Get Latest [Dec-2025] Conduct effective penetration tests using PassTorrent ADA-C01
Penetration testers simulate ADA-C01 exam PDF
Snowflake ADA-C01 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 21
An Administrator has a user who needs to be able to suspend and resume a task based on the current virtual warehouse load, but this user should not be able to modify the task or start a new run.
What privileges should be granted to the user to meet these requirements? (Select TWO).
- A. OPERATE on the task
- B. OWNERSHIP on the task
- C. EXECUTE TASK on the task
- D. USAGE on the database and schema containing the task
- E. OWNERSHIP on the database and schema containing the task
Answer: A,D
Explanation:
Explanation
The user needs the OPERATE privilege on the task to suspend and resume it, and the USAGE privilege on the database and schema containing the task to access it1. The EXECUTE TASK privilege is not required for suspending and resuming a task, only for triggering a new run1. The OWNERSHIP privilege on the task or the database and schema would allow the user to modify or drop the task, which is not desired.
NEW QUESTION # 22
An Administrator has been asked to support the company's application team need to build a loyalty program for its customers. The customer table contains Personal Identifiable Information (PII), and the application team's role is DEVELOPER.
CREATE TABLE customer_data (
customer_first_name string,
customer_last_name string,
customer_address string,
customer_email string,
... some other columns,
);
The application team would like to access the customer data, but the email field must be obfuscated.
How can the Administrator protect the sensitive information, while maintaining the usability of the data?
- A. Create a separate table for all the non-Pll columns and grant the role DEVELOPER access to the new table.
- B. Use the CURRENT_ROLE and CURRENT_USER context functions to integrate with a secure view and filter the sensitive data.
- C. Create a view on the customer_data table to eliminate the email column by omitting it from the SELECT clause. Grant the role DEVELOPER access to the view.
- D. Use the CURRENT_ROLE context function to integrate with a masking policy on the fields that contain sensitive data.
Answer: D
NEW QUESTION # 23
An Administrator has a user who needs to be able to suspend and resume a task based on the current virtual warehouse load, but this user should not be able to modify the task or start a new run.
What privileges should be granted to the user to meet these requirements? (Select TWO).
- A. OPERATE on the task
- B. OWNERSHIP on the task
- C. EXECUTE TASK on the task
- D. USAGE on the database and schema containing the task
- E. OWNERSHIP on the database and schema containing the task
Answer: A,D
NEW QUESTION # 24
Which commands can be performed by a user with the ORGADMIN role but not the ACCOUNTADMIN role? (Select TWO).
- A. SELECT SYSTEM$GLOBAL_ACCOUNT_SET_PARAMETER (
- B. SHOW USERS;
- C. SHOW REGIONS;
- D. SHOW ORGANIZATION ACCOUNTS;
- E. GRANT ROLE ORGADMIN TO USER <username>;
Answer: A,D
Explanation:
'ACCOUNT LOCATOR',
'ENABLE ACCOUNT DATABASE_REPLICATION',
'true'
);
Explanation:
According to the Snowflake documentation1, the ORGADMIN role is a special system role that is responsible for managing operations at the organization level, such as creating and viewing accounts, enabling database replication, and setting global account parameters. The ACCOUNTADMIN role is a system role that is responsible for managing operations at the account level, such as creating and managing users, roles, warehouses, databases, and shares. Therefore, the commands that can be performed by the ORGADMIN role but not the ACCOUNTADMIN role are:
* SHOW ORGANIZATION ACCOUNTS: This command lists all the accounts in the organization and their properties, such as region, edition, and status2. The ACCOUNTADMIN role can only show the current account and its properties using the SHOW ACCOUNTS command3.
* SELECT SYSTEM$GLOBAL_ACCOUNT_SET_PARAMETER: This function sets a global account parameter for an account in the organization, such as enabling account database replication4. The ACCOUNTADMIN role can only set local account parameters using the ALTER ACCOUNT command.
