1. A Snowflake architect is designing a solution where three separate business units—Finance, Marketing, and Operations—each need isolated compute with no cross-billing visibility, but must all query a shared central Data Vault in the same Snowflake account. Each business unit should only pay for its own warehouse usage. Additionally, Finance has a strict regulatory requirement that its query results must never be accessible to Marketing or Operations users, even accidentally. Which combination of Snowflake features BEST satisfies ALL of these requirements? (Select TWO)
- A. Create one virtual warehouse per business unit and use Resource Monitors scoped to each warehouse to isolate cost reporting and enforce credit limits per unit✓ Correct
- B. Place all three business units in a single virtual warehouse and use Row Access Policies to separate their data views
- C. Use Role-Based Access Control (RBAC) with separate roles per business unit, granting each role access only to the schemas and views relevant to that unit, to prevent cross-unit data exposure✓ Correct
- D. Enable Tri-Secret Secure on the Finance warehouse so that Marketing cannot decrypt Finance query results cached in the result cache
- E. Create three separate Snowflake accounts—one per business unit—and use cross-account data sharing for the central Data Vault
Explanation
Option A is correct: creating one virtual warehouse per business unit and attaching a Resource Monitor to each warehouse gives precise compute cost attribution and credit limit enforcement per unit—this directly satisfies the isolated billing requirement. Option C is correct: using RBAC with distinct roles per business unit—granting each role only the necessary privileges on specific schemas or views—is the standard Snowflake mechanism to ensure Finance results and objects are never visible to Marketing or Operations users, satisfying the data isolation requirement. Option B is wrong because sharing a single warehouse defeats cost isolation (all usage rolls up to one warehouse) and Row Access Policies alone do not address billing separation. Option D is wrong because Tri-Secret Secure is an encryption-at-rest feature requiring a customer-managed key; it does not control result cache access between roles within the same account—RBAC already prevents unauthorized cache access. Option E is wrong because separate accounts would technically work for isolation but would introduce significant operational overhead, and the question asks for the solution within the same account context as described.