Fast2test ADA-C01問題集80問でSnowPro Advanced: Administratorを確実実践
リアル最新ADA-C01試験問題ADA-C01問題集
Snowflake ADA-C01 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
| トピック 6 |
|
| トピック 7 |
|
質問 # 36
An Administrator needs to implement an access control mechanism across an organization. The organization users access sensitive customer data that comes from different regions and needs to be accessible for Analysts who work in these regions. Some Analysts need very specific access control depending on their functional roles in the organization. Following Snowflake recommended practice, how should these requirements be met? (Select TWO).
- A. Implement views on top of base tables that exclude or mask sensitive data.
- B. Use zero-copy cloning to replicate the database schema and provide access as needed.
- C. Include masking rules as part of data ingestion and transformation pipelines.
- D. Use a third-party tool to share the data.
- E. Implement row access policies and Dynamic Data Masking policies.
正解：A、E
解説：
The scenario describes a need for fine-grained access control over sensitive customer data across multiple regions, with functional-role-based access for analysts. Snowflake recommends applying a layered security model that separates raw data from user-facing access and leverages built-in policy features.
Explanation of Correct Answers:
A . Implement views on top of base tables that exclude or mask sensitive data.
Creating secure views allows administrators to abstract sensitive fields or filter out certain rows and columns.
It enables role-based access control by granting specific roles access only to the secure views.
Common practice is to restrict access to base tables and give users access to views that enforce business logic and data access rules.
B . Implement row access policies and Dynamic Data Masking policies.
Row Access Policies control access at the row level, determining what data a user can see based on their role or session context.
Dynamic Data Masking allows you to mask sensitive column data (like PII) dynamically based on the accessing role.
Both are central features of Snowflake's fine-grained access control.
Why the other options are incorrect:
C . Include masking rules as part of data ingestion and transformation pipelines.
This is not a Snowflake-recommended best practice for access control.
It hardcodes data access rules into ETL/ELT logic, which reduces flexibility and central control.
Also, it masks the data permanently at ingestion time, rather than dynamically at query time.
D . Use a third-party tool to share the data.
Snowflake supports native Secure Data Sharing, and using a third-party tool is unnecessary and introduces complexity.
It does not address row/column-level access control within Snowflake itself.
E . Use zero-copy cloning to replicate the database schema and provide access as needed.
Zero-copy cloning is ideal for testing, development, and backup purposes, not for controlling access.
It duplicates metadata but doesn't provide a mechanism for fine-grained, real-time access control.
SnowPro Administrator Reference:
Row Access Policies Overview
Dynamic Data Masking Overview
Access Control Best Practices
Using Secure Views for Access Control
質問 # 37
An Administrator receives data from a Snowflake partner. The partner is sharing a dataset that contains multiple secure views. The Administrator would like to configure the data so that only certain roles can see certain secure views.
How can this be accomplished?
- A. Individually grant imported privileges onto the schema in the share.
- B. Clone the data and insert it into a company-owned share and apply the desired RBAC on the new tables.
- C. Create views over the incoming shared database and apply the desired RBAC onto these views.
- D. Apply RBAC directly onto the partner's shared secure views.
正解：C
解説：
Explanation
According to the Snowflake documentation1, secure views are only exposed to authorized users who have been granted the role that owns the view. Therefore, applying RBAC directly onto the partner's shared secure views (option A) is not possible, as the administrator does not own those views. Individually granting imported privileges onto the schema in the share (option B) is also not feasible, as the privileges granted on the schema do not apply to existing secure views, only tofuture ones2. Cloning the data and inserting it into a company-owned share (option C) is not recommended, as it would create unnecessary duplication of data and increase storage costs. The best option is to create views over the incoming shared database and apply the desired RBAC onto these views (option D). This way, the administrator can control the access to the data based on the roles in their account, without modifying the original data or views from the partner.
質問 # 38
What are benefits of using Snowflake organizations? (Select TWO).
- A. Administrators can monitor and understand usage across all accounts in the organization.
