Snowflake ARA-C01 Online Practice Questions and Exam Preparation

Snowflake ARA-C01 Online Questions & Answers

• Question 1:

  Which security, governance, and data protection features require, at a MINIMUM, the Business Critical edition of Snowflake? (Choose two.)

  A. Extended Time Travel (up to 90 days)
  B. Customer-managed encryption keys through Tri-Secret Secure
  C. Periodic rekeying of encrypted data
  D. AWS, Azure, or Google Cloud private connectivity to Snowflake
  E. Federated authentication and SSO
  B. Customer-managed encryption keys through Tri-Secret Secure
  D. AWS, Azure, or Google Cloud private connectivity to Snowflake

  ---

  Explanation/Reference:

  According to the SnowPro Advanced: Architect documents and learning resources, the security, governance, and data protection features that require, at a minimum, the Business Critical edition of Snowflake are: Customer-managed encryption keys through Tri-Secret Secure. This feature allows customers to manage their own encryption keys for data at rest in Snowflake, using a combination of three secrets: a master key, a service key, and a security password. This provides an additional layer of security and control over the data encryption and decryption process1. Periodic rekeying of encrypted data. This feature allows customers to periodically rotate the encryption keys for data at rest in Snowflake, using either Snowflake- managed keys or customer-managed keys. This enhances the security and protection of the data by reducing the risk of key compromise or exposure2. The other options are incorrect because they do not require the Business Critical edition of Snowflake. Option A is incorrect because extended Time Travel (up to 90 days) is available with the Enterprise edition of Snowflake3. Option D is incorrect because AWS, Azure, or Google Cloud private connectivity to Snowflake is available with the Standard edition of Snowflake4. Option E is incorrect because federated authentication and SSO are available with the Standard edition of Snowflake5. References: Tri-Secret Secure | Snowflake Documentation, Periodic Rekeying of Encrypted Data | Snowflake Documentation, Snowflake Editions | Snowflake Documentation, Snowflake Network Policies | Snowflake Documentation, Configuring Federated Authentication and SSO | Snowflake Documentation

• Question 2:

  A company wants to deploy its Snowflake accounts inside its corporate network with no visibility on the internet. The company is using a VPN infrastructure and Virtual Desktop Infrastructure (VDI) for its Snowflake users. The company also wants to re-use the login credentials set up for the VDI to eliminate redundancy when managing logins.

  What Snowflake functionality should be used to meet these requirements? (Choose two.)

  A. Set up replication to allow users to connect from outside the company VPN.
  B. Provision a unique company Tri-Secret Secure key.
  C. Use private connectivity from a cloud provider.
  D. Set up SSO for federated authentication.
  E. Use a proxy Snowflake account outside the VPN, enabling client redirect for user logins.
  A. Set up replication to allow users to connect from outside the company VPN.
  B. Provision a unique company Tri-Secret Secure key.
  C. Use private connectivity from a cloud provider.
  D. Set up SSO for federated authentication.
  E. Use a proxy Snowflake account outside the VPN, enabling client redirect for user logins.

• Question 3:

  A large manufacturing company runs a dozen individual Snowflake accounts across its business divisions. The company wants to increase the level of data sharing to support supply chain optimizations and increase its purchasing leverage with multiple vendors.

  The company's Snowflake Architects need to design a solution that would allow the business divisions to decide what to share, while minimizing the level of effort spent on configuration and management. Most of the company divisions use Snowflake accounts in the same cloud deployments with a few exceptions for European-based divisions.

  According to Snowflake recommended best practice, how should these requirements be met?

  A. Migrate the European accounts in the global region and manage shares in a connected graph architecture. Deploy a Data Exchange.
  B. Deploy a Private Data Exchange in combination with data shares for the European accounts.
  C. Deploy to the Snowflake Marketplace making sure that invoker_share() is used in all secure views.
  D. Deploy a Private Data Exchange and use replication to allow European data shares in the Exchange.
  B. Deploy a Private Data Exchange in combination with data shares for the European accounts.

