COF-C03 Question 309
Single answer5.1 Explain data collaboration and protectionA healthcare analytics company stores curated provider performance data in Snowflake and wants to make a subset of that data available to several external insurance partners. The company must avoid copying data into each partner's environment, keep the data read-only for consumers, and ensure that one partner cannot see another partner's usage or objects. Which Snowflake approach best meets these requirements?
- A
Create a secure data share and add the required database objects to the share for each partner account
- B
Replicate the database to each partner's Snowflake account and grant SELECT privileges on the replicated database
- C
Unload the data to encrypted cloud storage and let each partner create an external table over the files
- D
Create a database role with SELECT privileges and grant that role directly to users in the partner accounts
Show answer and explanation
Correct answer: A
Explanation
The best solution is secure data sharing. Snowflake secure shares allow a provider to expose selected database objects to other Snowflake accounts without physically copying the data. Consumers access the shared data as a read-only database, which satisfies the read-only requirement. Creating a separate share per partner is a common best practice when partners should be isolated from one another and receive only their own approved data set. This approach is central to Snowflake's data collaboration model and is more appropriate than replication or file-based distribution when the goal is governed, no-copy sharing. Relevant Snowflake documentation includes topics on Secure Data Sharing, Shares and Consumers, and using secure objects such as secure views to further protect underlying data.
- A. Correct.
Correct. Secure data sharing is designed for Snowflake-to-Snowflake collaboration without copying or moving the underlying data. The provider can share specific objects, such as tables and secure views, and consumers get read-only access through a database created from the share. Separate shares can be created for each partner account, which helps isolate access and prevents one consumer from seeing another consumer's objects or activity.
- B. Incorrect.
Incorrect. Database replication copies data and metadata to another account or region for availability and disaster recovery scenarios, not for the most efficient collaboration pattern in this case. It also does not align with the requirement to avoid copying data into each partner's environment.
- C. Incorrect.
Incorrect. Unloading to cloud storage creates file copies and requires partners to manage access to those files. Although encryption can protect data at rest, this approach does not satisfy the requirement to avoid copying data and introduces additional operational complexity compared to Snowflake secure sharing.
- D. Incorrect.
Incorrect. Database roles can be granted within Snowflake accounts, but they are not the mechanism for directly granting access across separate external customer accounts. For cross-account collaboration, Snowflake uses shares, listings, and related sharing constructs rather than direct role grants to users in another account.