SnowPro Advanced: Security Engineer Question 328
Select 2Assess the security of data sharing agreements and configurations with external partnersA healthcare analytics company shares a curated Snowflake dataset with an external research partner. The provider's security engineer must review the sharing configuration and agreement before production go-live. The partner should only see approved tables and secure views, should not be able to access provider compute resources, and the provider must be able to revoke access quickly if the agreement ends. Which TWO actions best meet these requirements while reducing the risk of unintended exposure?
- A
Create a reader account for the partner and grant imported privileges on the shared database so the partner can query using compute managed by the provider.
- B
Create a share that contains only the approved objects, grant USAGE on the database and schema plus SELECT on the specific tables and secure views, and map the share to a dedicated consumer account.
- C
Use secure views in the shared database to hide sensitive columns and business logic, rather than sharing the underlying base tables when row or column restrictions are required.
- D
Grant the partner's role OWNERSHIP on the shared schema so the partner can create masking policies directly in the provider account for stronger separation of duties.
- E
Document revocation steps that remove the consumer account from the share or drop the share entirely, because access to a share can be revoked centrally by the provider.
Show answer and explanation
Correct answers: B, E
Explanation
The best answers are 2 and 5. To assess the security of a data sharing arrangement with an external partner, a Snowflake security engineer should verify that the share exposes only explicitly approved objects, that access is scoped to the intended consumer account, and that revocation is centrally controlled by the provider. In Snowflake Secure Data Sharing, providers create a SHARE object and grant privileges on only the database, schema, and specific objects that should be exposed. Consumers then create a database from that share in their own account and use their own virtual warehouses for compute. This aligns with the requirement that the partner must not use provider compute resources.
Option 5 is also essential because secure sharing should include a defined offboarding process. Providers can centrally revoke access by altering the share to remove consumer accounts or by dropping the share. This is an important security and contractual control for external partnerships.
Why not the other options? Reader accounts are useful when the recipient does not have a Snowflake account, but they use provider-managed compute, which conflicts with the scenario. Secure views are highly relevant for protecting sensitive logic and limiting exposed columns or rows, and they are a best practice when such restrictions are needed, but the question asks for the two actions that best satisfy the complete scenario. Granting ownership or allowing the consumer to administer objects in the provider account is not supported and would violate least privilege.
Relevant Snowflake guidance includes documentation for Secure Data Sharing, reader accounts, secure views, and provider-controlled revocation/access management for shares.
- A. Incorrect.
Incorrect. A reader account lets a provider share data with a party that does not have its own Snowflake account, but the reader account uses compute that is owned and billed by the provider. The scenario explicitly requires that the partner must not be able to access provider compute resources. Also, 'grant imported privileges on the shared database' is terminology used by consumers of shared databases in some contexts, not the primary control the provider uses to define shared object scope. Choosing a reader account here increases provider operational and cost exposure.
- B. Correct.
Correct. This is the standard least-privilege approach for secure direct sharing. The provider should create a share containing only approved objects and grant only the minimum required privileges: USAGE on the database and schema, and SELECT on the specific securable objects intended for sharing. Associating the share with the partner's dedicated consumer account limits access to the intended recipient and supports clean lifecycle management.
- C. Incorrect.
Incorrect for this question. Secure views are an important control and are often preferable when the provider must apply column filtering, row filtering, or protect underlying logic. However, this option says to use secure views 'rather than sharing the underlying base tables when row or column restrictions are required.' That statement is broadly true, but it does not fully address the scenario's full set of requirements as well as Options 2 and 5, especially account-level restriction to the intended partner and rapid centralized revocation. Also, the scenario allows approved tables and secure views, so secure views are not universally required for every shared object.
- D. Incorrect.
Incorrect. Consumers cannot be given OWNERSHIP in the provider account through a data share, and external partners should not be granted powerful administrative privileges in the provider environment. Masking policies and other governance controls on shared data are managed by the provider before sharing. This option reflects a misunderstanding of Snowflake's account boundary and object ownership model.
- E. Correct.
Correct. One of the key security advantages of Snowflake Secure Data Sharing is centralized provider control. The provider can revoke access by removing the consumer account from the share or by dropping the share, making this a strong operational control to include in the agreement and runbook. This directly supports the requirement for quick termination of access if the agreement ends.