Snowflake SnowPro Specialty - Native Apps : NAS-C01 Exam

In a Snowflake Native Application, you are using Streamlit to present data to different user roles. You need to dynamically adjust the Streamlit UI based on the user's privileges. Specifically, if a user has the 'MODIFY' privilege on a particular table, you want to display an 'Edit' button. Otherwise, the button should be hidden. Assuming you are already connected to Snowflake via Streamlit and have the user's role information, which of the following approaches is the most secure and efficient way to determine if the current user's role has the 'MODIFY' privilege on the 'MY TABLE table in the 'MY SCHEMA' schema? (Select two)

• A. Execute the SQL query SELECT HAS PRIVILEGE('MODIFY', 'TABLE', 'MY SCHEMA.MY TABLE')' as the application role. If the result is 'TRUE', then the application role has privilege.
• B. If this hypothetical function return 'TRUE', then the user_role has privilege. Execute the SQL query: 'SELECT COUNT( ) FROM INFORMATION SCHEMA.TABLE PRIVILEGES WHERE GRANTEE = CURRENT ROLE() AND TABLE_SCHEMA = 'MY_SCHEMA' AND TABLE_NAME = 'MY_TABLE' AND PRIVILEGE = 'MODIFY". Check if the count is greater than 0.
• C. Implement a custom stored procedure in Snowflake that encapsulates the privilege check logic. Call this stored procedure from Streamlit, passing the schema, table, and privilege name as parameters. Ensure the stored procedure runs with caller's rights.
• D. Execute the SQL query SELECT CURRENT ROLE()' to fetch the user's current role, then execute 'SHOW GRANTS TO ROLE and parse the output in Python to check for the 'MODIFY privilege on '
• E. Utilize the 'snowflake.permissions' module (if it existed) and call a hypothetical function like 'MY TABLE', 'MY_SCHEMA', user_role)'.

A data science team is developing a Native App on Snowflake that requires access to data from multiple customer accounts (Reader Accounts). They need to ensure strict data governance and minimize the risk of data leakage. Which of the following approaches provides the MOST secure and scalable solution for accessing and managing this cross-account data?

• A. Utilize secure data sharing with data clean rooms, exposing the required datasets via views on each data clean room.
• B. Create a shared database from each consumer account containing views over the required tables, granting SELECT privileges on these views to the application role.
• C. Grant SELECT privileges directly to the application role on all relevant tables in the consumer accounts.
• D. Package the data extraction logic directly into the Native App using User-Defined Functions (UDFs) that establish secure connections to each consumer account using separate credentials stored securely within the application package.
• E. Implement a data access service within the Native App that uses external functions to query data from consumer accounts, relying on network policies for security.

You are developing a Snowflake Native Application that utilizes the 'APPLICATION ROLE' within a secure data sharing context. The application needs to perform different actions based on the role assigned to the user accessing the shared dat a. Consider the following code snippet in a stored procedure:

Which of the following modifications is necessary for the stored procedure to correctly utilize the 'APPLICATION ROLE and function as intended within the context of a Snowflake Native Application and a share?

• A. No modification is needed. The function will automatically return the active 'APPLICATION_ROLE' within the share.
• B.
  
• C.
  
• D.
  
• E.
  

A Snowflake Native Application developer wants to ensure that a specific stored procedure, 'UPDATE CUSTOMER STATUS, within their application can only be executed by users who have been granted the 'CUSTOMER ADMIN' role in the consumer's account. How can the developer enforce this authorization check within the stored procedure's code?

• A. Implement a custom function that calls 'SYSTEM$GET PRIVILEGES()' and checks if the user executing the stored procedure possesses the 'CUSTOMER ADMIN' role.
• B. Use the function within the stored procedure to verify that the 'CUSTOMER_ADMIN' role is currently active in the session. If not, raise an error.
• C. Grant the 'EXECUTE privilege on the stored procedure only to the 'CUSTOMER_ADMIN' role in the consumer's account.
• D. Utilize the 'SESSION CONTEXT()' function to check for a specific context variable set only when a user with the 'CUSTOMER ADMIN' role is connected.
• E. Use the 'CURRENT ROLE()' function within the stored procedure to check if the current role is 'CUSTOMER ADMIN'. If not, raise an error.

You've built a Snowflake Native Application that processes data and exposes a set of stored procedures to the consumer. You're implementing a CI/CD pipeline using GitLab CI/CD for deploying updates. Your pipeline includes the following stages: linting, unit testing, integration testing, and deployment to a staging environment. During the integration testing stage, you want to verify that the exposed stored procedures function correctly against a representative dataset. What is the MOST effective approach for performing these integration tests?

• A. Execute the stored procedures directly from the GitLab CIICD runner using a Snowflake connection established with hardcoded credentials in the CI/CD configuration.
• B. Mock the Snowflake environment entirely within the GitLab CI/CD runner and execute the stored procedures against the mock environment. This eliminates the need for a live Snowflake connection during testing.
• C. Create a separate set of stored procedures within the application package specifically for testing purposes. These procedures should mimic the functionality of the production stored procedures and assert their behavior.
• D. Use the application's setup script to automatically create a test database populated with sample data when the application is installed. Integration tests can then run queries in this database to ensure the application functions correctly.
• E. Provision a dedicated Snowflake testing account with a representative dataset. Install the application version in this account and execute the stored procedures from within the account using Snowflake's SQL API or a Snowpark Python test framework.