Try Snowflake : NAS-C01 valid & accurate questions and answers

You are developing a Snowflake Native Application that requires specific roles to be assigned to consumers upon installation. Your setup script needs to automatically create these roles if they don't exist and grant appropriate privileges on application objects. Which of the following approaches is the MOST secure and efficient way to achieve this, assuming you want to minimize the attack surface?

• A. Use a UDF to create the roles and grant privileges. This UDF should be owned by the application and be executed with CALLER's rights.
• B. Hardcode the role names in the setup script and create them using a stored procedure executed with the 'OWNER privilege. Then, grant the necessary privileges to those roles.
• C. Use a 'CREATE ROLE IF NOT EXISTS' statement within the setup script, followed by 'GRANT statements using the 'APPLICATION' keyword to avoid granting privileges directly to the role within the provider account.
• D. Dynamically generate SQL statements within the setup script based on a configuration table stored within the application package, then execute these statements to create the roles and grant privileges.
• E. Instruct consumers to manually create the roles and grant privileges after installation, providing them with a separate documentation file containing the necessary SQL commands.

You are developing a Snowflake Native Application that requires access to an external API to enrich data within the consumer's account. You need to implement secure authentication and authorization to this external API. Which of the following methods provide the MOST secure and compliant approach for storing and managing the API credentials within your Snowflake Native Application package, while minimizing the risk of exposure to the consumer?

• A. Store the API credentials in a secure configuration table within your application package, encrypted using a symmetric key managed by Snowflake's KMS.
• B. Prompt the consumer to provide the API credentials during the application installation process, storing them in a secure configuration table within their account and referencing them from your application through secure views.
• C. Store the API credentials as environment variables within the Snowflake function code that calls the API. These variables are automatically encrypted by Snowflake.
• D. Store the API credentials as a secret within Snowflake's Secret Management feature, referencing the secret from within your application's functions. Grant access to the secret through the application role.
• E. Store the API credentials as plain text within the setup script, as this script is only executed once during installation and is not accessible to consumers.

You are developing a Snowflake Native Application that requires access to a specific stage in the consumer's account to read configuration files. The application needs to be able to create temporary files in the same stage during its execution. Which set of privileges needs to be granted on the stage to the application's service account, and how do you grant them?

• A. Grant READ and WRITE privileges on the stage to the application's service account using the 'GRANT USAGE ON INTEGRATION TO APPLICATION command.
• B. Grant OWNERSHIP on the stage to the application's service account. No other privileges are required.
• C. Grant READ and WRITE privileges on the stage using Snowsight, and ensure the application uses a service integration with appropriate permissions.
• D. Grant USAGE and READ privileges on the stage and CREATE FILE on the schema containing the stage to the application's service account using Snowsight.
• E. Grant USAGE on the database, USAGE on the schema containing the stage, and READ and WRITE privileges on the stage to the application's service account using a combination of SQL commands and Snowsight.

You are creating a Snowflake Native Application that includes a stored procedure to process sensitive dat a. The procedure needs to access data from a table owned by the application package and write processed data to a table in the consumer's account. The data in the consumer's table must only be accessible by authorized roles within the consumer's account, not directly by the application itself. Which of the following approaches ensures the MOST secure and controlled access to the consumer's data?

• A. Store the processed data in an intermediate stage accessible to both the application and the consumer.
• B. Create a secure view on the consumer's table and grant the APPLICATION' role 'SELECT privileges on the view.
• C. Implement an API endpoint within the application package that the consumer can call to retrieve the processed data.
• D. Grant the 'APPLICATION' role direct 'SELECT and 'INSERT privileges on the consumer's table.
• E. Use the EXECUTE AS CALLER clause for the stored procedure, requiring the consumer to grant the necessary privileges to a role that executes the procedure.

You are designing a Snowflake Native Application that provides a data enrichment service. Consumers provide their data via a secure data share, and your application enriches it with external datasets within your provider account. To ensure data security and prevent accidental data leakage, which of the following strategies should you implement when designing the application's logic (select all that apply)?

• A. Log all data access and modifications performed by the application, including the user context (application role), timestamps, and objects accessed, for auditing purposes.
• B. Create a dedicated service user within your provider account with restricted privileges to access the shared data. The application's logic should execute using this service user's context.
• C. Use fully qualified names when referencing objects within the consumer's shared data (e.g.,
• D. Grant the consumer's application role 'OWNERSHIP' privilege on the data share. This simplifies data management for the consumer.
• E. Implement strict input validation and sanitization of the data received from the consumer to prevent SQL injection or other malicious attacks that could lead to data exfiltration.