a running virtual warehouse to copy the micro-partitions, and compute credits scale with the volume of data cloned.
    5. E.Later changes to tables in PROD_DB keep flowing into DEV_DB, until the clone is detached from its source with an ALTER DATABASE command.
    Show answer & explanation

    Correct answers: A, C — Grants on the cloned database itself are not copied from PROD_DB, so roles need new privileges on DEV_DB; child objects keep theirs.; The clone is metadata-only and shares existing micro-partitions, so extra storage accrues only as data in either database diverges over time.

    • A. Correct. Privileges granted on the container object are not inherited by the clone, whereas privileges on contained objects are retained.
    • B. Incorrect. Transient and temporary tables can only be cloned into transient or temporary tables, so they cannot become permanent through cloning.
    • C. Correct. Zero-copy cloning reuses the source's micro-partitions, and only changed data is stored separately afterwards.
    • D. Incorrect. Cloning is a metadata operation performed by cloud services, so it needs no warehouse and its cost does not scale with data volume.
    • E. Incorrect. A clone is independent as soon as it is created, so subsequent changes to the source never propagate to it.

    Subdomain 3.3: Given a scenario, stage data in Snowflake.

    21.A security policy states that nobody may create a stage with an inline credentials string and that unloads must never target a raw cloud storage URL typed into a `COPY INTO` statement. Select TWO account parameters that enforce this.(Select 2)

    1. A.Set `PREVENT_UNLOAD_TO_INLINE_URL = TRUE` so that `COPY INTO <location>` statements cannot write to a cloud storage URL given directly in the command.
    2. B.Set `ENABLE_UNLOAD_PHYSICAL_TYPE_OPTIMIZATION = FALSE` so that unloaded Parquet files cannot be written to locations outside the account's region.
    3. C.Set `PERIODIC_DATA_REKEYING = TRUE` so that stored data is re-encrypted annually and credentials seen by users become invalid after the rekey.
    4. D.Set `SSO_LOGIN_PAGE = TRUE` so that users must authenticate through the identity provider before they are able to reference an external storage location.
    5. E.Set `REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE` so that new external stages must reference a storage integration rather than embed credentials.
    Show answer & explanation

    Correct answers: A, E — Set `PREVENT_UNLOAD_TO_INLINE_URL = TRUE` so that `COPY INTO <location>` statements cannot write to a cloud storage URL given directly in the command.; Set `REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE` so that new external stages must reference a storage integration rather than embed credentials.

    • A. Correct. This parameter blocks unloads that pass an inline URL, forcing unloads to go through a named stage, which can be governed by an integration.
    • B. Incorrect. This parameter only influences the physical column types in unloaded Parquet files; it has no effect on destination or authentication rules.
    • C. Incorrect. Rekeying rotates encryption keys for data at rest in Snowflake storage; it does not constrain how stages are created or where unloads can write.
    • D. Incorrect. This parameter changes what the login page shows for SSO; it does not restrict stage creation or unload destinations.
    • E. Correct. With this enabled, `CREATE STAGE` on an external location fails unless a storage integration is specified, so credentials can no longer be embedded in stage definitions.

    Subdomain 3.3: Given a scenario, stage data in Snowflake.

    22.A data engineering role already has `USAGE` on the target database and schema. It must create external stages that use an existing integration named `s3_int`, but must not be able to alter or drop that integration. Select TWO privileges to grant.(Select 2)

    1. A.`GRANT CREATE INTEGRATION ON ACCOUNT TO ROLE data_eng` so the role may set up the integration objects it needs for each stage.
    2. B.`GRANT OWNERSHIP ON INTEGRATION s3_int TO ROLE data_eng` so the role has full control of the integration object it depends on.
    3. C.`GRANT USAGE ON INTEGRATION s3_int TO ROLE data_eng` so the role may reference the integration when a stage is defined.
    4. D.`GRANT CREATE STAGE ON SCHEMA analytics.raw TO ROLE data_eng` so the role may create stage objects within the schema.
    5. E.`GRANT MONITOR ON INTEGRATION s3_int TO ROLE data_eng` so the role can see the integration and attach it to stage definitions.
    Show answer & explanation

    Correct answers: C, D — `GRANT USAGE ON INTEGRATION s3_int TO ROLE data_eng` so the role may reference the integration when a stage is defined.; `GRANT CREATE STAGE ON SCHEMA analytics.raw TO ROLE data_eng` so the role may create stage objects within the schema.

