Snowflake NAS-C01 Actual Tests : SnowPro Specialty - Native Apps

Your Snowflake Native App includes a JavaScript UDF that processes data from a secure view provided by the provider account. During consumer testing, the UDF fails with an 'Authorization error' even though the consumer has been granted the necessary USAGE privileges on the application package. What is the MOST likely cause of this error, and how can you resolve it within the context of a Snowflake Native App?

• A. The application package needs to be explicitly authorized to access secure views in the provider account. This requires a manifest update and resubmission of the package.
• B. The consumer's role does not have the OWNERSHIP privilege on the application object. Assign the OWNERSHIP privilege to the consumer's role.
• C. The secure view in the provider account has data masking policies applied that prevent the UDF from accessing the data. Remove the masking policies.
• D. The UDF is not declared as SECURE, preventing it from accessing objects in a different security context. Declare the UDF as SECURE.
• E. The consumer lacks the necessary permissions on the underlying tables referenced by the secure view in the provider account. Grant the consumer direct access to these tables.

A Snowflake Native App provider wants to implement row-level security (RLS) in an event table to ensure that consumers only receive events pertaining to their specific organization, even if they have been granted USAGE on the event table function. How can this be achieved?

• A. Implement a custom stored procedure that acts as a proxy for accessing the event table, filtering data based on the consumer's user ID.
• B. Create a view on top of the event table that includes a WHERE clause filtering by APP INSTANCE ID() and grant access to the view instead of the base table.
• C. Row-level security cannot be enforced on event tables shared through Snowflake Native Apps due to security limitations.
• D. Create a masking policy that filters rows in the event table based on the CURRENT_ACCOUNT() function to match the consumer's account ID.
• E. Create a row access policy that filters rows in the event table based on the APP_INSTANCE_ID() function, ensuring each consumer only sees events related to their application instance.

You are building a Snowflake Native Application that offers a data enrichment service. You want to automate the fulfillment of new customer trials. When a customer installs your application from the Marketplace, you want to automatically provision them with a limited dataset and compute resources for a 30-day trial period. Which of the following Snowflake features and implementation steps are essential for achieving this auto-fulfillment strategy? (Choose two)

• A. Implement a webhook endpoint within your Native Application that listens for installation events from the Snowflake Marketplace and triggers the provisioning process.
• B. Employ Snowflake's Event Tables to capture installation events and trigger a stored procedure within the Native App to provision the trial environment.
• C. Leverage Snowflake's Marketplace Auto-Fulfillment API to automatically create a dedicated share for each customer, granting them access to the limited dataset.
• D. Use Snowflake's Resource Monitors to automatically limit the credit usage for each trial customer account.
• E. Utilize Snowflake's External Functions to call an external auto-fulfillment service (e.g., AWS Lambda) that handles the provisioning logic.

You are developing a Snowflake Native Application that requires access to a specific stage in the consumer's account to read configuration files. The application needs to be able to create temporary files in the same stage during its execution. Which set of privileges needs to be granted on the stage to the application's service account, and how do you grant them?

• A. Grant READ and WRITE privileges on the stage to the application's service account using the 'GRANT USAGE ON INTEGRATION TO APPLICATION command.
• B. Grant USAGE on the database, USAGE on the schema containing the stage, and READ and WRITE privileges on the stage to the application's service account using a combination of SQL commands and Snowsight.
• C. Grant USAGE and READ privileges on the stage and CREATE FILE on the schema containing the stage to the application's service account using Snowsight.
• D. Grant OWNERSHIP on the stage to the application's service account. No other privileges are required.
• E. Grant READ and WRITE privileges on the stage using Snowsight, and ensure the application uses a service integration with appropriate permissions.

You are packaging a Snowflake Native App and need to ensure that consumer accounts can only access specific data views you've created within your application schem a. You want to prevent consumers from directly querying the underlying tables. Which of the following security measures, when implemented together, BEST achieve this objective? (Choose two)

• A. Grant 'SELECT privilege only on the views to the 'application role' within the application package.
• B. Use secure views to expose data, ensuring data access is controlled through the view's definition.
• C. Grant 'SELECT' privilege on the underlying tables to the 'application role' within the application package.
• D. Grant "OWNERSHIP' on the views to the 'application role' within the application package.
• E. Do not grant any privileges on the underlying tables to the 'application role' within the application package.