- B. Administrators have the ability to create accounts in any available cloud provider or region.
- C. Administrators can change Snowflake account editions on-demand based on need.
- D. User administration is simplified across all accounts within the organization.
- E. Administrators can simplify data movement across all accounts within the organization.
正解：A、B
解説：
According to the Snowflake documentation1, organizations are a feature that allows linking the accounts owned by a business entity, simplifying account management and billing, replication and failover, data sharing, and other account administration tasks. Some of the benefits of using organizations are:
* Administrators can monitor and understand usage across all accounts in the organization using the ORGANIZATION_USAGE schema, which provides historical usage data for all accounts in the organization via views in a shared database named SNOWFLAKE2. This can help to optimize costs and performance across the organization.
* Administrators have the ability to create accounts in any available cloud provider or region using the CREATE ACCOUNT command, which allows specifying the cloud platform and region for the new account3. This can help to meet the business needs and compliance requirements of the organization.
Option A is incorrect because administrators cannot change Snowflake account editions on-demand based on need, but rather have to contact Snowflake Support to request an edition change4. Option C is incorrect because administrators cannot simplify data movement across all accounts within the organization, but rather have to enable account database replication for both the source and target accounts, and use the ALTER DATABASE ... ENABLE REPLICATION TO ACCOUNTS command to promote a local database to serve as the primary database and enable replication to the target accounts5. Option D is incorrect because user administration is not simplified across all accounts within the organization, but rather requires creating and managing users, roles, and privileges for each account separately, unless using a federated authentication method such as SSO or SCIM.
質問 # 39
MY_TABLE is a table that has not been updated or modified for several days. On 01 January 2021 at 07:01, a user executed a query to update this table. The query ID is
'8e5d0ca9-005e-44e6-b858-a8f5b37c5726'. It is now 07:30 on the same day.
Which queries will allow the user to view the historical data that was in the table before this query was executed? (Select THREE).
- A. SELECT * FROM my_table AT (TIMESTAMP => '2021-01-01 07:00:00' :: timestamp);
- B. SELECT * FROM my table WITH TIME_TRAVEL (OFFSET => -60*30);
- C. SELECT * FROM my table PRIOR TO STATEMENT '8e5d0ca9-005e-44e6-b858-a8f5b37c5726';
- D. SELECT * FROM TIME_TRAVEL ('MY_TABLE', 2021-01-01 07:00:00);
- E. SELECT * FROM my_table BEFORE (STATEMENT => '8e5d0ca9-005e-44e6-b858-a8f5b37c5726');
- F. SELECT * FROM my_table AT (OFFSET => -60*30);
正解：A、C、E
解説：
According to the AT | BEFORE documentation, the AT or BEFORE clause is used for Snowflake Time Travel, which allows you to query historical data from a table based on a specific point in the past. The clause can use one of the following parameters to pinpoint the exact historical data you wish to access:
* TIMESTAMP: Specifies an exact date and time to use for Time Travel.
* OFFSET: Specifies the difference in seconds from the current time to use for Time Travel.
* STATEMENT: Specifies the query ID of a statement to use as the reference point for Time Travel.
Therefore, the queries that will allow the user to view the historical data that was in the table before the query was executed are:
* B. SELECT * FROM my_table AT (TIMESTAMP => '2021-01-01 07:00:00' :: timestamp); This query uses the TIMESTAMP parameter to specify a point in time that is before the query execution time of 07:01.
* D. SELECT * FROM my table PRIOR TO STATEMENT '8e5d0ca9-005e-44e6-b858-a8f5b37c5726'; This query uses the PRIOR TO STATEMENT keyword and the STATEMENT parameter to specify a point in time that is immediately preceding the query execution time of 07:01.
* F. SELECT * FROM my_table BEFORE (STATEMENT => '8e5d0ca9-005e-44e6-b858-a8f5b37c5726'); This query uses the BEFORE keyword and the STATEMENT parameter to specify a point in time that is immediately preceding the query execution time of 07:01.
