SnowPro Advanced: Security Engineer Question 353
Single answerSuspend data sharing or integrationA security engineer at a data provider discovers that a consumer account connected through a direct Snowflake Secure Data Sharing arrangement should no longer have access to shared data because of a contractual issue. The business requires access to be stopped immediately without dropping or recreating provider objects, because sharing may need to be restored later after legal review. Which action should the security engineer take?
- A
Execute ALTER SHARE <share_name> REMOVE ACCOUNTS = <consumer_account>.
- B
Revoke SELECT privileges on the underlying tables from the share.
- C
Disable the database that contains the shared objects until the review is complete.
- D
Transfer ownership of the share to a different role so the consumer can no longer query it.
Show answer and explanation
Correct answer: A
Explanation
For direct Secure Data Sharing, the cleanest way to suspend a single consumer's access is to remove that consumer account from the share using ALTER SHARE ... REMOVE ACCOUNTS. This immediately stops access for that account while preserving the provider-side share definition, object grants, and the ability to restore access later by re-adding the account. This aligns with Snowflake best practices for managing data sharing access at the account-share relationship level instead of making disruptive changes to the underlying database objects. By contrast, changing object grants can unintentionally impact multiple consumers if they use the same share, and changing ownership does not revoke consumer access. Relevant Snowflake documentation includes commands and concepts for Secure Data Sharing, especially CREATE SHARE, ALTER SHARE, and granting privileges to shares.
- A. Correct.
Correct. Removing the consumer account from the share immediately suspends that consumer's access to the shared database without requiring the provider to drop the share or recreate shared objects. This is the appropriate way to stop a specific consumer's access in a direct share while preserving the share for potential later reactivation by adding the account back.
- B. Incorrect.
Incorrect. Shares do not receive object privileges in the same way roles do, and access to objects in a share is managed by granting privileges to the share itself. In practice, revoking object privileges from the share could affect all consumers of that share, not just the single consumer account in question. It is not the best action when the requirement is to suspend one consumer immediately while keeping the sharing configuration reusable.
- C. Incorrect.
Incorrect. Snowflake does not provide a supported 'disable database' control for this purpose. Suspending an entire database is not how direct data sharing is managed, and even if access to provider objects changed, this would be an overly broad and disruptive approach compared with removing the consumer account from the share.
- D. Incorrect.
Incorrect. Changing ownership of a share affects administrative control over the share, not the consumer's ability to access shared data. Consumer access is determined by whether the consumer account is added to the share and whether the necessary objects and privileges are granted to that share.