SnowPro Advanced: Security Engineer Question 143
Single answerConfigure and manage Snowflake Data Clean Rooms:A retail company wants to collaborate with an advertising partner using Snowflake Data Clean Rooms to measure campaign overlap without exposing either party's raw customer data. The security engineer must configure the clean room so that analysts from the partner can run only approved overlap and aggregation analyses, while preventing direct access to underlying tables or arbitrary SQL. Which configuration approach best meets these requirements?
- A
Create a clean room and expose the provider's source tables directly to the partner through Secure Data Sharing, then rely on the partner's account-level RBAC policies to prevent misuse.
- B
Configure the clean room with approved templates or policies for permitted analyses, link only the required datasets into the clean room, and allow collaborators to run those authorized queries through the clean room interface instead of granting direct table access.
- C
Replicate the provider's customer tables into the partner's account and protect them with masking policies, because masking policies are sufficient to prevent the partner from reconstructing row-level data during analysis.
- D
Use a shared database role that grants SELECT on the provider's underlying tables, and require the partner to submit queries for manual review before execution.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use Snowflake Data Clean Rooms as a governed collaboration environment where the provider controls which datasets are available and which analyses collaborators can execute. For this scenario, the security goal is not just protecting columns with masking or restricting roles after sharing; it is preventing the partner from receiving direct access to raw tables and from issuing arbitrary SQL. Data Clean Rooms address this by enabling approved analytical workflows, such as overlap and aggregate measurement, while keeping the source data protected behind the clean room controls. This aligns with Snowflake best practices for privacy-enhancing data collaboration: expose the minimum necessary datasets, define approved analysis mechanisms, and avoid direct object access when the collaboration must be tightly governed.
- A. Incorrect.
Incorrect. Secure Data Sharing is not the right control model for this requirement because it exposes shared objects directly to the consumer account, even if no data is copied. The scenario requires limiting the partner to approved clean-room analyses and preventing arbitrary SQL against underlying tables. Relying on the partner's RBAC controls does not satisfy the provider's need to centrally enforce analytical restrictions.
- B. Correct.
Correct. Snowflake Data Clean Rooms are designed to support controlled collaboration without exposing raw data. The appropriate pattern is to configure the clean room with only the necessary datasets and restrict collaborator activity to approved analysis templates, policies, or configured query workflows. This allows overlap and aggregation use cases while preventing direct access to the base tables and blocking arbitrary querying outside the clean room's governed controls.
- C. Incorrect.
Incorrect. Copying or replicating the tables into the partner's environment increases exposure and does not align with the clean room objective of governed collaboration. Masking policies help obscure sensitive fields but do not by themselves enforce the broader requirement to limit analysts to only approved analytical patterns. A partner with table-level access could still attempt joins, filters, or repeated queries that go beyond the intended overlap analysis.
- D. Incorrect.
Incorrect. Granting SELECT on underlying tables contradicts the requirement to prevent direct data access. Manual review of submitted SQL is also not the intended operational model for Snowflake Data Clean Rooms and would be difficult to scale or enforce consistently. Clean rooms are meant to provide built-in governance over what analyses collaborators can run without exposing the source datasets directly.