SnowPro Advanced: Security Engineer Question 352
Single answerSuspend data sharing or integrationA security engineer discovers that an external company should no longer have access to a Secure Data Sharing listing created directly from a provider account. The business requirement is to stop the consumer from querying shared data immediately, while preserving the underlying provider database objects and allowing the share to be re-enabled later if the issue is resolved. Which action should the engineer take?
- A
Drop the shared database objects from the provider account so the consumer can no longer query them
- B
Alter the share and remove the consumer account from the share
- C
Revoke imported privileges from the consumer's shared database
- D
Suspend or disable the warehouse in the provider account that owns the shared objects
Show answer and explanation
Correct answer: B
Explanation
In Snowflake Secure Data Sharing, the provider controls access by managing the share and its authorized consumer accounts. If access must be stopped quickly without deleting data, the provider should remove the consumer account from the share (or otherwise remove access through the share relationship). This preserves the underlying objects and supports later restoration. Deleting source objects is unnecessarily destructive, and warehouse state in the provider account is not the mechanism that governs whether consumers can query shared data. This aligns with Snowflake best practices for provider-managed secure sharing: manage access through shares, grants to the share, and authorized consumer accounts rather than by changing compute resources or deleting data.
- A. Incorrect.
Incorrect. Dropping provider-side database objects would stop access, but it is destructive and does not meet the requirement to preserve the underlying objects for later reuse. Secure data sharing is designed so access can be managed through the share itself without deleting the source data.
- B. Correct.
Correct. Removing the consumer account from the share immediately stops that consumer's access while leaving the provider's source objects intact. This is the appropriate way to suspend a direct secure data sharing relationship when the provider may want to restore access later by adding the account back.
- C. Incorrect.
Incorrect. Imported privileges are granted within the consumer account on the database created from the share. The provider cannot rely on this as the control point for suspending access, and it does not address the provider-side requirement to stop sharing from the source. This option reflects a misunderstanding between provider-managed sharing and consumer-side role grants.
- D. Incorrect.
Incorrect. Consumers of shared data query the provider's storage layer through metadata sharing; they do not depend on a running warehouse in the provider account to access the shared objects. Suspending a provider warehouse would not reliably suspend the data share.