Snowflake Updated ADA-C02 Exam Questions and Answers by erik

Snowflake Dynamic Data Masking enforces column-level protection at query execution time. Masking policies determine whether the querying context receives the original value or a transformed representation.

Option B is correct because the same masking policy can be assigned to multiple compatible columns across different tables or views. This supports centralized governance and consistent protection of sensitive fields throughout an environment.

Option C is also correct. Snowflake supports assigning a masking policy to an external table's automatically generated VALUE column. The policy must accept and return the VARIANT data type, and the assignment must be performed using an ALTER TABLE statement rather than during initial external-table creation.

Option A is incorrect because a masking policy cannot normally be dropped while it remains associated with a column or tag. The administrator must first remove the applicable assignment.

Option D is incorrect because creating a policy does not automatically authorize viewing unmasked data. Visibility depends on the policy expression and execution context.

Option E is incorrect because a masking policy's argument and return signatures impose data-type compatibility requirements. One policy cannot be freely attached to columns of unrelated types.

This distinction is important when implementing reusable policies and managing external data.

Official Snowflake references: Understanding Column-level Security; DROP MASKING POLICY; Tag-based Masking Policies.

Core Concept: Privileges on Cloned Databases & Schemas

Under Snowflake's access control and cloning model:

Container vs. Child Objects:

When a database or schema is cloned, the container itself does not inherit privileges granted on the source container.

However, the clone inherits all granted privileges on all child objects contained within the source container.

For a database clone, contained child objects include schemas, tables, views, etc.

Explanation of Correct Choices

E. SELECT on all tables and views in DatabaseA_clone.Schema1: Tables and views within Schema1 are child objects of DatabaseA. All existing SELECT grants held by ANALYST on these tables and views are automatically replicated to their cloned counterparts.

B. USAGE on the database DatabaseA_clone.Schema1: Because Schema1 is a child object contained within the source database DatabaseA, privileges granted on Schema1 (such as USAGE) carry over to the clone. (Note: In this specific SnowPro Advanced exam question, the phrasing in options A and B inverts the labels "schema" and "database", with Option B designating the child schema DatabaseA_clone.Schema1 ).

Why the Other Options Are Incorrect

A is incorrect: The container itself (DatabaseA_clone) does not inherit any grants (such as USAGE) from DatabaseA. An administrator must explicitly grant USAGE ON DATABASE DatabaseA_clone TO ROLE ANALYST.

C and D are incorrect: Snowflake's privilege cloning does not distinguish between secure and non-secure views. All view grants are inherited equally regardless of whether the SECURE keyword is applied.

Practical Operational Note

Even though the ANALYST role possesses the object-level SELECT privileges on the tables/views and USAGE on Schema1 in the clone, queries will fail at runtime until a role with appropriate rights grants USAGE on the top-level parent container DatabaseA_clone to complete the privilege access hierarchy.

Snowflake resource monitors enforce credit-consumption controls through configurable quotas, reset intervals, start timestamps, and threshold-triggered actions.

Option B is the intended configuration because it specifies a 3,000-credit quota, a YEARLY reset frequency, an explicit January 1 start timestamp, and the three required actions.

At 80%, the NOTIFY action generates alerts for administrators who have enabled resource-monitor notifications without suspending the warehouse.

At 100%, SUSPEND prevents new query execution while allowing statements already running to complete. Snowflake also generates the associated suspension notifications.

At 120%, SUSPEND_IMMEDIATE cancels executing statements and suspends the assigned warehouse immediately, generating additional notifications.

Option A omits FREQUENCY despite defining START_TIMESTAMP. Snowflake requires the two scheduling parameters to be specified together for a customized schedule.

Option C omits FREQUENCY and uses unsupported combined actions such as DO NOTIFY AND SUSPEND.

Option D specifies YEARLY but omits the required START_TIMESTAMP.

The ALTER WAREHOUSE statement is necessary because creating a resource monitor does not automatically assign it to a warehouse.

Outdated exhibit warning: The January 1, 2022 timestamp is historical. For deployment in a current environment, the administrator should use an appropriate valid calendar-year start date rather than execute the sample unchanged. Notification delivery must also be enabled for the relevant administrators.

Official Snowflake references: CREATE RESOURCE MONITOR; Working with Resource Monitors — Schedules, Actions, and Notifications.

Snowflake resource monitors provide administrative controls for tracking virtual warehouse credit consumption and responding when configured thresholds are reached.

Option C is correct because resource monitors track consumption through Snowflake's account-management infrastructure rather than executing monitoring queries on the assigned virtual warehouses. Consequently, their monitoring activity does not impose additional workload on warehouse compute.

Option D is correct because a resource monitor supports multiple configurable triggers. Administrators can specify percentage thresholds that initiate notifications, suspend warehouses after running statements complete, or immediately suspend warehouses and cancel executing statements.

Option F is correct because a warehouse-level resource monitor can be assigned to multiple virtual warehouses. Their combined credit consumption is evaluated against the monitor's quota.

Option A is incorrect because Snowflake does not define the claimed daily monitoring charge.

Option B is incorrect because an individual virtual warehouse can be assigned to only one warehouse-level resource monitor.

Option E is incorrect as written. Although resource-monitor creation is restricted to ACCOUNTADMIN, Snowflake does not document the proposed CREATE MONITOR privilege as an alternative authorization mechanism for creating resource monitors. MONITOR and MODIFY are separate privileges that can be granted on existing resource monitors.

Official Snowflake references: Working with Resource Monitors; CREATE RESOURCE MONITOR.