Snowflake SnowPro Specialty - Native Apps Sample Questions:

1. A Snowflake Native App provider wants to grant a consumer access to a secure view within their application. The provider's application package is named and the secure view is named 'sensitive_data_view'. The consumer's account identifier is 'XYZ12345'. Which of the following is the MOST secure and appropriate method to grant this access using Snowflake's Native App Framework?

A) Create a role within the application package, grant SELECT on sensitive_data_view to the role, and create an authorization grant to account XYZ12345 for that role.
B) Grant imported privileges on my_app_package to share with account XYZI 2345;
C) Grant USAGE on database containing sensitive_data_view to account XYZI 2345;
D) Create a share and grant SELECT on sensitive_data_view to the share, then grant usage on the share to account XYZI 2345;
E) Grant SELECT on sensitive data view to account XYZ12345;

2. You are developing a Snowflake Native App that needs to perform asynchronous tasks in the consumer's account. Which of the following approaches is the MOST suitable and secure way to achieve this, ensuring minimal impact on the consumer's resources and maintaining data integrity?

A) The Native App can create task and warehouse in the consumer account to execute the code using CREATE APPLICATION command. The application uses SNOWFLAKE.CORE.AUTHZ.PASS PRIVILEGES() to execute these tasks.
B) Implement a Snowpark UDF that starts a new thread to handle the asynchronous task within the consumer's compute environment.
C) Create a Snowflake Task that is executed within the consumer's account, triggered by events within the application, and configured to run on a Snowflake-managed compute pool.
D) Utilize an external message queue (e.g., AWS SQS, Azure Queue Storage) to offload asynchronous tasks, requiring the consumer to configure network policies to allow egress traffic to the queue.
E) Implement a scheduled stored procedure that polls for new tasks every minute and processes them, potentially consuming significant compute resources in the consumer's account. The stored procedure is deployed in the consumer's account using CREATE APPLICATION.

3. You are developing a Native App on Snowflake that needs to interact with an external REST API. To ensure proper security, you want to store the API key securely within the application package and use it for authentication. Which of the following is the MOST secure and RECOMMENDED method to accomplish this?

A) Create a key-pair stored procedure. Storing the API key as a secret, then decrypting the key during each API call.
B) Store the API key as a secret using Snowflake's Secret Management feature and reference it within a secure UDE
C) Store the API key in a secure stage with encryption and grant SELECT privilege to the application role.
D) Hardcode the API key directly into the application code within a UDF (User-Defined Function).
E) Store the API key in a table within the application database with minimal access control, relying on Snowflake's data encryption at rest.

4. You are designing the setup script for a Snowflake Native Application. This application requires the creation of several views based on data residing in the consumer's account. These views need to be dynamically created based on a configuration table that is part of your application package. The configuration table contains view names, the underlying tables in the consumer's account, and the specific SQL queries for each view. The design must adhere to best practices for security and data governance. Which approach would you use for designing this setup script, considering security vulnerabilities and execution context?

A) Use dynamic SQL generation with proper escaping functions (e.g., to prevent SQL injection. Store the generated SQL in a temporary table, and then execute each statement from the temporary table using 'EXECUTE IMMEDIATE
B) Create a series of static 'CREATE VIEW' statements within the setup script, each targeting a predefined table in the consumer's account. The application will handle data filtering within these views.
C) Directly construct and execute the 'CREATE VIEW' statements within the setup script using string concatenation, reading the view definitions from the configuration table. This minimizes code complexity and ensures immediate view creation.
D) Employ parameterized SQL (using '?' 7 placeholders) within the 'CREATE VIEW' statements, binding the view names and queries read from the configuration table. Execute these statements using 'EXECUTE IMMEDIATE to prevent SQL injection vulnerabilities.
E) Use a stored procedure, owned by the application, to dynamically generate and execute the 'CREATE VIEW statements. The stored procedure reads the view definitions from the configuration table and creates the views using dynamic SQL.

5. You are developing a Snowflake Native Application that includes a Python module for data transformation. This module relies on the pandas' and 'requests' libraries. You are using an 'environment.yml' file to manage dependencies. Which of the following 'environment.yml' configurations is the MOST secure and correct way to define these dependencies for your application? Assume you want to install these packages directly from conda-forge channel.

A)

B)

C)

D)

E)

Solutions: