ADA-C01 Question 221
Single answerDetermine use cases and benefitsA global analytics team stores highly sensitive customer data in Snowflake and wants to let external auditors review only a small subset of records for a limited time. The auditors do not have Snowflake accounts in the company's account or organization, and the security team wants to minimize administrative effort while avoiding long-term data copies and user provisioning. Which Snowflake capability is the BEST fit for this requirement?
- A
Create a secure data share and require the auditors to consume it from their own Snowflake account
- B
Use a reader account so the auditors can access the shared data without needing their own Snowflake account
- C
Unload the subset of data to an external stage and give the auditors cloud storage credentials
- D
Replicate the database to a separate Snowflake account and create individual auditor users there
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use a reader account. In Snowflake, secure data sharing lets providers share live data without copying it, but standard secure sharing requires the consumer to have its own Snowflake account. Reader accounts extend this model to consumers who do not have a Snowflake account, making them a strong choice for third-party access such as auditors, vendors, or clients. This approach preserves Snowflake governance, avoids data duplication, and reduces onboarding effort compared with creating separate accounts or exporting files. By contrast, unloading data to external storage introduces extra copies and separate security controls, while replication is meant for availability and recovery scenarios rather than temporary external consumption. These distinctions align with Snowflake best practices around secure data sharing and reader accounts in the documentation.
- A. Incorrect.
This is not the best fit because secure data sharing requires the consumer to have an existing Snowflake account. In the scenario, the auditors do not have Snowflake accounts, so this would still require them to obtain and manage one. Secure shares are excellent for real-time, no-copy sharing between Snowflake accounts, but they do not eliminate the need for a consumer account.
- B. Correct.
This is correct. Reader accounts are designed for scenarios where a provider wants to share data with consumers who do not already have a Snowflake account. The provider manages the reader account and can grant access to only the required shared data, which aligns with the need to minimize administrative overhead, avoid unnecessary data copies, and support temporary external access.
- C. Incorrect.
This is incorrect because unloading data to cloud storage creates a separate copy of the data and shifts security and governance to the cloud storage layer. That approach increases operational complexity, can weaken centralized access control and auditing, and does not align with the requirement to avoid long-term data copies.
- D. Incorrect.
This is incorrect because database replication is intended for disaster recovery, business continuity, or cross-region/cross-account data availability use cases, not lightweight external auditor access. Creating a separate account and provisioning users would increase administrative effort and complexity compared with a reader account.