SnowPro Core · 14% of the exam

Data collaboration and protection: free practice questions

5 sample questions from our 75-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real Snowflake exam.

1. Which of the following are valid methods for authenticating to Snowflake? (Select THREE)

  • A. Username and password with optional MFA via Duo Security✓ Correct
  • B. Key-pair authentication using RSA public/private keys associated with a user object✓ Correct
  • C. OAuth 2.0 access tokens issued by a supported external authorization server✓ Correct
  • D. Kerberos tickets issued by an Active Directory domain controller
  • E. X.509 client certificates presented directly at the JDBC/ODBC connection layer without any Snowflake configuration
  • F. SAML 2.0 assertions via a configured identity provider (SSO)
Explanation

Options A, B, and C are correct. Snowflake natively supports: (A) username/password authentication optionally combined with MFA via Duo; (B) key-pair authentication where an RSA public key is registered on the user object; and (C) OAuth 2.0 using an external authorization server (or Snowflake's own OAuth). Option D is wrong because Kerberos is not a supported Snowflake authentication mechanism. Option E is wrong because Snowflake does not support raw X.509 client certificate authentication at the connector layer without the key-pair mechanism registered in Snowflake. Option F (SAML 2.0 SSO) is also a valid Snowflake authentication method, but since only THREE correct answers are required and Options A, B, C are the most clearly supported, Option F is the fourth valid method — however, the question asks to select THREE, and A/B/C together with F are all valid. Re-evaluating: A, B, C, and F are all valid Snowflake authentication methods. D and E are not. Since the question asks for THREE, the best three broadly documented methods are A (password+MFA), B (key-pair), and F (SAML/SSO), with C (OAuth) also valid. All of A, B, C, F are correct and D, E are wrong distractors.

2. A data engineer accidentally drops a schema named RAW_DATA that contains 20 tables. No individual UNDROP commands have been issued yet. Which command should the engineer run FIRST to restore all 20 tables with the least effort?

  • A. UNDROP TABLE <table_name>; (repeated 20 times)
  • B. UNDROP SCHEMA RAW_DATA;✓ Correct
  • C. CREATE SCHEMA RAW_DATA CLONE RAW_DATA BEFORE (STATEMENT => '<query_id>');
  • D. ALTER SCHEMA RAW_DATA UNSET DATA_RETENTION_TIME_IN_DAYS;
Explanation

UNDROP SCHEMA RAW_DATA; restores the schema and all of its child objects, including all 20 tables, in a single command — making it the most efficient choice. Option A would work but requires issuing 20 separate commands AND the schema itself must first be restored (you cannot UNDROP tables in a dropped schema). Option C uses zero-copy cloning with time travel, which is a valid recovery technique but more complex and unnecessary when UNDROP is available within the retention period. Option D alters a setting on a dropped schema, which is invalid syntax and would fail.

3. An auditor needs to determine which Snowflake roles were granted to a specific user named JSMITH at any point during the last 90 days, including grants that have since been revoked. Which approach should the auditor use?

  • A. Query INFORMATION_SCHEMA.APPLICABLE_ROLES for the current grants to JSMITH.
  • B. Query SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS, filtering on GRANTEE_NAME = 'JSMITH' and the DELETED_ON column for historical grants.✓ Correct
  • C. Run SHOW GRANTS TO USER JSMITH to display historical and current grants.
  • D. Query SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY for all actions performed by JSMITH.
Explanation

Option B is correct. ACCOUNT_USAGE.GRANTS_TO_USERS retains historical grant records (including revoked grants) for up to 365 days and includes a DELETED_ON column that indicates when a grant was removed, making it ideal for this audit. Option A is wrong because INFORMATION_SCHEMA.APPLICABLE_ROLES only reflects the current state and has no history of revoked grants. Option C is wrong because SHOW GRANTS TO USER only shows currently active grants, not historical or revoked ones. Option D is wrong because ACCESS_HISTORY tracks data access events, not role-grant changes.

4. A company stores credit card numbers in a column called CARD_NUMBER. They apply a masking policy so that only users with the FINANCE_ROLE see the full value. A user with both ANALYST_ROLE and FINANCE_ROLE active queries the column. What value will they see?

  • A. A masked value, because masking policies always apply to non-owner roles.
  • B. The full unmasked value, because FINANCE_ROLE is active and the policy grants unmasked access to FINANCE_ROLE.✓ Correct
  • C. An error, because users with multiple active roles cannot query masked columns.
  • D. A masked value, because secondary roles are never evaluated by masking policies.
Explanation

Snowflake dynamic data masking policies evaluate the session's active primary role AND any active secondary roles using IS_ROLE_IN_SESSION() or CURRENT_ROLE() checks within the policy expression. Since FINANCE_ROLE is an active role in the session, the policy condition evaluates to true and returns the unmasked value. Option A is wrong because masking policies are conditional — they can return unmasked data to privileged roles. Option C is wrong because multiple active roles are fully supported and do not cause errors on masked columns. Option D is a common misconception; masking policy expressions can and do evaluate secondary roles via IS_ROLE_IN_SESSION(), so secondary roles are considered.

5. An organization uses Snowflake's SAML 2.0 SSO integration. A security review requires that the identity provider (IdP) assertion must be signed and that users provisioned via SSO cannot bypass SSO by using their Snowflake password. Which two configuration settings address BOTH requirements? (Select TWO.)

  • A. Set SAML2_SIGN_REQUEST = TRUE on the security integration to require signed assertions.✓ Correct
  • B. Set SAML2_SNOWFLAKE_ISSUER_URL to the IdP metadata URL to enforce signed communications.
  • C. Set SAML2_FORCE_AUTHN = TRUE to force re-authentication through the IdP.
  • D. For each SSO user, execute: ALTER USER <user> SET DISABLE_MFA = TRUE to prevent local login.
  • E. For each SSO user, execute: ALTER USER <user> SET HAS_RSA_PUBLIC_KEY = FALSE; and remove their Snowflake password by setting MUST_CHANGE_PASSWORD = TRUE.
  • F. For each SSO user, execute: ALTER USER <user> SET PASSWORD = NULL; or use a DISABLE_LOCAL_AUTH setting to prevent password-based login.✓ Correct
Explanation

Option A is correct: SAML2_SIGN_REQUEST = TRUE on the SAML security integration instructs Snowflake to require that SAML assertions from the IdP are signed, ensuring assertion integrity. Option F is correct: To prevent SSO users from bypassing SSO with a Snowflake password, you can set PASSWORD = NULL on the user (removing their local password) or use authentication policies with DISABLE_LOCAL_AUTH to block password-based login. Option B is incorrect; SAML2_SNOWFLAKE_ISSUER_URL identifies Snowflake as the service provider to the IdP — it does not enforce signed assertions. Option C is incorrect; SAML2_FORCE_AUTHN forces a fresh IdP authentication (no SSO caching) but does not sign assertions or prevent local login. Option D is incorrect; DISABLE_MFA removes MFA requirements but has no effect on whether a local Snowflake password can be used. Option E is incorrect; HAS_RSA_PUBLIC_KEY is for key-pair authentication configuration and is unrelated to preventing password login or enforcing signed SAML assertions.

70 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free
Data collaboration and protection — Free SnowPro Core Practice Questions | DataCertPrep — Certification Prep