ADA-C01 Question 477
Select 3Configure and manage Snowflake Data Clean RoomsA media company wants to collaborate with an advertiser using Snowflake Data Clean Rooms. The media company must let the advertiser measure audience overlap and campaign reach, but it must prevent the advertiser from seeing any row-level customer identifiers or running arbitrary SQL outside approved analysis templates. As the Snowflake administrator helping implement the clean room, which TWO actions should you take to meet these requirements?
- A
Configure the clean room to use provider-approved templates so the consumer can run only the permitted analysis workflows.
- B
Share the underlying customer tables directly with the advertiser by using a standard secure share, then rely on contract language to prevent row-level inspection.
- C
Apply join and column policies in the clean room so only approved identifier columns can be used for matching and sensitive fields are not exposed in outputs.
- D
Grant the advertiser ACCOUNTADMIN in the provider account so they can validate the clean room logic without needing direct table access.
- E
Use the clean room collaboration controls instead of exposing base tables, ensuring analysis is executed within the governed clean room environment.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best answer is to use Snowflake Data Clean Rooms as intended: keep the collaboration inside the clean room, publish provider-approved templates, and apply governance over join keys and output columns. This combination enables privacy-preserving measurement use cases like overlap and reach while preventing direct access to row-level identifiers and blocking arbitrary SQL. Directly sharing base tables through secure shares does not provide the same analytical restrictions or privacy controls. Similarly, broad administrative privileges are not part of a secure clean room design. Snowflake best practices for clean rooms emphasize governed collaboration, template-based analysis, and limiting exposed data elements to only what is necessary for approved workflows.
- A. Correct.
Correct. Snowflake Data Clean Rooms are designed so the provider can publish approved analysis templates and restrict consumers to those workflows. This directly addresses the requirement to prevent arbitrary SQL execution and limit analysis to approved use cases such as overlap measurement and reach analysis.
- B. Incorrect.
Incorrect. A standard secure share exposes shared objects to the consumer account, which does not provide the same governed collaboration model as a clean room. Contract language is not a technical control and does not stop row-level inspection if the data is directly shared. The scenario specifically requires prevention of row-level identifier exposure and control over permissible analyses.
- C. Correct.
Correct. Clean rooms support governance controls around what can be joined and what can be returned. Restricting matching to approved identifier columns and preventing sensitive columns from appearing in outputs is a core clean room design practice for privacy-preserving collaboration.
- D. Incorrect.
Incorrect. Granting ACCOUNTADMIN in the provider account is both unnecessary and a major security violation. Clean rooms are intended to avoid broad administrative access while still enabling governed collaboration. Validation and use of clean room logic should occur through the clean room's controlled interfaces and roles, not through elevated account-wide privileges.
- E. Correct.
Correct. The governed clean room environment is the appropriate mechanism for this scenario because it allows collaboration without exposing underlying base tables. It enforces provider-defined controls over datasets, templates, joins, and outputs, which is exactly what the media company needs.