COF-C03 Question 331
Single answerSecure Data SharingA data provider needs to share a curated SALES database with a partner company using Snowflake Secure Data Sharing. The partner should be able to query only selected schemas and tables, and the provider wants to avoid copying data or creating ETL pipelines. The provider has already created the required database objects. Which sequence of actions should the provider take to make the data available to the partner?
- A
Create a reader account for the partner, grant imported privileges on the SALES database to the reader account, and then copy the required tables into the reader account.
- B
Create a share, grant USAGE on the database and selected schemas plus SELECT on the required tables to the share, then add the partner's Snowflake account to the share.
- C
Create a data exchange listing, publish the SALES database to the listing, and require the partner to clone the database into their account.
- D
Create a secure view over the required tables, export the view results to an internal stage, and grant the partner access to the staged files.
Show answer and explanation
Correct answer: B
Explanation
The correct implementation for Snowflake Secure Data Sharing is to create a share, grant object privileges to that share, and add the consumer account. For database objects, the provider typically grants USAGE on the database, USAGE on the schemas, and SELECT on the tables or secure views being shared. The consumer then creates a database from the share and queries the shared objects directly. This model avoids copying data and supports near real-time access because the shared data remains in the provider account's storage. Reader accounts are only needed when the consumer does not have its own Snowflake account. Data exchanges and listings build on sharing but do not replace the need to configure a share correctly. These behaviors align with Snowflake documentation on Secure Data Sharing, shares, consumer accounts, and reader accounts.
- A. Incorrect.
Incorrect. A reader account can be used when the consumer does not already have a Snowflake account, but data is not copied into the reader account for secure sharing. Also, imported privileges are granted to roles on databases created from shares, not used as the mechanism to expose provider data into a share. This option mixes several concepts incorrectly.
- B. Correct.
Correct. In Secure Data Sharing, the provider creates a share, grants the necessary privileges to that share, and then adds one or more consumer accounts. To share specific objects, the provider grants USAGE on the database, USAGE on the relevant schemas, and SELECT on the tables or secure views to the share. This allows the partner to query the shared data directly without data movement or duplication.
- C. Incorrect.
Incorrect. Listings and data exchanges are discovery and distribution mechanisms, but the core sharing configuration still relies on shares. Also, consumers query shared databases directly; cloning is not required to access shared data. This option confuses marketplace/data exchange concepts with the underlying secure sharing implementation.
- D. Incorrect.
Incorrect. Exporting data to a stage creates files and introduces data movement, which the scenario explicitly wants to avoid. Secure Data Sharing is designed to provide live access to shared objects without ETL or file-based distribution. Stages are used for data loading and unloading, not as the standard mechanism for secure shares.