Passing exam with NAS-C01 latest training materials

A Snowflake Native Application provider is deploying their application in multiple regions (AWS US-East-l and AWS EU-Central-l). The application relies on external functions that interact with a third-party API. The provider wants to optimize for both latency and cost while ensuring high availability. Which of the following strategies represents the MOST effective approach for configuring and deploying these external functions to meet these requirements? Select two.

• A. Utilize Snowflake's cross-region replication feature to automatically replicate the external functions between regions. This ensures that the functions are always available in both regions.
• B. Create a single external function that uses a conditional statement to route requests to different API endpoints based on the Snowflake region where the function is being called. This approach reduces management overhead.
• C. Configure a global load balancer in front of the third-party API endpoints and point all external functions to the load balancer's endpoint. This allows the load balancer to route requests to the closest available API endpoint.
• D. Host the external function code directly within the Snowflake application package and leverage Snowflake's serverless compute to execute the function logic without relying on external APIs.
• E. Deploy separate external functions in each region, pointing to API endpoints hosted in the respective regions. Configure each external function with the same security integration to simplify access management.

In a Snowflake Native Application, you are using Streamlit to present data to different user roles. You need to dynamically adjust the Streamlit UI based on the user's privileges. Specifically, if a user has the 'MODIFY' privilege on a particular table, you want to display an 'Edit' button. Otherwise, the button should be hidden. Assuming you are already connected to Snowflake via Streamlit and have the user's role information, which of the following approaches is the most secure and efficient way to determine if the current user's role has the 'MODIFY' privilege on the 'MY TABLE table in the 'MY SCHEMA' schema? (Select two)

• A. Execute the SQL query SELECT HAS PRIVILEGE('MODIFY', 'TABLE', 'MY SCHEMA.MY TABLE')' as the application role. If the result is 'TRUE', then the application role has privilege.
• B. Implement a custom stored procedure in Snowflake that encapsulates the privilege check logic. Call this stored procedure from Streamlit, passing the schema, table, and privilege name as parameters. Ensure the stored procedure runs with caller's rights.
• C. Utilize the 'snowflake.permissions' module (if it existed) and call a hypothetical function like 'MY TABLE', 'MY_SCHEMA', user_role)'.
• D. Execute the SQL query SELECT CURRENT ROLE()' to fetch the user's current role, then execute 'SHOW GRANTS TO ROLE and parse the output in Python to check for the 'MODIFY privilege on '
• E. If this hypothetical function return 'TRUE', then the user_role has privilege. Execute the SQL query: 'SELECT COUNT( ) FROM INFORMATION SCHEMA.TABLE PRIVILEGES WHERE GRANTEE = CURRENT ROLE() AND TABLE_SCHEMA = 'MY_SCHEMA' AND TABLE_NAME = 'MY_TABLE' AND PRIVILEGE = 'MODIFY". Check if the count is greater than 0.

You are designing a Snowflake Native App that interacts with sensitive customer dat a. You need to ensure that the application only accesses the data it absolutely needs and adheres to the principle of least privilege. Which of the following strategies are crucial for maintaining data security within your application?

• A. Create specific roles with granular access privileges (e.g., 'SELECT on specific columns) and grant these roles to the application's managed service account.
• B. Implement data masking policies to redact sensitive information before it's accessed by the application.
• C. Utilize Snowflake's secure UDFs with invoker's rights to perform data transformations and access control based on the user's role.
• D. Grant the application role the 'OWNERSHIP' privilege on all tables containing customer data.
• E. Store sensitive customer data directly within the application package to avoid external access.

A Snowflake Native App developer is designing the upgrade process for their application. They need to ensure that data stored in the application's managed tables is preserved during the upgrade and that the application remains functional throughout the upgrade process. Which of the following strategies should the developer implement to achieve these goals? (Select TWO)

• A. Utilize Snowflake's data sharing capabilities to create a read-only replica of the application's data for the new version to access during the upgrade.
• B. Implement a versioning system for the application's metadata using the ' APPLICATION VERSION' construct, ensuring that the new version can handle data from previous versions.
• C. Design the application's data model to be backward-compatible, allowing the new version to read and write data in the format used by previous versions. Use 'ALTER TABLE to add new columns or modify existing ones without breaking existing functionality.
• D. Before upgrading, unload all data from the application's tables to cloud storage, and then reload the data into the new version after the upgrade is complete.
• E. Use the 'DROP TABLE command with the 'CASCADE' option to remove all tables and views before deploying the new version of the application.

You are developing a Snowflake Native App that processes sensitive customer dat a. Your app needs to access data from a table owned by the consumer and write transformed data back to another table also owned by the consumer. To ensure data privacy and security, you decide to use a secure view for accessing the customer data and a stored procedure for writing the transformed data.
However, you are facing issues with privilege escalation when the stored procedure tries to access the secure view. The stored procedure is defined with the 'EXECUTE AS CALLER clause. Which of the following steps can you take to mitigate this privilege escalation issue and ensure secure data access?

• A. Change the stored procedure to run with the 'EXECUTE AS OWNER clause. Ensure the consumer grants 'IMPORTED PRIVILEGES' on their database to your application. Create a database role owned by the application and grant USAGE on database to it and SELECT on secure view to the database role.
• B. Change the stored procedure to run with the 'EXECUTE AS OWNER clause. Ensure the consumer grants 'IMPORTED PRIVILEGES' on their database to your application. Create a database role owned by the application and grant USAGE on database to it and SELECT on secure view to the database role. Also, grant the consumer database ownership to the application.
• C. Grant the 'APPLY MASKING POLICY privilege on the customer data table to the application role. Define masking policies on the sensitive columns of the customer data table.
• D. Grant the 'EXECUTE MANAGED TASK' privilege to the application role. Change the stored procedure to run with the 'EXECUTE AS OWNER clause. Ensure consumer grants 'IMPORTED PRIVILEGES' on their database to your application.
• E. Revoke the 'SELECT privilege on the secure view from the application role. Grant the 'SELECT' privilege on the secure view directly to the stored procedure using the 'GRANT ... TO PROCEDURE syntax.