COF-C03 Question 310
Single answer5.1 Explain data collaboration and protectionA retail company stores customer purchase data in Snowflake and wants to share a curated subset of this data with an external supplier for demand forecasting. The supplier should be able to query the latest shared data without copying it, and the retail company must ensure the supplier cannot see any other internal objects or modify the shared data. Which Snowflake approach best meets these requirements?
- A
Create a secure data share containing only the required database objects, and have the supplier create a database from the share in their Snowflake account
- B
Export the curated tables to external stage files and give the supplier READ and WRITE access to the stage so they can load and update the files as needed
- C
Create a reader account for the supplier and grant them ACCOUNTADMIN so they can query the shared database and manage any required permissions
- D
Replicate the entire production database to the supplier's region and let the supplier use role-based access control in their own account to hide unneeded objects
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Secure Data Sharing. Snowflake data sharing allows providers to share live, read-only data across Snowflake accounts without copying or moving the data. This is a core collaboration capability and supports strong data protection because the provider controls exactly which objects are shared. In practice, providers often expose secure views instead of base tables to further limit columns or rows. If the external party does not have a Snowflake account, a reader account can be used, but it should still follow least-privilege principles. Relevant Snowflake documentation includes topics on Secure Data Sharing, reader accounts, and secure views as part of data protection and controlled collaboration best practices.
- A. Correct.
Correct. Snowflake Secure Data Sharing is designed for this scenario. A provider can create a share with only the specific databases, schemas, secure views, and tables intended for consumption. The consumer can create a database from the share and query the shared data live, without copying or unloading it. Shared data is read-only for the consumer, and only explicitly shared objects are exposed, which supports both collaboration and protection requirements.
- B. Incorrect.
Incorrect. Exporting data to stage files creates copies of the data and moves away from Snowflake's live, zero-copy sharing model. Granting WRITE access also violates the requirement that the supplier must not modify the shared data. This option reflects a common misconception that file-based exchange is equivalent to Snowflake data sharing, but it provides weaker governance and more operational overhead.
- C. Incorrect.
Incorrect. A reader account can be used when the consumer does not already have a Snowflake account, but granting ACCOUNTADMIN is excessive and inappropriate for least-privilege access. Reader accounts are managed by the provider and should only receive the permissions needed to query the shared data. This option is wrong because of the permission model, even though the reader account concept may seem relevant.
- D. Incorrect.
Incorrect. Replicating the entire production database exposes far more data than required and is not the correct control mechanism for limiting visibility to only approved objects. Replication is intended for business continuity, disaster recovery, and regional availability scenarios, not as the primary method for secure external collaboration. It also does not align with the requirement to avoid exposing other internal objects.