COF-C03 Question 42
Single answerSharesA data provider uses a secure share to distribute a curated SALES database to several customers. The provider wants each customer to query the shared data with their own virtual warehouses, while ensuring customers cannot modify the provider's objects. A new customer asks the provider to include a table that uses a masking policy and several secure views in the share. Which action should the provider take to make the share available correctly?
- A
Grant SELECT on the required tables and secure views to the share, ensure the database and schema containing those objects are also granted to the share, and have the consumer create a database from the share.
- B
Clone the SALES database into the consumer account so the customer can use the provider's warehouse while retaining read-only access to the objects.
- C
Grant USAGE on the provider's virtual warehouse to the share so consumers can query shared tables and views without creating any compute resources.
- D
Convert all secure views to standard views before adding them to the share, because shares do not support secure objects or objects protected by policies.
Show answer and explanation
Correct answer: A
Explanation
Snowflake Secure Data Sharing allows a provider to share live, read-only database objects with consumers without copying the underlying data. To do this, the provider creates a share, grants privileges on the database, schema, and supported objects such as tables and secure views, and then adds the consumer account to the share. The consumer creates a database from the share and queries it using the consumer's own virtual warehouse. Consumers cannot modify shared objects. Secure views are often used in shares to expose only approved data. For SnowPro Core, remember the key operational model: provider shares objects; consumer creates a database from the share; consumer supplies compute; shared data remains read-only. These behaviors align with Snowflake documentation on Secure Data Sharing and sharing database objects.
- A. Correct.
Correct. In Snowflake Secure Data Sharing, the provider grants database objects to a share and then the consumer creates a database from that share. Consumers query shared data using their own virtual warehouses, not the provider's compute. Shared data is read-only for consumers. Secure views can be shared, and objects such as tables protected by supported governance features can be included as long as sharing requirements are met. The provider must grant the relevant privileges on the database, schema, and objects to the share.
- B. Incorrect.
Incorrect. Cloning is not how secure shares are delivered to another account. A clone creates a copy-like structure within Snowflake under the cloning model, but secure data sharing exposes live, read-only data without copying it into the consumer account's storage in the same way. Also, consumers do not use the provider's warehouse for shared data queries.
- C. Incorrect.
Incorrect. Virtual warehouses cannot be granted through a share. In secure data sharing, compute is not shared; the consumer pays for and uses its own warehouse to query the shared database. A common misconception is that sharing data also shares compute resources, but Snowflake separates storage sharing from compute usage.
- D. Incorrect.
Incorrect. Secure views are specifically supported for secure sharing and are commonly used to limit or transform exposed data. The statement that shares do not support secure objects is false. This distractor targets the misconception that only base tables can be shared or that governance features automatically block sharing.