    • A. Incorrect. This lets the role create new integrations and is not what is needed to use an existing one; it also widens the exfiltration surface.
    • B. Incorrect. Ownership allows the role to alter, drop, and re-grant the integration, which violates the requirement not to modify it.
    • C. Correct. Referencing a storage integration in `CREATE STAGE` requires `USAGE` on that integration, which does not allow modifying it.
    • D. Correct. Creating any stage object requires `CREATE STAGE` on the schema where it will live, in addition to usage of the integration.
    • E. Incorrect. `MONITOR` only lets a role see metadata about the object; it does not authorize using the integration in a stage.

    Subdomain 3.4: Given a scenario, manage tasks.

    23.A support team role `support_ops` must suspend, resume and manually trigger the task `ETL.JOBS.DAILY_SALES_LOAD`, but must not be able to change its definition or take ownership. Select TWO grants that satisfy this requirement.(Select 2)

    1. A.GRANT OPERATE ON TASK ETL.JOBS.DAILY_SALES_LOAD TO ROLE support_ops, allowing suspend, resume and manual execution of the task.
    2. B.GRANT USAGE ON DATABASE ETL and USAGE ON SCHEMA ETL.JOBS TO ROLE support_ops, so the task can be reached by name.
    3. C.GRANT OWNERSHIP ON TASK ETL.JOBS.DAILY_SALES_LOAD TO ROLE support_ops, so the team can control every aspect of the task.
    4. D.GRANT EXECUTE MANAGED TASK ON ACCOUNT TO ROLE support_ops, so the team can start tasks that use serverless compute.
    5. E.GRANT MONITOR ON TASK ETL.JOBS.DAILY_SALES_LOAD TO ROLE support_ops, so the team can control the task as an operator.
    Show answer & explanation

    Correct answers: A, B — GRANT OPERATE ON TASK ETL.JOBS.DAILY_SALES_LOAD TO ROLE support_ops, allowing suspend, resume and manual execution of the task.; GRANT USAGE ON DATABASE ETL and USAGE ON SCHEMA ETL.JOBS TO ROLE support_ops, so the task can be reached by name.

    • A. Correct: OPERATE on the task lets a non-owner suspend, resume and run it without being able to alter the definition.
    • B. Correct: the role also needs USAGE on the containing database and schema to reference the task at all.
    • C. Incorrect: OWNERSHIP would let the team alter, drop and re-grant the task, which exceeds the stated requirement.
    • D. Incorrect: EXECUTE MANAGED TASK is the privilege for creating serverless tasks and does not give control over an existing task.
    • E. Incorrect: MONITOR only allows viewing task details and history, and cannot be used to suspend, resume or trigger the task.

    Subdomain 3.5: Perform queries in Snowflake .

    24.A team lead wants a colleague to see the latest results of a Snowsight worksheet and run it with the colleague's own role, but must not let them edit the SQL or re-share it. Select TWO accurate statements about worksheet sharing.(Select 2)

    1. A.'View + Run' lets the colleague run the worksheet with a suitable role and duplicate it, without editing the original.
    2. B.Only the 'Edit' permission allows re-sharing, because editors can change content, manage versions and share the worksheet further.
    3. C.'View Results' lets the colleague run the SQL with any role, since the permission only restricts editing of the worksheet text.
    4. D.A worksheet owner cannot grant access to individual users and must use roles because sharing only works at role level.
    5. E.'View Results' shows the latest results to anyone, even a user who lacks the role that originally ran the statement.
    Show answer & explanation

    Correct answers: A, B — 'View + Run' lets the colleague run the worksheet with a suitable role and duplicate it, without editing the original.; Only the 'Edit' permission allows re-sharing, because editors can change content, manage versions and share the worksheet further.

    • A. Correct: View + Run allows running the worksheet and duplicating it, while the original stays unchanged.
    • B. Correct: Edit is the permission that carries content modification, version management and re-sharing rights.
    • C. Incorrect: View Results is read-only for the latest results and does not allow running the SQL.
    • D. Incorrect: worksheets can be shared with specific users as well as roles, so role-only sharing is not a requirement.
    • E. Incorrect: to see past run results, the viewer must hold the role that was used to run the statement.

    Domain 4: Performance Monitoring and Tuning

    Subdomain 4.1: Monitor and analyze Snowflake performance.

