ADA-C01 Question 434
Single answer5.1 Implement and manage data sharing.A data provider uses Snowflake Enterprise Edition and needs to share a curated SALES database with an external business partner. The partner wants near real-time access without copying data, and the provider wants to ensure the partner can only query a specific set of secure views and not the underlying base tables. The provider also wants to avoid ongoing warehouse costs for the consumer when possible. Which action should the Snowflake administrator take?
- A
Create a reader account for the partner, grant imported privileges on the shared database, and expose only secure views through a share.
- B
Create a direct share that includes the base tables, then use masking policies in the consumer account to hide restricted columns.
- C
Create a share containing only the required secure views, grant usage on the database and schema plus select on the secure views to the share, and if the partner does not already have a Snowflake account, create a reader account.
- D
Replicate the SALES database to the partner's region and allow the partner to query cloned tables so they do not need compute.
Show answer and explanation
Correct answer: C
Explanation
The best answer is to use Secure Data Sharing with secure views. In Snowflake, a provider can create a share and grant USAGE on the database and schema plus SELECT on specific supported objects. To ensure consumers cannot see underlying table definitions or bypass the curated interface, secure views are the recommended pattern. This satisfies the requirement for near real-time access without copying data, since consumers query the provider's live storage metadata rather than replicated data. If the external partner does not have a Snowflake account, a reader account is appropriate; reader accounts are consumer accounts managed by the provider and use provider-managed compute. Key best practices from Snowflake documentation include: use secure views when exposing filtered or transformed data through shares, grant object privileges to the share rather than to consumer roles directly, and use reader accounts for non-Snowflake customers who need shared data access.
- A. Incorrect.
Incorrect. A reader account can be used when the consumer does not have a Snowflake account, and data is exposed through a share. However, the phrase 'grant imported privileges on the shared database' is not the correct action for setting up provider-side sharing. The provider must grant USAGE on the database and schema and SELECT on the specific objects to the share. Also, imported privileges are typically granted to roles in the consumer account for databases created from shares, not used by the provider to define the share itself.
- B. Incorrect.
Incorrect. Sharing base tables would violate the requirement that the partner must only query a controlled set of secure views and not the underlying tables. In addition, masking policies are defined and enforced by the provider on shared objects; relying on the consumer account to apply masking is not an appropriate control for restricting provider-managed shared data exposure.
- C. Correct.
Correct. Secure data sharing allows the provider to share live data without copying it. To restrict access to a curated subset, the provider should create a share that includes only the required secure views, along with the necessary USAGE privileges on the containing database and schema and SELECT on those views. If the partner already has a Snowflake account, the share can be added to that account directly. If not, a reader account is the appropriate option, and reader accounts use provider-managed compute, which can help the consumer avoid maintaining their own warehouse.
- D. Incorrect.
Incorrect. Database replication is used for business continuity, disaster recovery, and cross-region/account replication scenarios, not as the primary mechanism for secure live data sharing to an external consumer. Replication also creates a copy rather than providing direct access to live shared data, which conflicts with the requirement for no data copying. Cloned tables still require compute to query.