ARA-C01 Question 20
Single answerIsolate or segment accountsA global enterprise uses a single Snowflake account for multiple business units. The security team has raised concerns because administrators from one business unit can view object metadata for databases outside their area, and the finance team wants to ensure separate billing visibility and tighter administrative boundaries for a newly acquired subsidiary. The subsidiary still needs to consume selected shared data from the parent company with minimal ETL. Which architecture best meets these requirements?
- A
Create separate Snowflake accounts for the parent company and the subsidiary, then use Secure Data Sharing to provide only the required data to the subsidiary account.
- B
Keep a single Snowflake account and create separate virtual warehouses, database roles, and masking policies for the subsidiary.
- C
Keep a single Snowflake account and place the subsidiary's data in a separate database with restricted privileges; this prevents metadata visibility across business units and provides separate billing.
- D
Create separate schemas for the subsidiary and use reader accounts so the subsidiary can operate independently while maintaining separate administrative control and billing.
Show answer and explanation
Correct answer: A
Explanation
When requirements include stronger isolation, clearer administrative boundaries, and separate cost visibility, Snowflake best practice is to segment workloads into separate accounts rather than relying only on databases, schemas, or warehouses within a single account. Separate accounts provide a stronger boundary for administration and metadata exposure concerns and align well with organizational, regulatory, or chargeback needs. To enable controlled access to parent-company data without ETL, Secure Data Sharing is the preferred mechanism because it allows live data to be shared across Snowflake accounts without copying the underlying data. This pattern is commonly recommended for subsidiaries, business units, partners, and regulated environments that need both separation and selective collaboration. Relevant Snowflake documentation includes guidance on organizations and accounts, Secure Data Sharing, and architecture patterns for account isolation versus in-account segmentation.
- A. Correct.
Correct. Separate Snowflake accounts are the strongest native boundary for isolating administration, metadata visibility, and charge tracking between organizations or business units that require clear separation. Secure Data Sharing is specifically designed to let one account share live data with another without copying or ETL, which fits the requirement for the subsidiary to consume selected parent data with minimal movement.
- B. Incorrect.
Incorrect. Warehouses, roles, and masking policies can help segment workloads and control data access within one account, but they do not create the same level of administrative or metadata isolation as separate accounts. This option also does not satisfy the finance team's requirement for clear separate billing visibility at the account boundary.
- C. Incorrect.
Incorrect. A separate database inside the same account can limit access to objects, but it does not fully prevent account-level administrators or certain metadata exposure patterns within the same account boundary. It also does not provide separate account-level billing separation. This reflects a common misconception that database-level segregation is equivalent to account isolation.
- D. Incorrect.
Incorrect. Separate schemas are a weak isolation boundary for this scenario. Reader accounts are intended primarily for data consumers who do not have their own Snowflake account, not for creating an independently administered subsidiary environment with its own full operational boundary. This option also does not address the requirement for the subsidiary to be independently administered as a distinct organizational unit in the same way a full Snowflake account would.