    25.A join between ORDERS (50 M rows) and CUSTOMERS (2 M rows) returns 4 billion rows and runs for 40 minutes. The Query Profile Join operator shows output rows far larger than either input. Which TWO findings or fixes apply? Select TWO.(Select 2)

    1. A.The warehouse lacks sufficient size, so the Join operator should be replaced with a UNION ALL to avoid the cross product of rows
    2. B.The result cache has expired, so setting USE_CACHED_RESULT to TRUE removes the extra rows produced during the join on later runs
    3. C.Duplicate keys in the CUSTOMERS table multiply matching rows, so deduplicate it or aggregate it before joining to restore a one-to-many join
    4. D.The join condition is missing or matches on a non-unique column, producing a row explosion, so join on the unique customer key
    5. E.The micro-partitions are too small to prune, so recluster ORDERS on order_date until the join returns only its original number of rows
    Show answer & explanation

    Correct answers: C, D — Duplicate keys in the CUSTOMERS table multiply matching rows, so deduplicate it or aggregate it before joining to restore a one-to-many join; The join condition is missing or matches on a non-unique column, producing a row explosion, so join on the unique customer key

    • A. Incorrect. Resizing does not fix the logical row multiplication, and UNION ALL stacks rows rather than relating them like a join does.
    • B. Incorrect. The result cache only reuses identical earlier results and cannot change how many rows a join generates.
    • C. Correct. Duplicate join keys on the dimension side multiply the matched rows; removing duplicates before the join restores the expected cardinality.
    • D. Correct. A missing or non-selective join condition behaves like a cross product, so output rows exceed both inputs; joining on the proper unique key removes the explosion.
    • E. Incorrect. Clustering affects how many partitions are read, not how many rows come out of a join with a faulty condition.

    Subdomain 4.1: Monitor and analyze Snowflake performance.

    26.A batch job occasionally hangs waiting for a busy warehouse, and a runaway query once ran for two days. The administrator wants queued statements cancelled after 10 minutes and any running statement stopped after 2 hours. Which TWO parameters should be set? Select TWO.(Select 2)

    1. A.LOCK_TIMEOUT = 7200 on the session so that statements running longer than two hours are cancelled and release their resources
    2. B.MAX_CONCURRENCY_LEVEL = 7200 on the warehouse so that statements are failed once two hours of total execution has been exceeded
    3. C.STATEMENT_QUEUED_TIMEOUT_IN_SECONDS = 600 on the warehouse so statements waiting in the queue are aborted after ten minutes
    4. D.AUTO_SUSPEND = 600 on the warehouse so that queued statements are removed after ten minutes of waiting without a running cluster
    5. E.STATEMENT_TIMEOUT_IN_SECONDS = 7200 on the warehouse so any statement running longer than two hours is automatically cancelled
    Show answer & explanation

    Correct answers: C, E — STATEMENT_QUEUED_TIMEOUT_IN_SECONDS = 600 on the warehouse so statements waiting in the queue are aborted after ten minutes; STATEMENT_TIMEOUT_IN_SECONDS = 7200 on the warehouse so any statement running longer than two hours is automatically cancelled

    • A. Incorrect. LOCK_TIMEOUT controls how long a statement waits for a lock on a table, not how long it can execute.
    • B. Incorrect. MAX_CONCURRENCY_LEVEL sets how many statements run concurrently on a cluster and is not a time limit.
    • C. Correct. STATEMENT_QUEUED_TIMEOUT_IN_SECONDS aborts statements that sit in the warehouse queue longer than the value.
    • D. Incorrect. AUTO_SUSPEND controls idle time before suspension and does not remove queued statements.
    • E. Correct. STATEMENT_TIMEOUT_IN_SECONDS cancels any statement that runs longer than the configured number of seconds.

    Subdomain 4.2: Manage DML locking and concurrency in Snowflake.

    27.A BI dashboard runs a heavy SELECT against SALES_FACT while a 45-minute UPDATE on the same table is still in progress. The analyst worries the query will block or return half-applied rows. Which statement describes what happens?

    1. A.The SELECT runs immediately but returns the uncommitted UPDATE rows, since Snowflake supports READ UNCOMMITTED for read-only statements.
    2. B.The SELECT runs at once without locks and returns only data committed before it began, ignoring the in-flight UPDATE.
    3. C.The SELECT waits for the UPDATE to commit because readers must obtain a shared table lock, and then returns the fully updated rows.
    4. D.The SELECT fails with a lock timeout error after the default wait period because queries cannot read tables with active UPDATE locks.
    Show answer & explanation

    Correct answer: B — The SELECT runs at once without locks and returns only data committed before it began, ignoring the in-flight UPDATE.