  ---

  Explanation/Reference:

  According to Snowflake recommended best practice, the requirements of the large manufacturing company should be met by deploying a Private Data Exchange in combination with data shares for the European accounts. A Private Data Exchange is a feature of the Snowflake Data Cloud platform that enables secure and governed sharing of data between organizations. It allows Snowflake customers to create their own data hub and invite other parts of their organization or external partners to access and contribute data sets. A Private Data Exchange provides centralized management, granular access control, and data usage metrics for the data shared in the exchange1. A data share is a secure and direct way of sharing data between Snowflake accounts without having to copy or move the data. A data share allows the data provider to grant privileges on selected objects in their account to one or more data consumers in other accounts2. By using a Private Data Exchange in combination with data shares, the company can achieve the following benefits: The business divisions can decide what data to share and publish it to the Private Data Exchange, where it can be discovered and accessed by other members of the exchange. This reduces the effort and complexity of managing multiple data sharing relationships and configurations. The company can leverage the existing Snowflake accounts in the same cloud deployments to create the Private Data Exchange and invite the members to join. This minimizes the migration and setup costs and leverages the existing Snowflake features and security. The company can use data shares to share data with the European accounts that are in different regions or cloud platforms. This allows the company to comply with the regional and regulatory requirements for data sovereignty and privacy, while still enabling data collaboration across the organization. The company can use the Snowflake Data Cloud platform to perform data analysis and transformation on the shared data, as well as integrate with other data sources and applications. This enables the company to optimize its supply chain and increase its purchasing leverage with multiple vendors. The other options are incorrect because they do not meet the requirements or follow the best practices. Option A is incorrect because migrating the European accounts to the global region may violate the data sovereignty and privacy regulations, and deploying a Data Exchange may not provide the level of control and management that the company needs. Option C is incorrect because deploying to the Snowflake Marketplace may expose the company's data to unwanted consumers, and using invoker_share() in secure views may not provide the desired level of security and governance. Option D is incorrect because using replication to allow European data shares in the Exchange may incur additional costs and complexity, and may not be necessary if data shares can be used instead. References: Private Data Exchange | Snowflake Documentation, Introduction to Secure Data Sharing | Snowflake Documentation

• Question 4:

  An Architect has chosen to separate their Snowflake Production and QA environments using two separate Snowflake accounts.

  The QA account is intended to run and test changes on data and database objects before pushing those changes to the Production account. It is a requirement that all database objects and data in the QA account need to be an exact copy of the database objects, including privileges and data in the Production account on at least a nightly basis.

  Which is the LEAST complex approach to use to populate the QA account with the Production account's data and database objects on a nightly basis?

  A. 1) Create a share in the Production account for each database 2) Share access to the QA account as a Consumer 3) The QA account creates a database directly from each share 4) Create clones of those databases on a nightly basis 5) Run tests directly on those cloned databases
  B. 1) Create a stage in the Production account 2) Create a stage in the QA account that points to the same external object-storage location 3) Create a task that runs nightly to unload each table in the Production account into the stage 4) Use Snowpipe to populate the QA account
  C. 1) Enable replication for each database in the Production account 2) Create replica databases in the QA account 3) Create clones of the replica databases on a nightly basis 4) Run tests directly on those cloned databases
  D. 1) In the Production account, create an external function that connects into the QA account and returns all the data for one specific table 2) Run the external function as part of a stored procedure that loops through each table in the Production account and populates each table in the QA account
  C. 1) Enable replication for each database in the Production account 2) Create replica databases in the QA account 3) Create clones of the replica databases on a nightly basis 4) Run tests directly on those cloned databases

  ---

  Explanation/Reference:

  This approach is the least complex because it uses Snowflake's built-in replication feature to copy the data and database objects from the Production account to the QA account. Replication is a fast and efficient way to synchronize data across accounts, regions, and cloud platforms. It also preserves the privileges and metadata of the replicated objects. By creating clones of the replica databases, the QA account can run tests on the cloned data without affecting the original data. Clones are also zero-copy, meaning they do not consume any additional storage space unless the data is modified. This approach does not require any external stages, tasks, Snowpipe, or external functions, which can add complexity and overhead to the data transfer process. References: Introduction to Replication and Failover Replicating Databases Across Multiple Accounts Cloning Considerations

• Question 5:

  Which organization-related tasks can be performed by the ORGADMIN role? (Choose three.)

  A. Changing the name of the organization
  B. Creating an account
  C. Viewing a list of organization accounts
  D. Changing the name of an account
  E. Deleting an account
  F. Enabling the replication of a database
  B. Creating an account
  C. Viewing a list of organization accounts
  F. Enabling the replication of a database

  ---

  Explanation/Reference:

  According to the SnowPro Advanced: Architect documents and learning resources, the organization-related tasks that can be performed by the ORGADMIN role are: Creating an account in the organization. A user with the ORGADMIN role can use the CREATE ACCOUNT command to create a new account that belongs to the same organization as the current account1. Viewing a list of organization accounts. A user with the ORGADMIN role can use the SHOW ORGANIZATION ACCOUNTS command to view the names and properties of all accounts in the organization2. Alternatively, the user can use the Admin ?Accounts page in the web interface to view the organization name and account names3. Enabling the replication of a database. A user with the ORGADMIN role can use the SYSTEM$GLOBAL_ACCOUNT_SET_PARAMETER function to enable database replication for an account in the organization. This allows the user to replicate databases across accounts in different regions and cloud platforms for data availability and durability4. The other options are incorrect because they are not organization-related tasks that can be performed by the ORGADMIN role. Option A is incorrect because changing the name of the organization is not a task that can be performed by the ORGADMIN role. To change the name of an organization, the user must contact Snowflake Support3. Option D is incorrect because changing the name of an account is not a task that can be performed by the ORGADMIN role. To change the name of an account, the user must contact Snowflake Support5. Option E is incorrect because deleting an account is not a task that can be performed by the ORGADMIN role. To delete an account, the user must contact Snowflake Support. References: CREATE ACCOUNT | Snowflake Documentation, SHOW ORGANIZATION ACCOUNTS | Snowflake Documentation, Getting Started with Organizations | Snowflake Documentation, SYSTEM$GLOBAL_ACCOUNT_SET_PARAMETER | Snowflake Documentation, ALTER ACCOUNT | Snowflake Documentation, [DROP ACCOUNT | Snowflake Documentation]

• Question 6:

  When using the Snowflake Connector for Kafka, what data formats are supported for the messages? (Choose two.)

  A. CSV
  B. XML
  C. Avro
  D. JSON
  E. Parquet
  C. Avro
  D. JSON

  ---

  Explanation/Reference:

  The data formats that are supported for the messages when using the Snowflake Connector for Kafka are Avro and JSON. These are the two formats that the connector can parse and convert into Snowflake table rows. The connector supports both schemaless and schematized JSON, as well as Avro with or without a schema registry1. The other options are incorrect because they are not supported data formats for the messages. CSV, XML, and Parquet are not formats that the connector can parse and convert into Snowflake table rows. If the messages are in these formats, the connector will load them as VARIANT data type and store them as raw strings in the table2. References: Snowflake Connector for Kafka | Snowflake Documentation, Loading Protobuf Data using the Snowflake Connector for Kafka | Snowflake Documentation

• Question 7:

  An Architect on a new project has been asked to design an architecture that meets Snowflake security, compliance, and governance requirements as follows:

  1) Use Tri-Secret Secure in Snowflake

  2) Share some information stored in a view with another Snowflake customer

  3) Hide portions of sensitive information from some columns

  4) Use zero-copy cloning to refresh the non-production environment from the production environment

  To meet these requirements, which design elements must be implemented? (Choose three.)

  A. Define row access policies.
  B. Use theBusiness-Criticaledition of Snowflake.
  C. Create a secure view.
  D. Use the Enterprise edition of Snowflake.
  E. Use Dynamic Data Masking.
  F. Create a materialized view.
  B. Use theBusiness-Criticaledition of Snowflake.
  C. Create a secure view.
  E. Use Dynamic Data Masking.

  ---

  Explanation/Reference:

  These three design elements are required to meet the security, compliance, and governance requirements for the project.

  To use Tri-Secret Secure in Snowflake, the Business Critical edition of Snowflake is required. This edition provides enhanced data protection features, such as customer-managed encryption keys, that are not available in lower editions. Tri-

  Secret Secure is a feature that combines a Snowflake-maintained key and a customer-managed key to create a composite master key to encrypt the data in Snowflake1.

  To share some information stored in a view with another Snowflake customer, a secure view is recommended. A secure view is a view that hides the underlying data and the view definition from unauthorized users. Only the owner of the view

  and the users who are granted the owner's role can see the view definition and the data in the base tables of the view2. A secure view can be shared with another Snowflake account using a data share3.

  To hide portions of sensitive information from some columns, Dynamic Data Masking can be used. Dynamic Data Masking is a feature that allows applying masking policies to columns to selectively mask plain-text data at query time.

  Depending on the masking policy conditions and the user's role, the data can be fully or partially masked, or shown as plain-text4.

• Question 8:

  An Architect entered the following commands in sequence:

  

  USER1 cannot find the table.

  Which of the following commands does the Architect need to run for USER1 to find the tables using the Principle of Least Privilege? (Choose two.)

  A. GRANT ROLE PUBLIC TO ROLE INTERN;
  B. GRANT USAGE ON DATABASE SANDBOX TO ROLE INTERN;
  C. GRANT USAGE ON SCHEMA SANDBOX.PUBLIC TO ROLE INTERN;
  D. GRANT OWNERSHIP ON DATABASE SANDBOX TO USER INTERN;
  E. GRANT ALL PRIVILEGES ON DATABASE SANDBOX TO ROLE INTERN;
  B. GRANT USAGE ON DATABASE SANDBOX TO ROLE INTERN;
  C. GRANT USAGE ON SCHEMA SANDBOX.PUBLIC TO ROLE INTERN;

  ---

  Explanation/Reference:

  According to the Principle of Least Privilege, the Architect should grant the minimum privileges necessary for the USER1 to find the tables in the SANDBOX database.

  The USER1 needs to have USAGE privilege on the SANDBOX database and the SANDBOX.PUBLIC schema to be able to access the tables in the PUBLIC schema. Therefore, the commands B and C are the correct ones to run. The

  command A is not correct because the PUBLIC role is automatically granted to every user and role in the account, and it does not have any privileges on the SANDBOX database by default.

  The command D is not correct because it would transfer the ownership of the SANDBOX database from the Architect to the USER1, which is not necessary and violates the Principle of Least Privilege.

  The command E is not correct because it would grant all the possible privileges on the SANDBOX database to the USER1, which is also not necessary and violates the Principle of Least Privilege.

  References: : Snowflake - Principle of Least Privilege : Snowflake - Access Control Privileges : Snowflake - Public Role : Snowflake - Ownership and Grants

• Question 9:

  Which Snowflake data modeling approach is designed for BI queries?

  A. 3 NF
  B. Star schema
  C. Data Vault
  D. Snowflake schema
  B. Star schema

  ---

  Explanation/Reference:

  A star schema is a Snowflake data modeling approach that is designed for BI queries. A star schema is a type of dimensional modeling that organizes data into fact tables and dimension tables. A fact table contains the measures or metrics of the business process, such as sales amount, order quantity, or profit margin. A dimension table contains the attributes or descriptors of the business process, such as product name, customer name, or order date. A star schema is called so because it resembles a star, with one fact table in the center and multiple dimension tables radiating from it. A star schema can improve the performance and simplicity of BI queries by reducing the number of joins, providing fast access to aggregated data, and enabling intuitive query syntax. A star schema can also support various types of analysis, such as trend analysis, slice and dice, drill down, and roll up12. References: Snowflake Documentation: Dimensional Modeling Snowflake Documentation: Star Schema

• Question 10:

  Which of the following are characteristics of Snowflake's parameter hierarchy?

  A. Session parameters override virtual warehouse parameters.
  B. Virtual warehouse parameters override user parameters.
  C. Table parameters override virtual warehouse parameters.
  D. Schema parameters override account parameters.
  D. Schema parameters override account parameters.

  ---

  Explanation/Reference:

  This is the correct answer because it reflects the characteristics of Snowflake's parameter hierarchy. Snowflake provides three types of parameters that can be set for an account: account parameters, session parameters, and object parameters. All parameters have default values, which can be set and then overridden at different levels depending on the parameter type. The following diagram illustrates the hierarchical relationship between the different parameter types and how individual parameters can be overridden at each level1: As shown in the diagram, schema parameters are a type of object parameters that can be set for schemas. Schema parameters can override the account parameters that are set at the account level. For example, the LOG_LEVEL parameter can be set at the account level to control the logging level for all objects in the account, but it can also be overridden at the schema level to control the logging level for specific stored procedures and UDFs in that schema2. The other options listed are not correct because they do not reflect the characteristics of Snowflake's parameter hierarchy. Session parameters do not override virtual warehouse parameters, because virtual warehouse parameters are a type of session parameters that can be set for virtual warehouses. Virtual warehouse parameters do not override user parameters, because user parameters are a type of session parameters that can be set for users. Table parameters do not override virtual warehouse parameters, because table parameters are a type of object parameters that can be set for tables, and object parameters do not affect session parameters1. References: Snowflake Documentation: Parameters Snowflake Documentation: Setting Log Level