Option A is incorrect because the SHOW REGIONS command can be executed by any role, not just the ORGADMIN role. Option B is incorrect because the SHOW USERS command can be executed by the ACCOUNTADMIN role, as well as any role that has been granted the MONITOR privilege on the account. Option D is incorrect because the GRANT ROLE ORGADMIN TO USER <username> command can be executed by the ACCOUNTADMIN role, as well as any role that has been granted the ORGADMIN role1.
NEW QUESTION # 25
What access control policy will be put into place when future grants are assigned to both database and schema objects?
- A. An access policy combining both the database object and the schema object will be used, with the most permissive policy taking precedence.
- B. An access policy combining both the database object and the schema object will be used, with the most restrictive policy taking precedence.
- C. Schema privileges will take precedence over database privileges.
- D. Database privileges will take precedence over schema privileges.
Answer: C
Explanation:
Explanation
When future grants are defined on the same object type for a database and a schema in the same database, the schema-level grants take precedence over the database level grants, and the database level grants are ignored4.
This behavior applies to privileges on future objects granted to one role or different roles4. Future grants allow defining an initial set of privileges to grant on new (i.e. future) objects of a certain type in a database or a schema3. As soon as the new objects are created inside the database or schema, the predefined set of privileges are assigned to the object automatically without any manual intervention3.
NEW QUESTION # 26
If the query matches the definition, will Snowflake always dynamically rewrite the query to use a materialized view?
- A. No, because the materialized view may not be up-to-date.
- B. No, because the optimizer might decide against it.
- C. Yes, because materialized views are always faster.
- D. No, because joins are not supported by materialized views.
Answer: B
Explanation:
Explanation
Snowflake's query optimizer can automatically rewrite queries against the base table or regular views to use the materialized view instead, if the query matches the definition of the materialized view1. However, this is not always guaranteed, as the optimizer might decide against using the materialized view based on various factors, such as the freshness of the data, the size of the result set, the complexity of the query, and the availability of the materialized view2. Therefore, the answer is no, because the optimizer might decide against it.
NEW QUESTION # 27
What is required for stages, without credentials, to limit data exfiltration after a storage integration and associated stages are created?
- A. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = false;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = false;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = true; - B. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = true;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION FOR STAGE_OPERATION = true;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = true; - C. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = true;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = true;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = false; - D. ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = false;
ALTER ACCOUNT my_account SET
REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = false;
ALTER ACCOUNT my_account SET
PREVENT_UNLOAD_TO_INLINE_URL = false;
Answer: B
Explanation:
According to the Snowflake documentation1, stages without credentials are a way to create external stages that use storage integrations to access data files in cloud storage without providing any credentials to Snowflake. Storage integrations are objects that define a trust relationship between Snowflake and a cloud provider, allowing Snowflake to authenticate and authorize access to the cloud storage. To limit data exfiltration after a storage integration and associated stages are created, the following account-level parameters can be set:
* REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION: This parameter enforces that all external stages must be created using a storage integration. This prevents users from creating external stages with inline credentials or URLs that point to unauthorized locations.
* REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION: This parameter enforces that all operations on external stages, such as PUT, GET, COPY, and LIST, must use a storage integration. This prevents users from performing operations on external stages with inline credentials or URLs that point to unauthorized locations.
* PREVENT_UNLOAD_TO_INLINE_URL: This parameter prevents users from unloading data from Snowflake tables to inline URLs that do not use a storage integration. This prevents users from exporting data to unauthorized locations.
Therefore, the correct answer is option D, which sets all these parameters to true. Option A is incorrect because it sets PREVENT_UNLOAD_TO_INLINE_URL to false, which allows users to unload data to inline URLs that do not use a storage integration. Option B is incorrect because it sets both REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION to false, which allows users to create and operate on external stages without using a storage integration. Option C is incorrect because it sets all the parameters to false, which does not enforce any restrictions on data exfiltration.
NEW QUESTION # 28
What role or roles should be used to properly create the object required to setup OAuth 2.0 integration?
