SnowPro Associate: Platform Question 305
Single answer● Use of Pre-signed URLsA data engineering team stores daily CSV exports in an internal named stage called @finance_exports. An external auditor needs temporary read-only access to download one specific file directly, but the security team does not want to grant the auditor a Snowflake user account or broad access to the stage. Which approach best meets this requirement?
- A
Generate a pre-signed URL for the specific staged file and share that URL with the auditor.
- B
Grant USAGE on the stage to PUBLIC so the auditor can download the file without authentication.
- C
Create a secure view over the staged file and send the auditor the view name.
- D
Copy the file into a table, grant SELECT on the table to the auditor, and let them query it through a trial account.
Show answer and explanation
Correct answer: A
Explanation
Pre-signed URLs in Snowflake are used to provide time-limited access to a specific file in a stage, which is ideal when an external party needs to download staged data without receiving a Snowflake login or stage privileges. This is a common secure-sharing pattern for staged files. The key benefit is least-privilege access: only the targeted file is exposed for a limited time. In contrast, granting stage access broadly violates security best practices, and secure views are for database objects rather than direct staged-file downloads. This aligns with Snowflake documentation on stage file access and the use of pre-signed URLs for controlled external access.
- A. Correct.
Correct. A pre-signed URL is designed for temporary access to a specific file in a stage without requiring the recipient to authenticate to Snowflake. This fits the requirement for limited, read-only access to one file and avoids granting broader privileges or creating a user account.
- B. Incorrect.
Incorrect. Granting access to PUBLIC would be overly permissive and is not an appropriate way to provide controlled temporary access to a single file. It also conflicts with the requirement to avoid broad access.
- C. Incorrect.
Incorrect. Secure views apply to table-like data access patterns, not direct file downloads from a stage. A staged file is not exposed to an external recipient simply by creating a secure view, and this does not solve the direct-download requirement.
- D. Incorrect.
Incorrect. This approach is unnecessarily complex, creates additional governance and account-management overhead, and does not align with the requirement to avoid creating a Snowflake user account for the auditor. It also changes the data access pattern from downloading a file to querying table data.