COF-C03 Question 332
Single answerSecure Data SharingA data provider wants to share a subset of sales data with an external business partner using Snowflake Secure Data Sharing. The provider has created a database role that grants SELECT on specific tables and a secure view that filters rows by region. The provider then creates a share intended for the partner's Snowflake account. Which action must the provider take next to ensure the partner can query only the filtered data through the share?
- A
Grant the database role to the share so consumers inherit the role's privileges on the shared objects
- B
Add the secure view to the share and grant SELECT on the secure view to the share
- C
Clone the filtered tables into a separate database and share that cloned database with the partner
- D
Grant IMPORTED PRIVILEGES on the shared database to the partner's account
Show answer and explanation
Correct answer: B
Explanation
In Snowflake Secure Data Sharing, the provider must explicitly grant privileges on shareable objects to the share. To restrict consumers to filtered data, the recommended pattern is to share a secure view rather than underlying base tables. Secure views protect the view definition and support governed access to subsets of data. The provider typically grants USAGE on the database and schema containing the secure view and SELECT on the secure view itself to the share. On the consumer side, a user with appropriate privileges creates a database from the share, and then roles in the consumer account can be granted IMPORTED PRIVILEGES on that database. This aligns with Snowflake best practices for secure sharing and data governance.
- A. Incorrect.
Incorrect. A share cannot directly receive a database role in a way that causes consumers to inherit that role for querying shared data. In Secure Data Sharing, privileges are granted to the share on specific objects such as schemas, tables, and secure views. Database roles are useful for organizing privileges within a database, but they are not the mechanism that makes data queryable through a share to a consumer account in this scenario.
- B. Correct.
Correct. To expose only filtered data, the provider should add the secure view to the share and grant SELECT on that secure view to the share, along with the required USAGE on the database and schema. Secure views are specifically designed for sharing governed subsets of data because they can hide underlying logic and restrict rows or columns presented to consumers.
- C. Incorrect.
Incorrect. Cloning data into a separate database is not required for Secure Data Sharing and would add unnecessary storage management and operational overhead. Snowflake sharing is designed to avoid copying data. If the goal is to expose only a governed subset, a secure view is the standard approach rather than physically duplicating filtered data.
- D. Incorrect.
Incorrect. IMPORTED PRIVILEGES is granted by the consumer on a shared database to a role within the consumer account after the share is consumed. It is not an action the provider uses to make objects available in a share. This option confuses provider-side share configuration with consumer-side access control after creating a database from the share.