ADA-C01 Question 483
Single answerManage collaboratorsA data provider shares a secure view from its account with three external companies using reader accounts. The provider wants each company to query only its own rows, and it also wants to onboard a fourth company quickly without creating a separate shared object for every consumer. Which approach should the Snowflake administrator implement?
- A
Create a separate database role for each consumer and grant each role access to a different copy of the shared table
- B
Use a secure view with a row access policy that filters rows based on the current account or current organization, then share that view with all reader accounts
- C
Create one standard view and rely on each consumer to add a WHERE clause filtering to its own company ID
- D
Create separate virtual warehouses for each reader account so query execution is isolated, and then share the same underlying table directly
Show answer and explanation
Correct answer: B
Explanation
For managing collaborators through reader accounts or other shared-consumer patterns, Snowflake best practice is to centralize security at the provider side. When multiple consumers need access to the same dataset but should only see their own subset, a secure view with a row access policy is the most maintainable design. This allows one shared object to serve many collaborators while enforcing row-level filtering based on session context such as CURRENT_ACCOUNT. Secure views are preferred for data sharing because they protect underlying implementation details. By contrast, asking consumers to filter data themselves is not secure, and warehouses do not provide row-level access control. This pattern aligns with Snowflake guidance on secure data sharing, secure views, and row access policies for fine-grained governance.
- A. Incorrect.
Incorrect. Creating separate copies of shared data or separate shared objects per consumer can work, but it does not meet the requirement to onboard new collaborators quickly without creating a separate shared object for every consumer. It also increases administrative overhead and object sprawl. Database roles help manage privileges, but they do not by themselves enforce per-consumer row filtering across a single shared object.
- B. Correct.
Correct. A secure view combined with a row access policy is the scalable approach for managing collaborators that need different row-level visibility from the same shared object. The row access policy can evaluate context such as the current account and return only rows permitted for that consumer. Sharing one secure view to multiple reader accounts reduces duplication and simplifies onboarding of new collaborators while preserving provider-side control.
- C. Incorrect.
Incorrect. A standard view is not appropriate for secure data sharing in this scenario because consumers should not be trusted to enforce filtering themselves. Requiring collaborators to add their own WHERE clause is not a security boundary and could expose unauthorized rows. In addition, secure views are designed to protect underlying logic and are the recommended pattern for controlled sharing.
- D. Incorrect.
Incorrect. Warehouses control compute, not data entitlements. Giving each reader account its own warehouse may help with workload isolation or billing separation, but it does nothing to restrict which rows a collaborator can see when querying a shared object. Sharing the underlying table directly also exposes all rows unless additional controls are implemented.