The other queries are incorrect because:
* A. SELECT * FROM my table WITH TIME_TRAVEL (OFFSET => -60*30); This query uses the OFFSET parameter to specify a point in time that is 30 minutes before the current time, which is 07:30. This is after the query execution time of 07:01, so it will not show the historical data before the query was executed.
* C. SELECT * FROM TIME_TRAVEL ('MY_TABLE', 2021-01-01 07:00:00); This query is not valid syntax for Time Travel. The TIME_TRAVEL function does not exist in Snowflake. The correct syntax is to use the AT or BEFORE clause after the table name in the FROM clause.
* E. SELECT * FROM my_table AT (OFFSET => -60*30); This query uses the AT keyword and the OFFSET parameter to specify a point in time that is 30 minutes before the current time, which is 07:30. This is equal to the query execution time of 07:01, so it will not show the historical data before the query was executed. The AT keyword specifies that the request is inclusive of any changes made by a statement or transaction with timestamp equal to the specified parameter. To exclude the changes made by the query, the BEFORE keyword should be used instead.
質問 # 40
In which scenario will use of an external table simplify a data pipeline?
- A. When accessing a Snowflake table from an external database within the same region
- B. When accessing a Snowflake table that references data files located in cloud storage
- C. When accessing a Snowflake table from a relational database
- D. When continuously writing data from a Snowflake table to external storage
正解：B
解説：
Explanation
According to the Introduction to External Tables documentation, an external table is a Snowflake feature that allows you to query data stored in an external stage as if the data were inside a table in Snowflake. The external stage is not part of Snowflake, so Snowflake does not store or manage the stage. This simplifies the data pipeline by eliminating the need to load the data into Snowflake before querying it. External tables can access data stored in any format that the COPY INTO <table> command supports, such as CSV, JSON, AVRO, ORC, or PARQUET. The other scenarios do not involve external tables, but rather require data loading, unloading, or federation.
質問 # 41
What are the requirements when creating a new account within an organization in Snowflake? (Select TWO).
- A. The account requires at least one ORGADMIN role within one of the organization's accounts.
- B. The account name must be unique within the organization.
- C. The account name is immutable and cannot be changed.
- D. The account name must be unique among all Snowflake customers.
- E. The account name must be specified when the account is created.
正解：B、E
解説：
Explanation
According to the CREATE ACCOUNT documentation, the account name must be specified when the account is created, and it must be unique within an organization, regardless of which Snowflake Region the account is in. The other options are incorrect because:
*The account does not require at least one ORGADMIN role within one of the organization's accounts. The account can be created by an organization administrator (i.e. a user with the ORGADMIN role) through the web interface or using SQL, but the new account does not inherit the ORGADMIN role from the existing account. The new account will have its own set of users, roles, databases, and warehouses.
*The account name is not immutable and can be changed. The account name can be modified by contacting Snowflake Support and requesting a name change. However, changing the account name may affect some features that depend on the account name, such as SSO or SCIM.
*The account name does not need to be unique among all Snowflake customers. The account name only needs to be unique within the organization, as the account URL also includes the region and cloud platform information. For example, two accounts with the same name can exist in different regions or cloud platforms, such as myaccount.us-east-1.snowflakecomputing.com and myaccount.eu-west-1.aws.snowflakecomputing.com.
質問 # 42
.
Company A uses Snowflake to manage audio files of call recordings. Company A hired Company B, who also uses Snowflake, to transcribe the audio files for further analysis.
Company A's Administrator created a share.
What object should be added to the share to allow Company B access to the files?
- A. A secure view with a column for the stage name and a column for the file path.
- B. A secure view with a column for file URLs.
- C. A secure view with a column for pre-signed URLs.
- D. A secure view with a column for METADATA$FILENAME.
正解：C
解説：
Explanation
According to the Snowflake documentation1, pre-signed URLs are required to access external files in a share.
