ARA-C01 exam dumps: questions 201 to 300 of 434

Correct answer: B

• A. Incorrect.

  Incorrect. This violates the requirement to avoid directly exposing raw consumer tables to the provider and moves data out of the consumer-controlled execution boundary. A core value of the Snowflake Native App Framework is that application logic can run within the consumer's Snowflake account, reducing the need to centralize customer data in the provider account.

• B. Correct.

  Correct. This is the intended architecture for this scenario. In the Snowflake Native App Framework, the app is installed in the consumer account and can process data there. References allow the provider to define required object bindings so the consumer explicitly grants access to specific objects such as tables, views, or warehouses, rather than exposing broad access. Application roles are used to control what consumers can do within the app.

• C. Incorrect.

  Incorrect. A standard data share is the wrong direction for this requirement because it exposes data from the consumer to the provider-side solution model. It also does not align with the requirement that the app process data inside the consumer account. While external hosting can be used for some solutions, it is not the best fit when the goal is to keep both execution and governed data access inside the consumer's Snowflake environment.

• D. Incorrect.

  Incorrect. Native Apps do not automatically assume ACCOUNTADMIN or bypass least-privilege controls. The framework is designed around explicit consumer approval, governed privileges, and object access patterns such as references. Assuming elevated account-wide administrative privileges would be a serious security anti-pattern and is not how Native Apps are installed or authorized.

Correct answer: A

• A. Correct.

  Correct. In the Snowflake Native App Framework, providers can include shared content in the application package so consumers' installed app instances can access provider-owned data without copying it into each consumer account. This is the appropriate pattern for centrally maintained reference data that must be updated by the provider and made visible across installations. At the same time, the app can create application objects in the consumer account to store derived or consumer-specific results. This design minimizes duplication, supports centralized updates, and prevents consumers from directly changing the provider-owned source data.

• B. Incorrect.

  Incorrect. Copying the reference tables into every consumer account increases storage duplication and creates operational complexity for weekly refreshes. It also undermines the requirement that provider updates become visible centrally without redistributing data into every installation. While setup scripts can create objects during installation, they are not the best mechanism for maintaining shared provider-owned reference data across all consumers.

• C. Incorrect.

  Incorrect. Native Apps can expose provider-owned shared content to consumers through the application package, so loading from an external stage into temporary tables is unnecessary and inefficient for this scenario. This option also adds repeated ingestion overhead and weakens the central-update requirement because the data would need to be reloaded per session or on some schedule rather than consumed directly as provider-managed shared content.

• D. Incorrect.

  Incorrect. Creating a separate copy of the provider reference data in each consumer account still causes unnecessary duplication and weekly refresh challenges. Application roles control access to objects within the app, but they do not make per-consumer copied data a better design than shared content when the goal is centralized provider maintenance. The misconception is that access control alone solves the lifecycle and update-distribution problem.

Correct answer: B

• A. Incorrect.

  Incorrect. Although Snowflake allows objects in one database to reference objects in another database with fully qualified names, placing shared logical objects inside a business unit's database creates an architectural dependency on that database. If that business unit is later moved to a different database or restructured, the shared objects remain tied to the original database hierarchy and may require broader refactoring. This design also weakens separation of ownership because centrally managed shared assets should not reside inside a single business unit's database.

• B. Correct.

  Correct. In Snowflake, schemas exist inside databases, and tables, views, and UDFs exist inside schemas. Placing each business unit in its own schema and storing centrally managed shared secure views and UDFs in a dedicated shared schema within the same database respects the object hierarchy while reducing cross-database dependencies. If a business unit later needs to move to a different database, the shared assets remain logically centralized and not embedded in that business unit's schema. This is often a practical design when common semantic or governance objects are broadly consumed across closely related domains.

• C. Incorrect.

  Incorrect. Schemas cannot exist directly under the account in Snowflake. The hierarchy requires schemas to be contained within a database. This option reflects a common misconception about Snowflake object hierarchy. Because the proposed structure is invalid, it cannot be the right architectural choice.

• D. Incorrect.

  Incorrect. Warehouses are compute resources, not containers for database objects. Views and UDFs are database objects that must exist within a schema, which itself must exist within a database. This option confuses storage/logical object hierarchy with compute isolation.

Correct answer: A

• A. Correct.

  Correct. In Snowflake, databases contain schemas, and schemas contain database objects such as tables, views, and stages. Using separate databases for PROD and DEV aligns with the object hierarchy and creates a cleaner administrative boundary. This helps with privilege delegation, replication/failover planning, data sharing design, and lifecycle operations. It also reduces the blast radius of database-level actions because dropping a database removes its schemas and the objects within them, so isolating environments into separate databases prevents one environment's database-level operation from affecting another.

• B. Incorrect.

  Incorrect. Although this pattern is sometimes used, placing PROD and DEV as schemas in the same database weakens the environment boundary. Because schemas are children of a database, database-level actions such as DROP DATABASE affect all schemas within that database. This increases operational risk when environments must be strongly separated. It also complicates certain architecture decisions where the database is the intended boundary for administration, replication, and organization.

• C. Incorrect.

  Incorrect. Warehouses are compute resources and are not part of the database object containment hierarchy for tables, views, and schemas. Separating warehouses can isolate compute usage and performance, but it does not change where objects exist or how parent-child object deletion behaves. A DROP DATABASE or DROP SCHEMA issue is unrelated to warehouse design.

• D. Incorrect.

  Incorrect. Roles control access, not containment. Keeping all objects in PUBLIC does not provide strong structural separation between environments. PUBLIC is simply a schema, and using it for both PROD and DEV increases the chance of naming conflicts, deployment mistakes, and accidental impact from schema-level operations. Role-based access control is important, but it does not replace sound use of the Snowflake object hierarchy.

Correct answer: B

• A. Incorrect.

  This is incorrect because directly granting object privileges to users is not a scalable or recommended Snowflake access-control design. Snowflake best practice is to grant privileges to roles, then grant roles to users. Direct user grants make administration harder, increase audit complexity over time, and reduce the benefits of role-based access control and inheritance.

• B. Correct.

  This is correct because it aligns with Snowflake RBAC best practices. Privileges should be granted to roles rather than directly to users. Functional roles can encapsulate job duties, and role hierarchy allows business-unit roles to inherit least-privilege access without needing account-wide administrative rights. This approach supports centralized governance while still enabling delegated role assignment within a controlled structure.

• C. Incorrect.

  This is incorrect because granting OWNERSHIP broadly to business-unit roles violates least-privilege principles and introduces unnecessary risk. OWNERSHIP is a powerful privilege that includes the ability to transfer ownership and effectively control objects. Business units that only need to manage analyst access typically should not own all databases and warehouses. More granular privileges and role hierarchy are preferred.

• D. Incorrect.

  This is incorrect because relying only on system-defined roles such as SYSADMIN and SECURITYADMIN is too coarse-grained for most enterprise designs. These roles are intended for specific administrative responsibilities, not day-to-day end-user access. Using them broadly would create excessive privilege exposure and weaken separation of duties.