    • A. Incorrect: Snowflake never exposes uncommitted data; READ UNCOMMITTED is not a supported isolation level.
    • B. Correct: SELECT statements never acquire locks, and under READ COMMITTED a statement sees only data committed before it started.
    • C. Incorrect: readers do not take shared table locks in Snowflake, so there is nothing for the SELECT to wait on.
    • D. Incorrect: queries are not blocked by DML locks, so no lock timeout applies to the SELECT.

    Subdomain 4.3: Given a scenario, implement resource monitors.

    28.A CFO asks which Snowflake consumption is NOT controlled by any resource monitor and needs different tooling. Select THREE items that resource monitors cannot cap.(Select 3)

    1. A.Credits used by automatic clustering that keeps large tables well clustered in the background.
    2. B.Credits used by Snowpipe to load newly staged files continuously with serverless compute resources.
    3. C.Credits used by a multi-cluster warehouse while it scales out and runs several clusters at once.
    4. D.Cloud services credits consumed by queries that are running on a warehouse with a monitor attached.
    5. E.Credits used by serverless tasks that run on Snowflake-managed compute, not a user warehouse.
    Show answer & explanation

    Correct answers: E, A, B — Credits used by serverless tasks that run on Snowflake-managed compute, not a user warehouse.; Credits used by automatic clustering that keeps large tables well clustered in the background.; Credits used by Snowpipe to load newly staged files continuously with serverless compute resources.

    • A. Correct: automatic clustering is a serverless feature billed outside warehouses, so no resource monitor can limit it.
    • B. Correct: Snowpipe uses serverless compute rather than a warehouse, so it sits outside resource monitor control.
    • C. Incorrect: every cluster of a multi-cluster warehouse draws warehouse credits, and a monitor on that warehouse counts them all toward its quota.
    • D. Incorrect: resource monitors track warehouse credits together with cloud services credits for the monitored warehouses, so this usage is controlled.
    • E. Correct: serverless tasks use Snowflake-managed compute, which resource monitors do not track. Budgets are the tool for such spend.

    Subdomain 4.5: Manage and optimize costs.

    29.During an incident, an administrator must list the queries that ran on a warehouse in the last 20 minutes, and the result must be complete with no ingestion delay. Which source should be used?

    1. A.The SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY view, filtered by warehouse name and the last 20 minutes
    2. B.The SNOWFLAKE.ORGANIZATION_USAGE.WAREHOUSE_METERING_HISTORY view, filtered by account and warehouse name
    3. C.The SNOWFLAKE.ACCOUNT_USAGE.WAREHOUSE_EVENTS_HISTORY view, which lists warehouse activity and its queries
    4. D.The INFORMATION_SCHEMA.QUERY_HISTORY table function, filtered by warehouse name and an end-time range
    Show answer & explanation

    Correct answer: D — The INFORMATION_SCHEMA.QUERY_HISTORY table function, filtered by warehouse name and an end-time range

    • A. ACCOUNT_USAGE views lag behind real time, with QUERY_HISTORY delayed by up to roughly 45 minutes. Queries from the last 20 minutes may be missing.
    • B. This view reports credit consumption by warehouse across the organization, not individual queries. It also arrives with a delay of hours.
    • C. This view records warehouse events such as resume, suspend and resize, not individual query records. It is also subject to ACCOUNT_USAGE latency.
    • D. The INFORMATION_SCHEMA table functions return results in real time with no latency, which suits a very recent window. They only cover a short recent period, which is fine here.

    Subdomain 4.5: Manage and optimize costs.

