ADA-C01 Question 364
Single answerManage event tablesA Snowflake administrator enabled telemetry collection for an application team that uses Snowpark Container Services and several stored procedures. After two weeks, the team reports that querying operational logs has become slower and storage consumption has grown rapidly. The current setup writes all telemetry data into a single account-level event table. The security team also requires that only a small operations role can read the telemetry data, while developers should not be able to query it directly. Which action should the administrator take to best address the performance, cost, and access-control requirements?
- A
Create a dedicated event table for the application team, set it as the active event table for the relevant scope, and restrict SELECT privileges on that event table to the operations role.
- B
Convert the existing event table to a temporary table so older telemetry data is automatically dropped when sessions end, reducing storage and improving query performance.
- C
Create a materialized view on the event table for the developers and grant them OWNERSHIP on the view so they can troubleshoot without querying the base telemetry data.
- D
Move telemetry data from the event table into an external stage and point Snowflake telemetry collection to the stage to reduce storage costs.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to separate telemetry storage by creating a dedicated event table and making it the active event table for the relevant scope, then applying least-privilege access so only the operations role can query it. In Snowflake, event tables are the supported destination for telemetry data such as logs, metrics, and traces. As telemetry volume increases, using separate event tables for different workloads or teams can improve operational manageability, simplify retention and query patterns, and reduce the impact of a single rapidly growing shared event table. Access should be controlled with standard Snowflake privileges on the event table, following least-privilege principles. Snowflake documentation for event tables and telemetry management describes creating event tables, setting an active event table, and securing access through roles and object privileges.
- A. Correct.
Correct. Event tables can be created and managed to isolate telemetry data for specific workloads or teams, which is a practical way to reduce contention and improve manageability when a single shared event table grows quickly. Administrators can designate an event table as the active event table at the appropriate scope so new telemetry is routed there. Limiting SELECT on the event table to a dedicated operations role satisfies the requirement that developers must not directly read telemetry data. This approach aligns with Snowflake best practices for managing observability data, access boundaries, and growth.
- B. Incorrect.
Incorrect. Event tables are a specific Snowflake table type used for telemetry data and are not converted into temporary tables for lifecycle management. Temporary tables are session-scoped and not an appropriate mechanism for account telemetry retention. This option reflects a common misconception that all storage-growth problems can be solved with table type conversion.
- C. Incorrect.
Incorrect. Although views can help present filtered data, granting developers OWNERSHIP on a view does not meet the stated requirement that developers should not directly query telemetry data, and it introduces unnecessary privilege risk. In addition, this option does not address the root issue of all telemetry being written into one shared event table, which is contributing to scale and performance concerns.
- D. Incorrect.
Incorrect. Snowflake telemetry is written to event tables, not directly to an external stage. External stages are used for accessing files in cloud storage, not as a target for native telemetry collection. This distractor targets the misconception that stages can replace internal observability storage for event table workloads.