COF-C03 Question 313
Single answerSecure data sharing featuresA data provider wants to share a curated SALES database with a business partner using Snowflake Secure Data Sharing. The partner should be able to query only selected tables and secure views, but the provider must ensure the partner cannot see any underlying base objects that are not intended for sharing. Which action should the provider take to meet this requirement?
- A
Create a share, grant USAGE on the database and schema to the share, and grant SELECT only on the specific tables and secure views that should be exposed.
- B
Create a reader account for the partner, then grant OWNERSHIP on the database to the reader account so it can query the shared data directly.
- C
Replicate the SALES database into the partner's account and use role-based access control in the partner account to hide the underlying base tables.
- D
Grant IMPORTED PRIVILEGES on the SALES database to the share so the partner can access only the approved objects.
Show answer and explanation
Correct answer: A
Explanation
Snowflake Secure Data Sharing allows a provider to share live data without copying it. The provider controls exposure by creating a share and granting only the required privileges to that share: typically USAGE on the database and schema and SELECT on specific tables or secure views. Secure views are important when the provider wants to hide underlying table structures, join logic, or filtered data logic from consumers. This is a common best practice when exposing curated datasets externally. Reader accounts may be used if the consumer does not have a Snowflake account, but they do not change the privilege model for shared objects. IMPORTED PRIVILEGES applies on the consumer side after a database is created from a share. These behaviors align with Snowflake documentation for Secure Data Sharing, secure views, shares, and imported privileges.
- A. Correct.
Correct. In Secure Data Sharing, the provider creates a share and grants privileges to that share. To expose only approved data, the provider grants USAGE on the shared database and schema, plus SELECT on only the specific tables and secure views to be shared. Secure views are specifically designed so consumers can query the view without gaining visibility into the underlying objects or business logic beyond what the secure view exposes.
- B. Incorrect.
Incorrect. Reader accounts are used when the consumer does not already have a Snowflake account, but the provider does not grant OWNERSHIP of a database to a reader account for secure sharing. OWNERSHIP would also be far broader than necessary and is not how secure data sharing is implemented.
- C. Incorrect.
Incorrect. Database replication is a different feature from Secure Data Sharing. Replication creates a copy for business continuity and cross-region/cloud use cases, not a controlled live share of selected objects. It also would not be the standard way to prevent visibility into underlying objects for a partner in this scenario.
- D. Incorrect.
Incorrect. IMPORTED PRIVILEGES is granted by the consumer on a shared database they have imported, typically to allow a role in the consumer account to use privileges from the share. It is not something the provider grants to a share in order to restrict access to specific objects.