ARA-C01 Question 160
Single answer2.3 Create architecture solutions that support development lifecycles as well as workload requirements.A global SaaS company uses Snowflake to support three parallel needs: (1) production ELT pipelines that load customer data every 5 minutes, (2) ad hoc analytics by business users during business hours, and (3) a development lifecycle in which engineers must regularly create test environments that closely mirror production data without exposing sensitive columns. The current design uses one large warehouse for all workloads and developers refresh test data by rebuilding tables from production copies, which is slow and expensive. The architect must redesign the solution to improve workload isolation, reduce environment provisioning time, and protect sensitive data in non-production environments. Which approach BEST meets these requirements?
- A
Use separate virtual warehouses for ELT, ad hoc analytics, and development/testing workloads; create dev/test databases from zero-copy clones of production; and apply dynamic data masking or tag-based masking policies to sensitive columns in non-production access paths.
- B
Keep a single multi-cluster warehouse for all workloads to simplify administration; create developer schemas with CTAS copies of production tables; and restrict sensitive data by granting only SELECT on approved views.
- C
Create a reader account for developers so they can test against production data without copying it; use a single warehouse with higher max cluster count; and rely on object ownership to prevent exposure of sensitive columns.
- D
Use database replication to create dev/test environments from production in the same region every day; run all workloads on the replicated database using the same warehouse size; and secure sensitive fields by removing them from cloned tables after refresh.
Show answer and explanation
Correct answer: A
Explanation
The best solution combines Snowflake capabilities that address both workload requirements and development lifecycle requirements. For workload support, Snowflake best practice is to separate unlike workloads onto different virtual warehouses so ETL/ELT, interactive analytics, and engineering activities can scale independently, avoid resource contention, and be governed with distinct auto-suspend, auto-resume, size, and cost controls. For SDLC support, zero-copy cloning is the preferred mechanism for rapidly creating lower environments from production-like data because clones are metadata-based, near-instant to create, and storage-efficient until changes diverge. For protecting sensitive data in non-production, Snowflake supports dynamic data masking and tag-based masking policies to centrally govern exposure of sensitive columns without requiring manual stripping of data after each refresh. Relevant Snowflake documentation and best practices include guidance on virtual warehouses for workload isolation, zero-copy cloning for dev/test and environment promotion, and masking policies/tag-based masking for fine-grained data protection.
- A. Correct.
Correct. This approach aligns with Snowflake architectural best practices for both workload management and development lifecycles. Separate virtual warehouses provide compute isolation so frequent ELT jobs, business-user analytics, and development/testing do not contend for the same compute resources. Zero-copy cloning is specifically designed to create fast, space-efficient copies of databases, schemas, or tables for dev/test and supports realistic environment promotion and testing workflows. To prevent sensitive data exposure in non-production environments, masking policies, including tag-based masking where appropriate, provide centralized, governed protection at query time without requiring repeated physical data rewrites.
- B. Incorrect.
Incorrect. A single multi-cluster warehouse can help concurrency for one workload pattern, but it does not provide strong workload isolation across ETL, interactive BI, and dev/test. Different workloads may still compete for queueing priorities, sizing strategy, and cost governance. Rebuilding tables with CTAS copies is slower and more storage-intensive than zero-copy cloning, making it a poor fit for rapid environment provisioning. Restricting users to approved views can help limit access, but it is not the best answer here because the requirement is to create test environments that mirror production closely while protecting sensitive columns in a governed, scalable way; masking policies are the stronger control.
- C. Incorrect.
Incorrect. Reader accounts are intended for data sharing with consumers who do not have their own Snowflake account, not for internal software development lifecycle management. They do not solve the need for quickly provisioned dev/test environments. Using a single warehouse, even with more clusters, still fails to provide clear workload isolation and separate cost/performance controls. Object ownership is not a column-level data protection mechanism and does not prevent authorized queries from seeing sensitive column values unless additional controls such as masking policies are in place.
- D. Incorrect.
Incorrect. Database replication is primarily intended for business continuity, disaster recovery, and cross-region/cloud data distribution scenarios, not as the preferred mechanism for routine same-region dev/test refreshes. It is heavier and less efficient than zero-copy cloning for lifecycle support. Running all workloads with the same warehouse design again ignores the need for workload isolation. Removing sensitive fields after each refresh introduces operational overhead, delays, and risk; policy-based masking is more maintainable and consistent.