COF-C03 Question 314
Single answerSecure data sharing featuresA data provider company uses Secure Data Sharing to give a partner near real-time access to selected sales data stored in Snowflake. The partner has asked for access without copying the data, and the provider wants to ensure the partner can only query the shared objects, not modify them. Which action should the provider take to meet these requirements?
- A
Create a reader account for the partner and grant OWNERSHIP on the provider tables to that account
- B
Create a share containing the required database objects, then have the partner create a database from the share in their Snowflake account
- C
Unload the sales data to an external stage and give the partner READ access to the cloud storage location
- D
Replicate the sales database to the partner's Snowflake account so the partner can query the replicated copy
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use Secure Data Sharing by creating a share and allowing the consumer to create a database from that share. This provides near real-time access to live data stored by the provider, with no ETL, file export, or physical copying required for the shared data. Consumers can query shared objects, but they cannot modify the provider's underlying data because shared objects are read-only. If the partner did not already have a Snowflake account, a reader account could be considered, but even then the provider would still use sharing concepts rather than transferring ownership. This aligns with Snowflake documentation on Secure Data Sharing, shares, consumer databases created from shares, and reader accounts as a special case for non-Snowflake consumers.
- A. Incorrect.
Incorrect. A reader account can be used when the consumer does not already have a Snowflake account, but granting OWNERSHIP is not how Secure Data Sharing works and would be inappropriate. Shared data is read-only to consumers, and object ownership remains with the provider. This option mixes a real feature (reader accounts) with an incorrect privilege model.
- B. Correct.
Correct. Secure Data Sharing is designed for exactly this use case: the provider creates a share with specific database objects, and a consumer with an existing Snowflake account creates a database from that share. The consumer accesses live data without data being copied or moved, and shared objects are read-only from the consumer side.
- C. Incorrect.
Incorrect. Unloading data to an external stage creates a separate copy of the data in cloud storage, which does not satisfy the requirement for access without copying. It also shifts security and governance away from Snowflake's secure sharing model.
- D. Incorrect.
Incorrect. Replication is intended for business continuity, disaster recovery, and regional/account synchronization scenarios, not as the standard mechanism for secure, read-only partner access. Replication creates a copy of database objects in another account or region, which conflicts with the requirement to avoid copying data.