ARA-C01 Question 170
Single answerProduction/development/sandboxA company uses a single Snowflake account and separates environments into PROD, DEV, and SANDBOX databases. Analysts in SANDBOX frequently need realistic production data for testing, but the security team requires that: (1) production workloads must not be impacted, (2) storage costs should be minimized, and (3) analysts must be prevented from modifying production objects. Which approach should the architect recommend?
- A
Grant analysts read access directly to the PROD database and instruct them to create temporary tables in their own schemas for testing
- B
Create a zero-copy clone of the PROD database into a SANDBOX database, grant analysts access only to the clone, and use role-based privileges to prevent access to PROD
- C
Replicate the PROD database into the same account as a SANDBOX copy so analysts can work independently without affecting production
- D
Unload production data to cloud storage each day and reload it into SANDBOX tables to ensure analysts work from a separate copy
Show answer and explanation
Correct answer: B
Explanation
The best answer is to create a zero-copy clone of the PROD database for SANDBOX use. Snowflake zero-copy cloning is a standard best practice for production/development/sandbox separation when teams need realistic data quickly and cost-effectively. Because the clone metadata points to the same underlying storage until changes occur, the initial storage overhead is minimal. Access control should then be enforced through roles so users can work only in SANDBOX and have no direct privileges on PROD. This satisfies all three requirements: production objects are protected, storage is minimized, and analysts can safely test against realistic data. Snowflake documentation on cloning and access control supports this design, while replication and unload/reload approaches are intended for different use cases or add unnecessary cost and complexity.
- A. Incorrect.
Incorrect. Although direct read access avoids copying data, it violates the requirement to isolate analysts from production objects and increases the risk of accidental exposure or misuse. Temporary tables created by analysts do not change the fact that they are querying PROD directly, which can still consume compute against production-facing workloads and does not provide proper environment separation.
- B. Correct.
Correct. Zero-copy cloning is designed for this exact use case: creating a fast, space-efficient copy of production data for development or sandbox work. The clone initially shares underlying micro-partitions with the source, minimizing storage costs until changes diverge. Analysts can be granted privileges only on the SANDBOX clone, preventing modification of PROD objects while allowing realistic testing on current data. This approach also supports environment isolation within the same account.
- C. Incorrect.
Incorrect. Database replication in Snowflake is intended primarily for cross-region or cross-account business continuity, disaster recovery, and data distribution scenarios, not for creating low-cost same-account development copies. In the same account, zero-copy cloning is the simpler and more appropriate mechanism.
- D. Incorrect.
Incorrect. Exporting and reloading data creates a full physical copy, increasing storage and operational cost. It also adds pipeline complexity and latency, making the SANDBOX data less timely. While this does isolate analysts from production, it does not meet the requirement to minimize storage costs and is less efficient than cloning.