    30.A platform team must attribute last month's serverless spend to its causes: Snowpipe loading, materialized view maintenance and automatic clustering. Select THREE ACCOUNT_USAGE views that report these credits.(Select 3)

    1. A.MATERIALIZED_VIEW_REFRESH_HISTORY, which lists credits used to maintain each materialized view
    2. B.WAREHOUSE_METERING_HISTORY, which lists hourly credits consumed by each virtual warehouse
    3. C.LOGIN_HISTORY, which lists authentication attempts by user, client type and outcome
    4. D.QUERY_HISTORY, which lists each statement with its elapsed time and bytes scanned
    5. E.PIPE_USAGE_HISTORY, which lists credits consumed and files loaded by Snowpipe pipes
    6. F.AUTOMATIC_CLUSTERING_HISTORY, which lists credits used to recluster each clustered table
    Show answer & explanation

    Correct answers: A, E, F — MATERIALIZED_VIEW_REFRESH_HISTORY, which lists credits used to maintain each materialized view; PIPE_USAGE_HISTORY, which lists credits consumed and files loaded by Snowpipe pipes; AUTOMATIC_CLUSTERING_HISTORY, which lists credits used to recluster each clustered table

    • A. Materialized view maintenance runs on serverless compute and is reported here by view. It exposes the cost of keeping views current.
    • B. This view covers warehouse compute only. Serverless features do not run on a user warehouse, so their credits are absent.
    • C. This is a security audit view with nothing about credit use. It cannot help attribute serverless spend.
    • D. QUERY_HISTORY describes statements and has no credit totals for background serverless services. It cannot attribute these charges.
    • E. This view reports Snowpipe credit consumption per pipe along with bytes and files loaded. It is the source for ingestion cost.
    • F. Background reclustering is serverless, and this view reports the credits by table. It covers the third cost source.

    Subdomain 4.4: Enable and manage logging and tracing.

    31.An administrator wants developers to query the default system event table, with each team seeing only rows from its own databases. Select TWO steps to implement this.(Select 2)

    1. A.Have a role with SNOWFLAKE.EVENTS_ADMIN attach a row access policy to the events view that filters by database name.
    2. B.Create a secure view in each team database that selects from SNOWFLAKE.TELEMETRY.EVENTS and share it to the matching team roles.
    3. C.Run ALTER ACCOUNT SET EVENT_TABLE to a custom table for each team, since the account can use one event table per team.
    4. D.Grant the SNOWFLAKE.EVENTS_VIEWER application role to each developer role so they can query SNOWFLAKE.TELEMETRY.EVENTS_VIEW.
    5. E.Run GRANT SELECT ON SNOWFLAKE.TELEMETRY.EVENTS TO ROLE for every team role, then add a masking policy on the RECORD column.
    Show answer & explanation

    Correct answers: A, D — Have a role with SNOWFLAKE.EVENTS_ADMIN attach a row access policy to the events view that filters by database name.; Grant the SNOWFLAKE.EVENTS_VIEWER application role to each developer role so they can query SNOWFLAKE.TELEMETRY.EVENTS_VIEW.

    • A. Correct. The EVENTS_ADMIN application role is allowed to add a row access policy to the events view, so each team's rows can be filtered per team.
    • B. Incorrect. Secure views cannot be built on the system event table in user databases, and this does not apply row-level filtering to the shared view.
    • C. Incorrect. An account has only one active event table at a time, so it cannot have an event table for each team.
    • D. Correct. The EVENTS_VIEWER application role gives read access to the events view without needing ACCOUNTADMIN.
    • E. Incorrect. Access to the default table is provided through the application roles and the view rather than direct grants on the system table.

    Domain 5: Data Sharing and Snowflake Marketplace

    Subdomain 5.1: Implement and manage data sharing.

    32.A data vendor wants to monetize a weather dataset and have any Snowflake customer discover and request it, with the vendor controlling the listing and profile. Which sharing model is MOST appropriate?

    1. A.Create a direct share and add each interested customer's account identifier with ALTER SHARE ... ADD ACCOUNTS
    2. B.Create a reader account per prospective customer and send each one credentials to the vendor-managed account
    3. C.Create a private listing limited to named consumer accounts and approve each request manually by email
    4. D.Publish a public listing on the Snowflake Marketplace under the vendor's provider profile, open to all
    Show answer & explanation

    Correct answer: D — Publish a public listing on the Snowflake Marketplace under the vendor's provider profile, open to all

    • A. Incorrect. A direct share reaches only accounts that the provider adds by hand, so customers cannot discover the dataset on their own.
    • B. Incorrect. Reader accounts serve known customers without Snowflake and scale poorly for open discovery.
    • C. Incorrect. Private listings are visible only to chosen accounts, so strangers cannot find them in the Marketplace.
    • D. Correct. A public Marketplace listing makes the data discoverable to all Snowflake customers, with the vendor's profile, terms and pricing attached.

    Subdomain 5.2: Implement and manage the Snowflake Marketplace

    33.A provider has a published private listing delivered to a specified consumer account. The provider later wants to point that listing at a different secure share containing a restructured schema. What is the MOST appropriate approach?

