ADA-C01 Question 482
Single answerBring users into the clean roomA data collaboration administrator has created a Snowflake clean room and needs to onboard analysts from a partner company so they can run approved analyses inside the clean room without granting them direct access to the provider's underlying tables. The partner analysts do not currently have user accounts in the clean room environment. Which action should the administrator take first to correctly bring these users into the clean room while preserving the clean room security model?
- A
Create Snowflake users for each partner analyst directly in the provider account and grant them SELECT on the provider's source tables used by the clean room
- B
Add the partner analysts as clean room users by onboarding them through the clean room's user access mechanism and assigning the appropriate clean room application roles
- C
Create shares for the source schemas and let the partner analysts query the shared objects from their own accounts before joining the clean room
- D
Grant the partner analysts the ACCOUNTADMIN role in the clean room environment so they can self-configure access to the approved datasets
Show answer and explanation
Correct answer: B
Explanation
The key requirement is to allow partner analysts to participate in the clean room without exposing the provider's underlying tables. In Snowflake, clean rooms are intended to provide controlled collaboration through governed interfaces, roles, templates, or application functionality rather than direct object access. Therefore, the correct first step is to onboard the partner users into the clean room using the clean room's supported user access model and grant only the necessary clean room-specific roles. Options that grant direct table access, use shares as a substitute for clean room onboarding, or assign powerful account-level administrative roles break the clean room governance model and violate least-privilege best practices. This aligns with Snowflake guidance on secure collaboration, role-based access control, and keeping raw data protected while enabling approved analytical workflows.
- A. Incorrect.
Incorrect. This bypasses the clean room security model by creating direct user access in the provider account and granting access to underlying source tables. Clean rooms are designed to allow governed collaboration without exposing raw data directly. Granting SELECT on source tables would violate the intended isolation and least-privilege model.
- B. Correct.
Correct. To bring users into a clean room, the administrator should onboard them through the clean room's supported user access process and assign only the clean room roles or application roles required to use approved functionality. This preserves the model in which users interact with governed clean room capabilities rather than the provider's raw base tables.
- C. Incorrect.
Incorrect. Secure sharing is a Snowflake feature for cross-account data access, but using a share for the source schemas would expose objects outside the clean room workflow and is not the right first step for bringing users into the clean room itself. The scenario specifically requires approved analyses within the clean room without direct access to underlying tables.
- D. Incorrect.
Incorrect. Granting ACCOUNTADMIN is excessive and contrary to Snowflake security best practices. Administrative roles should not be used to onboard business users for clean room analysis. Clean room users should receive scoped permissions aligned to the principle of least privilege.