Snowflake SnowPro Specialty - Native Apps Sample Questions:

1. You are developing a Snowflake Native Application that allows customers to enrich their dat a. The application involves executing Javascript UDFs. Which of the following practices are considered unacceptable regarding code practices within the UDFs to ensure the Native App complies with Snowflake's requirements and security best practices?

A) Directly embedding secrets (e.g., API keys, passwords) within the Javascript UDF code itself, even if obfuscated.
B) Relying solely on the consumer's network policy to manage external network access from the UDFs.
C) Using JavaScript's eval() function to dynamically execute code based on user input or data retrieved from external sources.
D) Using the SYSTEM$ALLOWLIST function to restrict external network access from the Javascript UDFs to a specific set of approved domains. Using Snowflake's network rules is also acceptable for newer accounts.
E) Using Javascript UDFs to access data not needed by the application to save on querying costs.

2. You are developing a Native App on Snowflake that needs to interact with an external REST API. To ensure proper security, you want to store the API key securely within the application package and use it for authentication. Which of the following is the MOST secure and RECOMMENDED method to accomplish this?

A) Store the API key in a table within the application database with minimal access control, relying on Snowflake's data encryption at rest.
B) Store the API key as a secret using Snowflake's Secret Management feature and reference it within a secure UDE
C) Create a key-pair stored procedure. Storing the API key as a secret, then decrypting the key during each API call.
D) Store the API key in a secure stage with encryption and grant SELECT privilege to the application role.
E) Hardcode the API key directly into the application code within a UDF (User-Defined Function).

3. A Native Application developer is creating a data product to be sold on the Snowflake Marketplace. The application needs read access to a shared database called 'RETAIL DATA'. The application logic includes a function that reads a lookup table, 'PRODUCT CATEGORIES', within this shared database. Which sequence of actions, executed by the application provider, ensures the application can access this table at installation time and after updates, following least privilege principles?

A) Grant 'SELECT on to the application role during the application's setup script. Do not grant 'IMPORTED PRIVILEGES' on the database.
B) Grant USAGE on ' RETAIL_DATX to the application role during the application's setup script. Do not grant 'IMPORTED PRIVILEGES' on the database.
C) Grant 'IMPORTED PRIVILEGES' on 'RETAIL DATA to the application role. Rely on the consumer to grant 'SELECT access to tables within 'RETAIL DATA' to the application role.
D) Grant 'IMPORTED PRIVILEGES' on to the application role. Grant 'SELECT on to the application role during the application's setup script.
E) Grant 'IMPORTED PRIVILEGES' on 'RETAIL DATA' to the application role. The application setup script should also GRANT USAGE on database RETAIL_DATA and then GRANT SELECT on to the application role.

4. You are developing a Snowflake Native Application that utilizes a custom stage for storing large intermediate datasets during processing. Your CI/CD pipeline involves automated testing in a dedicated testing account. To ensure proper isolation and prevent interference with production data, how should you configure the stage path within your application package version definition, considering the stage name might differ between development and test environments?

A) Employ a versioned configuration file (e.g., YAML) within the application package. The CI/CD pipeline should replace placeholders in the configuration file with environment-specific stage paths before creating the version.
B) Utilize Snowflake's and 'CURRENT functions in conjunction with conditional logic within the application to derive the stage path based on the environment.
C) Use a Snowflake Secret to store the stage path and retrieve it dynamically during application installation. The secret's value will be environment-specific.
D) Define the stage path as a parameter in the application installation script. When installing the application in each environment, pass the correct stage path as an argument.
E) Hardcode the stage name and path directly within the setup script of the version. This approach is simple and ensures consistent access across environments.

5. You are developing a Snowflake Native Application that processes sensitive financial data. You need to implement robust logging and auditing to comply with regulatory requirements. Which of the following strategies would provide the MOST secure and comprehensive auditing and logging solution within the context of a Snowflake Native App?

A) Rely solely on Snowflake's ACCOUNT_USAGE views and information schema tables within the consumer account.
B) Implement logging to an external service such as AWS CloudWatch or Azure Monitor, streaming data directly from UDFs using external functions. Implement data redaction within the UDFs before sending data externally.
C) Utilize Snowflake's Event Tables to capture application events. Ensure proper role-based access control is in place to restrict access to the event data within the provider account. Masking and Row Access policies should be applied before writing to event tables.
D) Implement custom logging using UDFs that write directly to a table accessible only within the provider account. Use masking policies to protect sensitive data before logging.
E) Use Snowflake's stages to write the event logs and then create the external table on top of it to process the data.

Solutions: