ARA-C01 Question 199
Single answerStreamlitA retail company has built an internal Streamlit in Snowflake application for category managers to analyze sales trends and submit price-adjustment recommendations. The app must let users query governed sales data already in Snowflake, display interactive charts, and write approved recommendations back to Snowflake tables. The security team requires that access to data remain controlled by Snowflake roles and that no external infrastructure be introduced for the application runtime. Which approach best meets these requirements?
- A
Deploy the Streamlit app inside Snowflake and grant users the appropriate Snowflake role privileges on the underlying objects and the Streamlit app.
- B
Host the Streamlit app on an external VM, connect to Snowflake with a shared service account, and enforce row-level access in Python code.
- C
Export governed sales data to object storage, have Streamlit read the files directly, and load recommendation results back into Snowflake in scheduled batches.
- D
Use a client-side JavaScript application for visualizations and allow users to write recommendation data to local files that are later uploaded to Snowflake.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Streamlit in Snowflake. This lets architects deliver interactive data applications directly within Snowflake, minimizing architectural complexity and preserving Snowflake-native governance. In practice, users need privileges both to access the Streamlit app object and to access the underlying schemas, tables, views, and any write targets used by the app. This aligns with Snowflake best practices of keeping data in place, enforcing RBAC centrally, and reducing external components when the use case can be satisfied natively. External hosting, data export patterns, or client-side file workflows introduce avoidable security, governance, and operational issues. See Snowflake documentation for Streamlit in Snowflake, Snowflake role-based access control, and secure data application design patterns.
- A. Correct.
Correct. Streamlit in Snowflake is designed to run the Streamlit application within Snowflake-managed infrastructure, which satisfies the requirement to avoid external runtime infrastructure. It also allows organizations to continue using Snowflake's native security model, including role-based access control for the app and underlying database objects. This approach supports reading Snowflake data and writing results back to Snowflake tables while keeping governance centralized.
- B. Incorrect.
Incorrect. Although an externally hosted Streamlit app can connect to Snowflake, it violates the requirement to avoid external infrastructure for the runtime. Using a shared service account also weakens per-user governance and auditing because Snowflake would primarily see the service principal rather than each end user's role context unless additional complex delegation patterns are implemented. Enforcing row-level access in Python code is less secure and less maintainable than using Snowflake's native governance features.
- C. Incorrect.
Incorrect. Exporting governed data to object storage creates unnecessary data movement and duplicates governed datasets outside Snowflake. This weakens centralized governance and does not satisfy the requirement to keep access controlled by Snowflake roles for the analytical workflow. It also introduces latency and operational overhead for reloading recommendation results.
- D. Incorrect.
Incorrect. A client-side application with local file exports does not meet the requirement for controlled writes back to Snowflake tables as part of the application workflow. It also bypasses the governed, centralized execution model expected by the security team and adds manual steps that reduce reliability and auditability.