Snowflake : NAS-C01 Questions & Answers

Snowflake NAS-C01 Exam Syllabus Topics:

Snowflake SnowPro Specialty - Native Apps Sample Questions:

Question 1

You are developing a Snowflake Native Application that needs to be deployed across multiple consumer accounts. The application relies on a secure external function (SEF) for real-time data enrichment. The SEF interacts with a third-party API secured with OAuth 2.0. What are the MOST important considerations when designing the setup script for this application to ensure seamless deployment and security in the consumer accounts?

A. The setup script should explicitly create a new API integration with the consumer's credentials, separate from the provider's account. Consumer will manually update credentials.
B. The setup script should create an API integration referencing a secret object in the consumer account, allowing the consumer to inject their own credentials post- installation.
C. The setup script should pre-configure the API integration in the provider account and securely share the credentials with consumer accounts during the installation process.
D. The setup script should attempt to automatically create the API integration using the provider's credentials, but gracefully handle failures if the consumer's account lacks necessary privileges.
E. The setup script should include instructions for the consumer to manually create and configure the API integration using their own OAuth 2.0 credentials after the application is installed.

Question 2

You are developing a Snowflake Native App that requires specific privileges to access data in the consumer's account. In your manifest file, you want to request these privileges. Which of the following statements best describes the correct way to request these privileges within the 'privileges' section of the manifest file?

A. You can only request privileges for future grants. Existing object grants are not supported in manifest file.
B. Specify a list of required privileges under the 'privileges' section, detailing the specific objects (databases, schemas, tables) and actions (SELECT, INSERT, UPDATE) the application needs to perform.
C. Privileges are automatically granted to the application based on the roles specified in the application code. No explicit declaration is needed in the manifest file.
D. Privileges are managed entirely through the application's setup scripts. The manifest file does not play a role in privilege management.
E. Use the 'allowed_roles' section in the manifest to list the roles that are allowed to access data in the consumer's account, Snowflake automatically grants necessary privileges to these roles.

Question 3

You are developing a Snowflake Native Application that utilizes Snowpark Container Services to perform complex image processing. The application needs to securely access data stored in the consumer's Snowflake account, specifically a table named 'USER IMAGES' in the schema 'RAW DATA'. The container image is built and pushed to Snowflake's internal registry. Which of the following steps are necessary to ensure the container service can access this data securely and efficiently within the consumer's account without exposing credentials directly in the container environment?

A. Configure a Snowflake OAuth integration and associate it with the container service. The container application would then use the OAuth client credentials to obtain an access token and authenticate with Snowflake.
B. Create a Snowflake service account and grant it SELECT privileges on the 'RAW DATA.USER IMAGES table. Store the service account's credentials as environment variables within the container service's specification.
C. Create a Snowflake network rule that allows access to all Snowflake internal IPs. Associate this rule with the container service's network policy.
D. Grant the SNOWFLAKE CONTAINER SERVICE role to the account administrator and use the administrator's credentials within the container service's code.
E. Create a Snowflake database role, grant SELECT privileges on ' to this role, and then assign this role to the service account used by the container service through an entitlement.

Question 4

You are developing a Snowflake Native Application. During internal testing, you need to simulate different consumer account environments to validate the application's behavior under various conditions (e.g., different Snowflake editions, security configurations). What are the recommended methods for setting up these test environments WITHIN the constraints of the Snowflake Native App framework?

A. Create multiple Snowflake accounts, each representing a different consumer environment, and install the application in each account.
B. Develop a configuration file within the application that allows you to simulate different consumer environments. Implement logic in the application code to adapt to these simulated environments.
C. Employ multiple developer accounts with different configurations to simulate consumer environments, package your application from each account and test it. Additionally, use parameters within the setup script to configure application behavior.
D. Use Snowflake's cloning capabilities to create multiple clones of your developer account, each with different configurations, and install the application in each clone.
E. Utilize Snowflake's Resource Monitors to limit the resources available to the application, simulating a consumer environment with limited compute.

Question 5

A Snowflake Native Application is being developed. The application requires access to a third-party API to enrich dat a. To securely store the API key, the developer plans to use a Secret object within Snowflake. Which of the following steps are necessary to grant the application, specifically an application role named 'data_processor' , the ability to read this Secret object? (Choose three)

A. Grant the READ privilege on the Secret object to the 'data_processor' application role.
B. Grant the USAGE privilege on the secret object to the 'APPLICATION PACKAGE.
C. Grant the OWNERSHIP privilege on the Secret object to the 'data_processor' application role.
D. The 'data_processor' application role automatically inherits privileges for accessing Secrets defined within the application package.
E. Grant the USAGE privilege on the Secret object to the 'data_processor' application role.

Solutions: