A directory table in Snowflake is an implicit object layered on a stage, whether internal or external. It allows users to query the contents of a stage as if it were a table, providing metadata about the files stored in the stage, such as filenames, file sizes, and last modified timestamps.

Snowflake Documentation: Directory Tables

The correct answer is D. The USAGE privilege on the database and the schema .

To query a table in Snowflake, a role needs the SELECT privilege on the table. In addition, the role must have USAGE on the containing database and schema so it can resolve and access the object path.

Why D is correct:

For a table named:

database1.schema1.table1

A role generally needs:

USAGE ON DATABASE database1

USAGE ON SCHEMA database1.schema1

SELECT ON TABLE database1.schema1.table1

Without USAGE on the database and schema, the role cannot access the namespace that contains the table, even if SELECT exists on the table.

Why the other options are incorrect:

A. There is no USAGE privilege on a table for this purpose. SELECT is the table-level privilege needed to read data.

B. OWNERSHIP on the schema is not required to query a table.

C. REFERENCES is used for foreign key/reference-related behavior and is not required for simple SELECT queries.

Official Snowflake documentation reference:

Snowflake documentation explains that access to objects requires privileges on the object and appropriate USAGE privileges on parent containers, such as the database and schema.

The correct answer is B. Restrict access to Snowflake to known networks using a network policy .

A network policy improves account access security by allowing or blocking access based on IP address ranges. This helps ensure that users can connect to Snowflake only from approved networks.

Why B is correct:

Network policies can restrict inbound access to Snowflake by defining allowed and blocked IP address ranges. This is a direct security control for user access to a Snowflake account.

Example concept:

CREATE NETWORK POLICY corp_network_policy

ALLOWED_IP_LIST = ( ' 203.0.113.0/24 ' );

ALTER ACCOUNT SET NETWORK_POLICY = corp_network_policy;

Why the other options are incorrect:

A. A UDF is not the correct tool for managing account access security. Monitoring security parameters may provide visibility, but it does not directly restrict access.

C. A short session timeout can reduce risk from idle sessions, but making it “very short” can harm usability and is not as direct as network restrictions.

D. Every user already has access to the PUBLIC role by default. Setting restrictive permissions on PUBLIC is good practice, but it is not as direct as restricting access through a network policy.

Official Snowflake documentation reference:

Snowflake documentation describes network policies as security controls that restrict access to Snowflake based on allowed and blocked IP address lists.

Snowpipe via REST API can reference both named internal stages within Snowflake and external stages, suchas Amazon S3, Google Cloud Storage, or Microsoft Azure1. This means that Snowpipe is not limited to only external stages as a source for data loading.

References = [COF-C02] SnowPro Core Certification Exam Study Guide, Snowflake Documentation1

 Snowflake automatically rotates the Account and Table master keys when they are more than 30 days old. Active keys are retired, and new keys are created, ensuring robust security through frequent key changes1

The search optimization service and automatic clustering are features that can improve the performance of queries returning a small subset of rows from a large table. The search optimization service is designed for low-latency point lookup queries, while automatic clustering organizes data in micro-partitions based on specific dimensions to reduce the amount of data scanned during queries.

Snowflake recommends using columns with very high cardinality and those that are most actively used in selective filters as clustering keys. High cardinality columns have a wide range of unique values, which helps in evenly distributing the data across micro-partitions. Columns used in selective filters help in pruning the number of micro-partitions to scan, thus improving query performance. References: Based on general database optimization principles.

The VARIANT data type in Snowflake can store multiple types of data structures, as it is designed to hold semi-structured data. It can contain any other data type, including OBJECT and ARRAY, which allows it to represent various data structures

Snowflake integrates Duo Security to support Multi-Factor Authentication (MFA). This feature provides increased login security for users connecting to Snowflake, and it is managed completely by Snowflake without the need for users to sign up separately with Duo4.

Multi-cluster virtual warehouses in Snowflake are designed to manage user and query concurrency needs. They allow for the allocation of additional clusters of compute resources, either statically or dynamically, to handle increased loads and reduce or eliminate the queuing of concurrent queries2.

https://docs.snowflake.com/en/user-guide/warehouses-multicluster.html#:~:text=Multi%2Dcluster%20warehouses%20enable%20you,during%20peak%20and%20off%20hours.

The Snowflake Cloud Services layer coordinates activities within the Snowflake account. It is responsible for tasks such as authentication, infrastructure management, metadata management, query parsing and optimization, and access control. References: Based on general cloud database architecture knowledge.

 In Snowflake, a namespace is comprised of a database and a schema. The combination of a database and schema uniquely identifies database objects within an account

Worksheets in Snowsight can be shared directly with other Snowflake users within the same account. This feature allows for collaboration and sharing of SQL queries or Python code, as well as other data manipulation tasks1.

 The GET command is used to download files from a Snowflake stage to a local folder on a client’s machine2.

When publishing a Snowflake Data Marketplace listing into a remote region, it’s important to note that while the listing is replicated into all selected regions automatically, the data itself is not.Therefore, the data must be replicated separately. Additionally, the user must have the ORGADMIN role in at least one account to manage the replication of accounts1.