A secure view can be used to generate pre-signed URLs for the audio files stored in an external stage and expose them to the consumer account. Option A is incorrect because file URLs alone are not sufficient to access external files in a share. Option C is incorrect because METADATA$FILENAME only returns the file name, not the full path or URL. Option D is incorrect because the stage name and file path are not enough to generate pre-signed URLs.
質問 # 43
A Snowflake account is configured with SCIM provisioning for user accounts and has bi-directional synchronization for user identities. An Administrator with access to SECURITYADMIN uses the Snowflake UI to create a user by issuing the following commands:
use role USERADMIN;
create or replace role DEVELOPER_ROLE;
create user PTORRES PASSWORD = 'hello world!' MUST_CHANGE_PASSWORD = FALSE default_role = DEVELOPER_ROLE; The new user named PTORRES successfully logs in, but sees a default role of PUBLIC in the web UI. When attempted, the following command fails:
use DEVELOPER_ROLE;
Why does this command fail?
- A. The new role will only take effect once the identity provider has synchronized by way of SCIM with the Snowflake account.
- B. The new role can only take effect after USERADMIN has logged out.
- C. The DEVELOPER_ROLE needs to be granted to SYSADMIN before user PTORRES will be able to use the role.
- D. USERADMIN needs to explicitly grant the DEVELOPER_ROLE to the new USER.
正解：D
解説：
Explanation
According to the Snowflake documentation1, creating a user with a default role does not automatically grant that role to the user. The user must be explicitly granted the role by the role owner or a higher-level role.
Therefore, the USERADMIN role, which created the DEVELOPER_ROLE, needs to explicitly grant the DEVELOPER_ROLE to the new user PTORRES using the GRANT ROLE command. Otherwise, the user PTORRES will not be able to use the DEVELOPER_ROLE and will see the default role of PUBLIC in the web UI. Option A is incorrect because the DEVELOPER_ROLE does not need to be granted to SYSADMIN before user PTORRES can use the role. Option B is incorrect because the new role can take effect immediately after it is created and granted to the user, and does not depend on the USERADMIN role logging out. Option D is incorrect because the new role will not be affected by the identity provider synchronization, as it is created and managed in Snowflake.
質問 # 44
A Snowflake Administrator is investigating why a query is not re-using the persisted result cache.
The Administrator found the two relevant queries from the SNOWFLAKE. ACCOUNT_USAGE.
QUERY_HISTORY view:
Why is the second query re-scanning micro-partitions instead of using the first query's persisted result cache?
- A. The queries are executed with two different roles.
- B. The queries are executed with two different virtual warehouses.
- C. The second query includes a CURRENT_TIMESTAMP () function.
- D. The second query includes a CURRENT_DATE () function.
正解：B
解説：
Explanation
The inclusion of the CURRENT_TIMESTAMP() function in the second query prevents it from re-using the first query's persisted result cache because this function makes each execution unique due to the constantly changing timestamp. According to the Snowflake documentation, "The query does not include non-reusable functions, which return different results for successive runs of the same query. UUID_STRING, RANDOM, and RANDSTR are good examples of non-reusable functions." The CURRENT_TIMESTAMP() function is another example of a non-reusable function, as it returns the current date and time at the start of query execution, which varies for each run. Therefore, the second query is not identical to the first query, and the result cache is not reused. The other options are either incorrect or irrelevant to the question. Option B is incorrect, as the CURRENT_DATE() function is a reusable function, as it returns the same value for all queries executed within the same day. Option C is irrelevant, as the virtual warehouse used to execute the query does not affect the result cache reuse. Option D is also irrelevant, as the role used to execute the query does not affect the result cache reuse, as long as the role has the necessary access privileges for all the tables used in the query.
質問 # 45
If the query matches the definition, will Snowflake always dynamically rewrite the query to use a materialized view?
- A. No, because joins are not supported by materialized views.
- B. Yes, because materialized views are always faster.
- C. No, because the materialized view may not be up-to-date.
- D. No, because the optimizer might decide against it.
