ADA-C01 Question 447
Single answerUse Cross-cloud Data GovernanceA global company stores regulated customer data in a Snowflake account on AWS us-east-1. Several analytics teams work in separate Snowflake accounts on Azure and Google Cloud and need read-only access to a subset of this data. The security team requires the provider account to retain centralized control over which rows and columns are exposed, and they want to avoid duplicating data pipelines into each cloud. Which approach should the Snowflake administrator implement to meet these requirements?
- A
Create listings using Cross-Cloud Auto-Fulfillment from the provider account, and publish shared objects that include secure views with the required row and column controls.
- B
Replicate the source database manually into each consumer account's cloud region, then grant imported privileges directly on the replicated databases.
- C
Create a standard direct share from the AWS account to the Azure and Google Cloud consumer accounts, because direct shares support cross-cloud access without replication.
- D
Unload the data to cloud storage in each cloud, then create external tables in the consumer accounts so policy enforcement remains centralized in the provider account.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a listing with Cross-Cloud Auto-Fulfillment. This capability allows a provider to share data products with consumers in other regions and clouds while Snowflake automatically handles the necessary replication to fulfill the share. To maintain centralized governance, the provider should share controlled objects such as secure views rather than exposing raw base tables. Secure views are a common best practice for enforcing filtered access patterns, including restricting sensitive columns and rows before data is shared. In contrast, direct shares alone are not the mechanism for cross-cloud distribution, and manual replication or unloading to object storage introduces avoidable complexity and reduces governance consistency. This aligns with Snowflake guidance for cross-cloud collaboration through listings, auto-fulfillment, and provider-managed secure data access patterns.
- A. Correct.
Correct. Cross-Cloud Auto-Fulfillment is designed for sharing data products across regions and clouds through listings, while Snowflake manages the required replication behind the scenes. To preserve centralized governance, the provider should expose only the approved shared objects, commonly secure views, that implement the required row- and column-level restrictions. This approach avoids building separate ETL pipelines into each cloud and keeps control with the data provider.
- B. Incorrect.
Incorrect. Although database replication can move data across regions or clouds, manually replicating databases into each consumer environment does not match the requirement for centralized provider-controlled sharing to multiple external consumer accounts with minimal operational overhead. Also, imported privileges apply to shared databases, not as a mechanism for granting access on manually replicated databases in consumer accounts.
- C. Incorrect.
Incorrect. Standard direct sharing works only within supported same-cloud and region-sharing boundaries and does not by itself provide cross-cloud access. For cross-cloud consumers, Snowflake uses listings with Cross-Cloud Auto-Fulfillment rather than basic direct shares.
- D. Incorrect.
Incorrect. Unloading to cloud storage and exposing external tables would create separate data movement processes and weaken the governance model. Policy enforcement would no longer remain cleanly centralized in the provider's Snowflake shared objects, and this approach adds operational complexity that the scenario explicitly wants to avoid.