Snowflake SnowPro Specialty - Native Apps Sample Questions:

1. You are publishing a Snowflake Native Application to the Marketplace. You've completed initial testing, and the application appears to function as expected. However, the security scan consistently fails with a 'Data Exfiltration' error. The application includes a stored procedure that aggregates data from several tables within the application container and writes the results to an external stage using the 'COPY INTO' command. Review the following code snippet:

Which of the following changes is MOST likely to resolve the 'Data Exfiltration' error during the security scan?

A) Implement row-level security policies on the 'aggregated_data' table to restrict access to sensitive rows.
B) Require the consumer to explicitly grant the application usage privilege on a secure external stage controlled by the consumer, and modify the procedure to validate the stage's existence and permissions before exporting data.
C) Modify the stored procedure to only export data to a table within the application container instead of an external stage.
D) Encrypt the data written to the external stage using client-side encryption with a key managed by the application provider.
E) Remove the 'GRANT EXECUTE privilege on the 'export_data' procedure from the 'app_public' role.

2. You are managing a Snowflake Native Application that provides data enrichment services. Over time, you've accumulated several application package versions: v1 .0 (initial release), v1.1 (bug fixes), v2.0 (new features and schema changes), and v2.1 (performance improvements for v2.0). Some consumers are still using v1 .0, while others have upgraded to v2.1. You need to retire v1.0 to reduce maintenance overhead. Which of the following actions and considerations are MOST important when deprecating vl .0? Select TWO that apply.

A) Update the application's metadata in the Snowflake Marketplace to indicate that v1.0 is no longer supported.
B) Immediately drop version v1.0 from the application package to free up storage space.
C) Automatically migrate all consumers still using v1.0 to the latest version (v2.1 ) without their consent to simplify management.
D) Identify consumers still using v1.0. Communicate the deprecation timeline and provide clear instructions on how to upgrade to a supported version. Offer support during the transition.
E) Keep v1.0 indefinitely to ensure compatibility with all existing application instances, regardless of usage.

3. A software company, 'Data Insights Corp', develops a Snowflake Native App. They want to grant users the ability to view limited metadata information about the app's installation without granting them extensive privileges over the app's data or functionality. Which of the following options BEST represent the correct approach for granting Viewer privileges in a Snowflake Native App context to a consumer account user?

A) Grant the 'SELECT' privilege on all tables within the application instance to the user role.
B) Grant the USAGE privilege on the application package to the user role.
C) Create a custom role in the consumer account and grant the 'MONITOR EXECUTION' privilege on the application instance to that role, then grant that role to the user.
D) Grant the 'IMPORTED PRIVILEGES privilege on the application package to the user role.
E) Grant the 'APPLY APPLICATION' privilege on the application package to the user role.

4. A Native Application provider wants to grant the 'SELECT privilege on a view, 'CUSTOMER DATA, in a shared database 'SALES DATA DB' to consumers installing their application. The provider also wants to ensure that future views created in 'SALES DATA DB' are automatically accessible to the application. Which of the following SQL statements, executed by the provider, achieves this with the LEAST amount of privilege escalation risk?

A)

B)

C)

D)

E)

5. You are designing a Snowflake Native App that interacts with sensitive customer dat a. You need to ensure that the application only accesses the data it absolutely needs and adheres to the principle of least privilege. Which of the following strategies are crucial for maintaining data security within your application?

A) Create specific roles with granular access privileges (e.g., 'SELECT on specific columns) and grant these roles to the application's managed service account.
B) Implement data masking policies to redact sensitive information before it's accessed by the application.
C) Utilize Snowflake's secure UDFs with invoker's rights to perform data transformations and access control based on the user's role.
D) Grant the application role the 'OWNERSHIP' privilege on all tables containing customer data.
E) Store sensitive customer data directly within the application package to avoid external access.

Solutions: