Snowflake ARA-C01: Accounts and Security Practice Questions

ACCESS_HISTORY (available on Business Critical and higher) records the base objects accessed by each query, including the specific columns that were read (projected), not just the table. It captures direct object access and lineage down to the column level, making it the correct view for this use case. QUERY_HISTORY records query text and metadata (execution time, bytes scanned, etc.) but does not enumerate which specific columns were accessed. LOGIN_HISTORY tracks authentication events, not data access. OBJECT_DEPENDENCIES tracks compile-time dependencies between objects (e.g., views referencing tables), not runtime column-level access.

IS_ROLE_IN_SESSION('DATA_STEWARD') is the correct context function for conditional masking because it returns TRUE if the DATA_STEWARD role is anywhere in the active role hierarchy of the querying session, accounting for role inheritance. CURRENT_ROLE() returns only the primary role active in the session and would fail if DATA_STEWARD is a secondary or inherited role, making it too narrow for hierarchical RBAC. INVOKER_ROLE() is not a valid Snowflake function. CHECK_ROLE_ACCESS() does not exist in Snowflake's function library.

UNDROP SCHEMA SCHEMA_NAME is the correct command. Snowflake's UNDROP command restores a dropped schema (and all its child tables, views, and other objects) from Time Travel within the retention period. Because the schema was dropped only 10 minutes ago and the retention is 3 days, UNDROP works immediately. The SELECT … AT syntax allows querying historical data but does not restore dropped objects. CLONE … AT can create a new clone of a historical object state, but it does not restore the original schema in place—it creates a copy. RESTORE … FROM FAILSAFE is not valid Snowflake syntax; Fail-safe recovery requires contacting Snowflake Support and cannot be initiated by the user.

GCP Private Service Connect (PSC) provides a private network path between a customer's VPC and Snowflake's GCP endpoint, ensuring traffic never traverses the public internet—exactly what the policy requires. A network policy IP allowlist restricts who can connect but still routes traffic over the public internet. AWS PrivateLink is an AWS-specific service and cannot be used for GCP-hosted Snowflake accounts. TLS encryption secures data in transit but does not change the routing path; traffic still crosses the public internet.

SCIM (System for Cross-domain Identity Management) is the correct choice because it automates the lifecycle management of users and groups—including provisioning, attribute updates, and deprovisioning—by synchronizing directly with the IdP. SAML 2.0 SSO enables federated authentication but does not automate user provisioning; accounts must still be manually created in Snowflake. OAuth 2.0 is an authorization delegation protocol, not a user provisioning mechanism. Key-pair authentication addresses how a user authenticates, not how user accounts are created or removed.