正解：D
解説：
Snowflake's query optimizer can automatically rewrite queries against the base table or regular views to use the materialized view instead, if the query matches the definition of the materialized view1. However, this is not always guaranteed, as the optimizer might decide against using the materialized view based on various factors, such as the freshness of the data, the size of the result set, the complexity of the query, and the availability of the materialized view2. Therefore, the answer is no, because the optimizer might decide against it.
質問 # 46
A company's Snowflake account has multiple roles. Each role should have access only to data that resides in the given role's specific region.
When creating a row access policy, which code snippet below will provide privileges to the role ALL_ACCESS_ROLE to see all rows regardless of region, while the other roles can only see rows for their own regions?
- A. create or replace row access policy region policy as (region_value varchar) returns boolean ->
'ALL ACCESS ROLE' = current_role ()
) - B. create or replace row access policy region policy as (region_value varchar) returns boolean ->
'ALL ACCESS_ROLE' = current_role ()
and exists (
select 1 from entitlement_table
where role = current_role ()
and region = region_value
) - C. create or replace row access policy region policy as (region_value varchar) returns boolean ->
'ALL_ACCESS_ROLE' = current_role ()
or exists (
select 1 from entitlement_table
where role = current_role ()
and region = region_value
) - D. create or replace row access policy region policy as (region_value varchar) returns boolean -> exists ( select 1 from entitlement_table where role = current_role () and region = region_value )
正解：C
解説：
Explanation
This code snippet will create a row access policy that returns true if the current role is ALL_ACCESS_ROLE or if the current role matches the region value in the entitlement_table. This means that the ALL_ACCESS_ROLE can see all rows regardless of region, while the other roles can only see rows for their own regions. According to the Snowflake documentation, the CURRENT_ROLE context function returns the name of the current role for the session. The EXISTS function returns true if the subquery returns any rows.
The OR operator returns true if either operand is true. Therefore, this code snippet satisfies the requirements of the question.
質問 # 47
An Administrator has been asked to support the company's application team need to build a loyalty program for its customers. The customer table contains Personal Identifiable Information (PII), and the application team's role is DEVELOPER.
CREATE TABLE customer_data (
customer_first_name string,
customer_last_name string,
customer_address string,
customer_email string,
... some other columns,
);
The application team would like to access the customer data, but the email field must be obfuscated.
How can the Administrator protect the sensitive information, while maintaining the usability of the data?
- A. Create a view on the customer_data table to eliminate the email column by omitting it from the SELECT clause. Grant the role DEVELOPER access to the view.
- B. Create a separate table for all the non-Pll columns and grant the role DEVELOPER access to the new table.
- C. Use the CURRENT_ROLE context function to integrate with a masking policy on the fields that contain sensitive data.
- D. Use the CURRENT_ROLE and CURRENT_USER context functions to integrate with a secure view and filter the sensitive data.
正解：C
質問 # 48
Which statement allows this user to access this Snowflake account from a specific IP address (192.168.1.100) while blocking their access from anywhere else?
- A. CREATE NETWORK POLICY ADMIN POLICY
ALLOWED_IP_LIST = ('192.168.1.100');
ALTER ROLE ACCOUNTADMIN SET NETWORK_POLICY = 'ADMIN_POLICY'; - B. CREATE NETWORK POLICY ADMIN_POLICY
ALLOWED IP LIST = ('192.168.1.100')
BLOCKED_IP_LIST = ('0.0.0.0/0');
ALTER USER ABC SET NETWORK_POLICY = 'ADMIN_POLICY'; - C. CREATE OR REPLACE NETWORK POLICY ADMIN_POLICY
ALLOWED_IP_LIST = ('192.168. 1. 100/0') ;
ALTER USER ABC SET NETWORK_POLICY = 'ADMIN_POLICY'; - D. CREATE NETWORK POLICY ADMIN_POLICY
ALLOWED_IP_LIST = ('192.168.1.100');
ALTER USER ABC SET NETWORK_POLICY = 'ADMIN_POLICY';
User ABC is the only user with an ACCOUNTADMIN role.
正解：B
解説：
Explanation
Option C creates a network policy that allows only the IP address 192.168.1.100 and blocks all other IP addresses using the CIDR notation 0.0.0.0/01. It then applies the network policy to the user ABC, who has the ACCOUNTADMIN role. This ensures that only this user can access the Snowflake account from the specified IP address, while blocking their access from anywhere else. Option A does not block any other IP addresses, option B applies the network policy to the role instead of the user, and option D uses an invalid CIDR notation.
質問 # 49
When adding secure views to a share in Snowflake, which function is needed to authorize users from another account to access rows in a base table?
- A. CURRENT_CLIENT
- B. CURRENT_USER
- C. CURRENT_ROLE
- D. CURRENT ACCOUNT
正解：B
解説：
According to the Working with Secure Views documentation, secure views are designed to limit access to sensitive data that should not be exposed to all users of the underlying table(s). When sharing secure views with another account, the view definition must include a function that returns the identity of the user who is querying the view, such as CURRENT_USER, CURRENT_ROLE, or CURRENT_ACCOUNT. These functions can be used to filter the rows in the base table based on the user's identity. For example, a secure view can use the CURRENT_USER function to compare the user name with a column in the base table that contains the authorized user names. Only the rows that match the user name will be returned by the view. The CURRENT_CLIENT function is not suitable for this purpose, because it returns the IP address of the client that is connected to Snowflake, which is not related to the user's identity.
質問 # 50
In general, the monthly billing for database replication is proportional to which variables? (Select TWO).
- A. The amount of table data in the primary database that changes as a result of data loading or DML operations
- B. The frequency of the secondary database refreshes from the primary database
- C. The number and size of warehouses defined in the primary account
- D. The number of times data moves across regions and/or cloud service providers between the primary and secondary database accounts
- E. The frequency of changes to the primary database as a result of data loading or DML operations
正解：A、E
解説：
Snowflake charges for database replication based on two categories: data transfer and compute resources1. Data transfer costs depend on the amount of data that is transferred from the primary database to the secondary database across regions and/or cloud service providers2. Compute resource costs depend on the use of Snowflake-provided compute resources to copy data between accounts across regions1. Both data transfer and compute resource costs are proportional to the frequency and amount of changes to the primary database as a result of data loading or DML operations3. Therefore, the answer is A and B. The other options are not directly related to the replication billing, as the frequency of secondary database refreshes does not affect the amount of data transferred or copied4, and the number and size of warehouses defined in the primary account do not affect the replication process5.
質問 # 51
Which command can temporarily disable Multi-factor Authentication (MFA) for the Snowflake username user1 for 24 hours?
- A. alter user userl set DISABLE_MFA=1440;
- B. alter user userl set MINS_TO_BYPASS_MFA=1440;
- C. alter user userl set TEMPORARY_MFA_BYPASS=1440;
- D. alter user userl set HOURS_TO_BYPASS_MFA=24;
正解：B
解説：
According to the Snowflake documentation1, the MINS_TO_BYPASS_MFA property specifies the number of minutes to temporarily disable MFA for a user so that they can log in without the temporary token generated by the Duo Mobile application. After the time passes, MFA is enforced and the user cannot log in without the token. Therefore, to disable MFA for 24 hours, the value of this property should be set to 1440 minutes (24 x 60). Option B is incorrect because the DISABLE_MFA property is a boolean value that permanently disables MFA for a user, not a numeric value that specifies the duration. Option C is incorrect because there is no such property as TEMPORARY_MFA_BYPASS in Snowflake. Option D is incorrect because there is no such property as HOURS_TO_BYPASS_MFA in Snowflake.
質問 # 52
What is required for stages, without credentials, to limit data exfiltration after a storage integration and associated stages are created?
- A. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = true;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = true;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = false; - B. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = false;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = false;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = false; - C. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = false;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = false;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = true; - D. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = true;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION FOR STAGE_OPERATION = true;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = true;
正解：D
解説：
According to the Snowflake documentation1, stages without credentials are a way to create external stages that use storage integrations to access data files in cloud storage without providing any credentials to Snowflake. Storage integrations are objects that define a trust relationship between Snowflake and a cloud provider, allowing Snowflake to authenticate and authorize access to the cloud storage. To limit data exfiltration after a storage integration and associated stages are created, the following account-level parameters can be set:
* REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION: This parameter enforces that all external stages must be created using a storage integration. This prevents users from creating external stages with inline credentials or URLs that point to unauthorized locations.
* REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION: This parameter enforces that all operations on external stages, such as PUT, GET, COPY, and LIST, must use a storage integration. This prevents users from performing operations on external stages with inline credentials or URLs that point to unauthorized locations.
* PREVENT_UNLOAD_TO_INLINE_URL: This parameter prevents users from unloading data from Snowflake tables to inline URLs that do not use a storage integration. This prevents users from exporting data to unauthorized locations.
Therefore, the correct answer is option D, which sets all these parameters to true. Option A is incorrect because it sets PREVENT_UNLOAD_TO_INLINE_URL to false, which allows users to unload data to inline URLs that do not use a storage integration. Option B is incorrect because it sets both REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION to false, which allows users to create and operate on external stages without using a storage integration. Option C is incorrect because it sets all the parameters to false, which does not enforce any restrictions on data exfiltration.
質問 # 53
Which tasks can be performed by the ORGADMIN role? (Select THREE).
- A. Perform zero-copy cloning on account data.
- B. View usage information for all accounts in the organization.
- C. Create a reader account to share data with another organization.
- D. View a list of all regions enabled for the organization.
- E. Create secure views on application tables within the organization.
- F. Create one or more accounts in the organization.
正解：B、D、F
解説：
A user with the ORGADMIN role can perform the following tasks1:
* Create one or more accounts in the organization.
* View a list of all regions enabled for the organization.
* View usage information for all accounts in the organization.
Option C is incorrect because creating secure views on application tables is not a function of the ORGADMIN role, but rather a function of the roles that have access to the tables and schemas within the accounts. Option E is incorrect because performing zero-copy cloning on account data is not a function of the ORGADMIN role, but rather a function of the roles that have the CLONE privilege on the objects within the accounts. Option F is incorrect because creating a reader account to share data with another organization is not a function of the ORGADMIN role, but rather a function of the roles that have the CREATE SHARE privilege on the objects within the accounts.
質問 # 54
An Administrator is evaluating a complex query using the EXPLAIN command. The Globalstats operation indicates 500 partitionsAssigned.
The Administrator then runs the query to completion and opens the Query Profile. They notice that the partitions scanned value is 429.
Why might the actual partitions scanned be lower than the estimate from the EXPLAIN output?
- A. Runtime optimizations such as join pruning can reduce the number of partitions and bytes scanned during query execution.
- B. The EXPLAIN results always include a 10-15% safety factor in order to provide conservative estimates.
- C. The GlobalStats partition assignment includes the micro-partitions that will be assigned for preservation of the query results.
- D. In-flight data compression will result in fewer micro-partitions being scanned at the virtual warehouse layer than were identified at the storage layer.
正解：A
解説：
The EXPLAIN command returns the logical execution plan for a query, which shows the upper bound estimates for the number of partitions and bytes that might be scanned by the query1. However, these estimates do not account for the runtime optimizations that Snowflake performs to improve the query performance and reduce the resource consumption2. One of these optimizations is join pruning, which eliminates unnecessary partitions from the join inputs based on the join predicates2. This can result in fewer partitions and bytes scanned than the estimates from the EXPLAIN output3. Therefore, the actual partitions scanned value in the Query Profile can be lower than the partitionsAssigned value in the EXPLAIN output4.
質問 # 55
What roles can be used to create network policies within Snowflake accounts? (Select THREE).
