ADA-C01 Question 133
Single answerDomain 2.0: Account Management and Data Governance (18%)A financial services company uses Snowflake data sharing to provide curated position data to several external partners. The provider account has strict governance requirements: partner consumers must be able to query only approved objects, and if a partner is removed, access must be revoked immediately without copying data into the consumer account. The Snowflake administrator wants a solution that scales as new partners are onboarded and minimizes ongoing privilege management. Which approach should the administrator implement?
- A
Create a reader account for each partner and grant imported privileges on a shared database directly to each reader account.
- B
Create a share containing only the approved schemas and objects, grant USAGE on the database and schemas plus SELECT on the required secure objects to the share, then add or remove consumer accounts from the share as needed.
- C
Create database roles on the provider database, grant object privileges to those database roles, and assign the database roles directly to external consumer accounts.
- D
Replicate the provider database into each partner account and use future grants in the consumer accounts so partners can query only approved objects.
Show answer and explanation
Correct answer: B
Explanation
For external data sharing with strong governance, Snowflake best practice is to use secure data sharing via shares. The provider creates a share and grants only the minimum required privileges: typically USAGE on the database, USAGE on exposed schemas, and SELECT on the approved tables or secure views. Consumers then create a database from that share. This approach is scalable because the same share can be associated with one or more consumer accounts, and revocation is handled by removing an account from the share, which stops access without moving or duplicating data. Reader accounts are a special-case option for consumers that do not have their own Snowflake accounts, but the core governance model is still based on shares. Database replication is not intended to replace secure sharing for this use case because it copies data. These behaviors align with Snowflake documentation on Secure Data Sharing, Reader Accounts, and access control for shared objects.
- A. Incorrect.
Incorrect. Reader accounts can be used when a consumer does not already have a Snowflake account, but the scenario emphasizes scalable partner onboarding and revocation through data sharing without copying data. Also, imported privileges are granted to roles within a consumer account for shared databases; they are not the primary mechanism a provider uses to manage access per reader account. The provider controls access by creating a share and adding accounts to it.
- B. Correct.
Correct. This is the standard and most scalable Snowflake secure data sharing pattern. A provider creates a share, grants USAGE on the database and relevant schemas, and grants SELECT on the specific objects to be exposed. Only explicitly granted objects are visible to consumers. Adding or removing consumer accounts from the share provides immediate access or revocation without physically copying the data into consumer accounts.
- C. Incorrect.
Incorrect. Database roles can simplify privilege management within and across databases, but they are not assigned directly to external consumer accounts through secure data sharing. Consumer access to shared data is managed through shares, and the consumer then creates a database from the share. This option reflects a common misconception that provider-side roles can be granted directly to other accounts in place of shares.
- D. Incorrect.
Incorrect. Replication creates copies of database metadata and data for business continuity or regional/account distribution use cases, but it is not the appropriate mechanism for external partner data sharing when the requirement is to avoid copying data. Future grants in consumer accounts also would not control what is exposed by the provider; governance of shared content must be enforced in the provider account through the share.