ADA-C01 Question 484
Single answerManage collaboratorsA Snowflake administrator is enabling Secure Data Sharing for an external analytics partner. The partner should be able to query only a curated set of tables and views, but they must not receive any privileges on the provider account itself. The administrator also wants to simplify ongoing collaboration management so future object additions can be exposed with minimal operational effort. Which action should the administrator take?
- A
Create a reader account for the partner, grant imported privileges on the SNOWFLAKE database, and share the entire source database so the partner can manage access internally.
- B
Create a share, grant USAGE on the database and schema plus SELECT on the specific tables and secure views, and use a database role to manage the shared objects before adding that database role to the share.
- C
Create a network policy for the partner's IP addresses, grant the partner role USAGE on the warehouse, and then grant that role access to the required schemas and tables.
- D
Create a data exchange listing, publish the data set publicly, and rely on listing access controls instead of object privileges to limit the partner to the intended tables and views.
Show answer and explanation
Correct answer: B
Explanation
For Snowflake collaboration, a secure share is the core mechanism to provide data access to another account without granting the consumer direct privileges in the provider account. To share objects, the provider grants USAGE on the containing database and schema and SELECT on the specific tables or secure views to the share. For easier long-term management, Snowflake supports granting database roles to shares. This allows the administrator to manage shared object privileges through a database role and then expose that role through the share, which is a best practice for scalable collaboration management. Reader accounts are appropriate only when the consumer does not already have a Snowflake account, and even then the provider should still grant only the required object privileges. Network policies and warehouse privileges are not the right solution for data sharing to an external collaborator. These patterns align with Snowflake documentation on Secure Data Sharing, database roles, and collaboration best practices.
- A. Incorrect.
Incorrect. A reader account can be used when a consumer does not have its own Snowflake account, but the rest of this option is flawed. Imported privileges on the SNOWFLAKE database are unrelated to sharing provider data to a collaborator. Also, sharing an entire source database does not align with least privilege when only a curated subset should be exposed. The provider should explicitly grant privileges on only the required database objects.
- B. Correct.
Correct. This is the recommended pattern for secure collaboration through shares. A share can expose only specific objects by granting USAGE on the database and schema and SELECT on the required tables and secure views. Using database roles to group shared privileges simplifies ongoing management: the administrator can grant object privileges to the database role and then grant that database role to the share, reducing repetitive privilege administration as collaboration needs evolve.
- C. Incorrect.
Incorrect. Network policies restrict connection sources but do not provide data sharing access to external collaborators. Also, consumers of a share do not use the provider's warehouse; shared data is queried using compute in the consumer account, except in reader account scenarios where special setup applies. Granting a partner role in the provider account conflicts with the requirement that the partner must not receive privileges on the provider account itself.
- D. Incorrect.
Incorrect. Listings and data exchanges are collaboration/discovery mechanisms, but they do not replace the underlying need to define object access correctly. Publishing publicly would violate the scenario's requirement for a specific external partner and least-privilege access. The administrator should use a private sharing model with a share and precise object grants.