    1. A.Unpublish the listing, drop the old share, and attach the new share by editing the same listing's settings
    2. B.Grant the consumer IMPORTED PRIVILEGES on the new share and leave the listing's original share attached
    3. C.Run ALTER LISTING to swap in the new share, then republish the listing so consumers pick up the change
    4. D.Create a new listing that uses the new share, then retire the old listing once consumers have moved
    Show answer & explanation

    Correct answer: D — Create a new listing that uses the new share, then retire the old listing once consumers have moved

    • A. Dropping the old share and editing the listing does not work, because the listing's share binding is fixed once created.
    • B. IMPORTED PRIVILEGES is granted to roles in a consumer account on an imported database. It does not change what a provider's listing delivers.
    • C. The share associated with a private listing cannot be changed in place, so ALTER LISTING cannot swap it, whatever republishing is done.
    • D. Because the attached share cannot be changed, the supported path is a new listing built on the new share, with the old listing retired after consumers migrate.

    Domain 6: Disaster Recovery, Backup, and Data Replication

    Subdomain 6.1: Manage data replication.

    34.Applications connect to Snowflake through the connection URL of a connection object named prodconn. A failover group was promoted in the target account, yet clients still reach the old primary. Which action redirects the clients?

    1. A.Update the company DNS record to point at the target account's locator-based hostname and ask every application team to change their drivers
    2. B.Run ALTER CONNECTION prodconn PRIMARY in the target account so the connection URL resolves to the new primary account
    3. C.Run ALTER FAILOVER GROUP ... REFRESH in the target account again so the connection object is rebuilt from the old primary
    4. D.Resume all warehouses in the target account so that new sessions started through the connection URL are routed to the new primary
    Show answer & explanation

    Correct answer: B — Run ALTER CONNECTION prodconn PRIMARY in the target account so the connection URL resolves to the new primary account

    • A. Incorrect: pointing DNS at a locator hostname works but requires client changes, which defeats using a connection object.
    • B. Correct: promoting the secondary connection makes the connection URL point to the new primary, so clients that use it are redirected without configuration changes.
    • C. Incorrect: a refresh copies objects from the primary and does not promote a connection.
    • D. Incorrect: warehouse state does not change where the connection URL resolves.

    Subdomain 6.2: Given a scenario, manage Snowflake Time Travel and Fail-safe.

    35.A compliance team requires every table in an Enterprise account to keep at least 7 days of Time Travel, even when table owners set a lower value. The administrator sets `MIN_DATA_RETENTION_TIME_IN_DAYS = 7` on the account. Select TWO statements that are true.(Select 2)

    1. A.The 7-day minimum also extends transient and temporary tables, which then keep 7 days of Time Travel history.
    2. B.A table owner can bypass the minimum by setting the table retention to 0, which disables Time Travel on that table.
    3. C.The setting rewrites each table's stored DATA_RETENTION_TIME_IN_DAYS value to 7, so owners can no longer see their original value.
    4. D.Only the ACCOUNTADMIN role can set this parameter, and it exists only at the account level, not on databases or tables.
    5. E.A permanent table explicitly set to 2 days gets an effective retention of 7 days, because the larger of the two values applies.
    Show answer & explanation

    Correct answers: D, E — Only the ACCOUNTADMIN role can set this parameter, and it exists only at the account level, not on databases or tables.; A permanent table explicitly set to 2 days gets an effective retention of 7 days, because the larger of the two values applies.

    • A. Incorrect. Transient and temporary tables are capped at 1 day of Time Travel, so the minimum cannot extend them to 7 days.
    • B. Incorrect. The effective retention is still the larger of the two values, so a table-level setting of 0 does not disable Time Travel below the minimum.
    • C. Incorrect. The object's own setting is left unchanged and only the effective value is raised, so owners still see the value they configured.
    • D. Correct. The minimum retention parameter exists only at the account level and is restricted to ACCOUNTADMIN, so object owners cannot change it.
    • E. Correct. Snowflake applies the maximum of the object's retention and the account minimum, so a 2-day table is effectively retained for 7 days.

    Want the full experience?

    These are just samples. Practice the full Snowflake SnowPro Advanced: Administrator (ADA-C02) question bank in quiz mode — free, no signup, with domain practice and exam simulation.

    Practice all 361 questions in quiz mode