- A. Any role with the global permission of CREATE NETWORK POLICY
- B. SYSADMIN
- C. ACCOUNTADMIN
- D. ORGADMIN
- E. Any role that owns the database where the network policy is created
- F. SECURITYADMIN
正解：A、C、F
解説：
Network policies are used to restrict access to the Snowflake service and internal stages based on user IP address1. To create network policies, a role must have the global permission of CREATE NETWORK POLICY2. By default, the system-defined roles of SECURITYADMIN and ACCOUNTADMIN have this permission3. However, any other role can be granted this permission by an administrator4. Therefore, the answer is B, C, and E. The other options are incorrect because SYSADMIN and ORGADMIN do not have the CREATE NETWORK POLICY permission by default3, and network policies are not tied to specific databases5.
質問 # 56
A virtual warehouse report_wh is configured with AUTO_RESUME=TRUE and AUTO_SUSPEND=300. A user has been granted the role accountant.
An application with the accountant role should use this warehouse to run financial reports, and should keep track of compute credits used by the warehouse.
What minimal privileges on the warehouse should be granted to the role to meet the requirements for the application? (Select TWO).
- A. MONITOR
- B. MODIFY
- C. OPERATE
- D. OWNERSHIP
- E. USAGE
正解：A、E
解説：
According to the Snowflake documentation1, the MONITOR privilege on a warehouse grants the ability to view the warehouse usage and performance metrics, such as the number of credits consumed, the average and maximum run time, and the number of queries executed. The USAGE privilege on a warehouse grants the ability to use the warehouse to execute queries and load data. Therefore, the minimal privileges on the warehouse that should be granted to the role to meet the requirements for the application are MONITOR and USAGE. Option A is incorrect because the OPERATE privilege on a warehouse grants the ability to start, stop, resume, and suspend the warehouse, which is not required for the application. Option B is incorrect because the MODIFY privilege on a warehouse grants the ability to alter the warehouse properties, such as the size, auto-suspend, and auto-resume settings, which is not required for the application. Option E is incorrect because the OWNERSHIP privilege on a warehouse grants the ability to drop the warehouse, grant or revoke privileges on the warehouse, and transfer the ownership to another role, which is not required for the application.
質問 # 57
An Administrator wants to delegate the administration of a company's data exchange to users who do not have access to the ACCOUNTADMIN role.
How can this requirement be met?
- A. Grant modify on data exchange EXCHANGE_NAME to ROLE_NAME;
- B. Grant ownership on data exchange EXCHANGE_NAME to ROLE NAME;
- C. Grant imported privileges on data exchange EXCHANGE_NAME to ROLE_NAME;
- D. Grant usage on data exchange EXCHANGE_NAME to ROLE_NAME;
正解：A
解説：
Explanation
According to the [GRANT MODIFY] documentation, the MODIFY privilege on a data exchange allows a role to perform administrative tasks on the data exchange, such as inviting members, approving profiles, and reviewing listings. This privilege can be granted by the ACCOUNTADMIN role or a role that already has the MODIFY privilege on the data exchange. Therefore, to delegate the administration of a company's data exchange to users who do not have access to the ACCOUNTADMIN role, the best option is to grant the MODIFY privilege on the data exchange to a role that the users can assume. The other options are incorrect because:
*A. There is no such privilege as IMPORTED PRIVILEGES in Snowflake. The correct privilege name is IMPORT SHARE, which allows a role to create a database from a share. This privilege is not related to the administration of a data exchange, but to the consumption of shared data.
*C. There is no such privilege as OWNERSHIP in Snowflake. The correct privilege name is OWNED BY, which indicates the role that owns an object and has full control over it. However, this privilege cannot be granted or revoked, but only transferred by the current owner to another role using the GRANT OWNERSHIP command. Therefore, this option is not feasible for delegating the administration of a data exchange.
*D. The USAGE privilege on a data exchange allows a role to access the data exchange and view the available data listings. This privilege does not allow a role to perform administrative tasks on the data exchange, such as inviting members, approving profiles, and reviewing listings. Therefore, this option is not sufficient for delegating the administration of a data exchange.
質問 # 58
......
ADA-C01別格な問題集で最上級の成績にさせるADA-C01問題：https://jp.fast2test.com/ADA-C01-premium-file.html