ADA-C01 Question 473
Single answerDetermine if there is a need to store data (CREATE DATABASE)A data platform administrator is onboarding a new third-party analytics tool to Snowflake. The vendor requires read-only SQL access to several existing tables in the PROD database for 30 days during a proof of concept. The tool will not load files, create tables, or persist any intermediate results in Snowflake. Security policy requires least privilege and minimizing unnecessary objects. What is the best recommendation regarding whether to create a new database for this use case?
- A
Do not create a new database; grant the tool access only to the required existing objects, because no new data needs to be stored in Snowflake.
- B
Create a new permanent database for the vendor, because every external tool should have its own database regardless of whether it stores data.
- C
Create a transient database for the vendor, because transient databases are required for all temporary proof-of-concept workloads.
- D
Create a database from a share, because shared databases are the standard way to give third-party tools read-only access to internal Snowflake tables.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to avoid creating a database when there is no requirement to store new data or database objects. In Snowflake, CREATE DATABASE is appropriate when you need a logical container for schemas and stored data objects. If the use case is only read-only access to existing data, administrators should typically use role-based access control to grant the minimum required privileges on the existing database objects. This aligns with Snowflake best practices around least privilege and reducing unnecessary object sprawl. Relevant Snowflake documentation includes CREATE DATABASE, database and schema object hierarchy, and access control/privilege grants. Transient databases are useful when storing data with reduced data protection cost requirements, but they are still for persisted objects. Databases from shares apply to Secure Data Sharing scenarios, not ordinary in-account access for a tool.
- A. Correct.
Correct. A database is needed when there is a requirement to store data objects such as schemas and tables in Snowflake. In this scenario, the vendor only needs read-only access to existing tables and will not create or persist data. Creating another database would add unnecessary administrative overhead and conflict with least-privilege and object-minimization practices. Access can be provided through roles with USAGE and SELECT privileges on the existing database, schema, and tables or views as appropriate.
- B. Incorrect.
Incorrect. Snowflake does not require a separate database per external tool. Creating one simply to isolate a consumer that is only querying existing data is unnecessary if no data or database objects need to be stored there. This option reflects a common misconception that logical access boundaries must always map to separate databases rather than roles and grants.
- C. Incorrect.
Incorrect. A transient database reduces fail-safe costs for data stored in it, but it is still a database intended to hold persistent objects. It is not required for proof-of-concept activity, and it does not address the core question here because the scenario explicitly states that no data or intermediate results will be stored in Snowflake.
- D. Incorrect.
Incorrect. A database created from a share is used by a data consumer to access data that another Snowflake account has shared. That is different from granting an external application access within your own account to existing internal objects. The scenario is about deciding whether to create a database for storage needs, not about cross-account Secure Data Sharing.