SnowPro Advanced: Security Engineer Question 136
Single answer2.2 Manage and audit Secure Data Sharing and collaborations.A Snowflake security engineer at a healthcare analytics company manages a secure share that provides de-identified claims data to several external partner accounts. During a quarterly access review, auditors ask for evidence of which consumer accounts currently have access to the share and whether any consumers have imported the shared privileges into their own roles. The engineer needs a solution that provides auditable, account-level visibility without relying on partner cooperation. Which approach best meets this requirement?
- A
Run SHOW GRANTS TO SHARE <share_name> to list the objects granted to the share and determine which consumer accounts imported the privileges
- B
Query account usage views related to shares, such as SNOWFLAKE.ACCOUNT_USAGE.SHARES and SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_SHARE, to identify the share, its consumers, and the objects exposed through it
- C
Query SHOW GRANTS ON DATABASE for the shared database in the provider account, because consumers that imported privileges will appear as grantees in the provider account
- D
Ask each consumer to run SHOW GRANTS TO ROLE in their account and send the output, because Snowflake does not expose provider-side metadata about secure share consumers
Show answer and explanation
Correct answer: B
Explanation
In Snowflake Secure Data Sharing, the provider can audit the existence of shares, the consumer accounts attached to those shares, and the objects granted to the shares by using provider-side metadata, especially Account Usage views such as SNOWFLAKE.ACCOUNT_USAGE.SHARES and SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_SHARE. This is the correct approach for evidence-based auditing of current share consumers and exposed objects. A key nuance is that imported privileges are consumed and assigned within the consumer account. The provider can confirm that a consumer has access to the share, but not inspect the consumer's internal role hierarchy as if it were local provider metadata. Best practice is to use provider-side Account Usage for share auditing and, where contractual or regulatory requirements demand deeper consumer-side attestation, combine that with partner governance processes. Relevant Snowflake documentation areas include Secure Data Sharing, SHOW GRANTS TO SHARE, and Account Usage views for share auditing.
- A. Incorrect.
Incorrect. SHOW GRANTS TO SHARE is useful for seeing which database objects have been granted to a share, but it does not tell the provider whether a consumer imported those privileges into roles inside the consumer account. Imported privileges are applied in the consumer account, not as provider-side grants to consumer roles.
- B. Correct.
Correct. For auditing secure data sharing from the provider side, Account Usage metadata is the best fit. SHARES provides visibility into shares and consumer accounts, while GRANTS_TO_SHARE helps identify the objects granted to a share. This gives auditable evidence of who the consumers are and what data is exposed. However, whether imported privileges were granted onward to specific roles inside a consumer account is managed in the consumer account and is not directly exposed as provider-side role grants.
- C. Incorrect.
Incorrect. SHOW GRANTS ON DATABASE in the provider account shows grants on the provider's database objects within that account. It does not show consumer-side roles or whether imported privileges were granted in external consumer accounts. This is a common misunderstanding because shared data appears as a database in the consumer account, but that does not create provider-visible role grants.
- D. Incorrect.
Incorrect. Consumer cooperation may help with deeper role-level review inside the consumer account, but it does not best meet the stated requirement because the engineer specifically needs an auditable provider-side approach that does not depend on partner action. Snowflake does expose provider-side metadata about shares and consumers through metadata views and commands.