- A. Any role with GRANT USAGE on SECURITY INTEGRATION
- B. ACCOUNTADMIN only
- C. ACCOUNTADMIN and SECURITYADMIN
- D. ACCOUNTADMIN and SYSADMIN
Answer: B
Explanation:
Explanation
According to the Using OAuth 2.0 with Snowflake - Blog, only the ACCOUNTADMIN role can create and manage integrations, so an administrator must assume that role when creating a security integration for OAuth.
The other roles do not have the necessary privileges to create the object required to setup OAuth 2.0 integration.
NEW QUESTION # 29
Which Snowflake objects can be managed using SCIM integration? (Select TWO).
- A. Roles
- B. Stages
- C. Warehouses
- D. Shares
- E. Users
Answer: A,E
Explanation:
A SCIM security integration allows the automated management of user identities and groups (i.e. roles) by creating an interface between Snowflake and a third-party Identity Provider (IdP)1. Snowflake supports SCIM integration with Okta, Azure, and custom SCIM clients2. SCIM integration does not support managing other Snowflake objects, such as stages, warehouses, or shares3. Therefore, the answer is B. Users and D. Roles.
NEW QUESTION # 30
What roles can be used to create network policies within Snowflake accounts? (Select THREE).
- A. ACCOUNTADMIN
- B. Any role that owns the database where the network policy is created
- C. SECURITYADMIN
- D. Any role with the global permission of CREATE NETWORK POLICY
- E. SYSADMIN
- F. ORGADMIN
Answer: A,C,D
Explanation:
Network policies are used to restrict access to the Snowflake service and internal stages based on user IP address1. To create network policies, a role must have the global permission of CREATE NETWORK POLICY2. By default, the system-defined roles of SECURITYADMIN and ACCOUNTADMIN have this permission3. However, any other role can be granted this permission by an administrator4. Therefore, the answer is B, C, and E. The other options are incorrect because SYSADMIN and ORGADMIN do not have the CREATE NETWORK POLICY permission by default3, and network policies are not tied to specific databases5.
NEW QUESTION # 31
How should an Administrator configure a Snowflake account to use AWS PrivateLink?
- A. Block public access to Snowflake.
- B. Contact Snowflake Support.
- C. Create CNAME records in the DNS.
- D. Use SnowCD to evaluate the network connection.
Answer: C
Explanation:
To configure a Snowflake account to use AWS PrivateLink, the Administrator needs to create CNAME records in the DNS that point to the private endpoints provided by Snowflake. This allows the clients to connect to Snowflake using the same URL as before, but with private connectivity. According to the Snowflake documentation, "After you have created the VPC endpoints, Snowflake provides you with a list of private endpoints for your account. You must create CNAME records in your DNS that point to these private endpoints. The CNAME records must use the same hostnames as the original Snowflake URLs for your account." The other options are either incorrect or not sufficient to configure AWS PrivateLink. Option B is not necessary, as the Administrator can enable AWS PrivateLink using the SYSTEM$AUTHORIZE_PRIVATELINK function1. Option C is not recommended, as it may prevent some data traffic from reaching Snowflake, such as large result sets stored on AWS S32. Option D is not related to AWS PrivateLink, but to Snowflake Connectivity Diagnostic (SnowCD), which is a tool for diagnosing network issues between clients and Snowflake3.
NEW QUESTION # 32
In general, the monthly billing for database replication is proportional to which variables? (Select TWO).
- A. The amount of table data in the primary database that changes as a result of data loading or DML operations
- B. The number and size of warehouses defined in the primary account
- C. The frequency of changes to the primary database as a result of data loading or DML operations
- D. The frequency of the secondary database refreshes from the primary database
- E. The number of times data moves across regions and/or cloud service providers between the primary and secondary database accounts
Answer: A,C
Explanation:
Snowflake charges for database replication based on two categories: data transfer and compute resources1. Data transfer costs depend on the amount of data that is transferred from the primary database to the secondary database across regions and/or cloud service providers2. Compute resource costs depend on the use of Snowflake-provided compute resources to copy data between accounts across regions1. Both data transfer and compute resource costs are proportional to the frequency and amount of changes to the primary database as a result of data loading or DML operations3.
Therefore, the answer is A and B. The other options are not directly related to the replication billing, as the frequency of secondary database refreshes does not affect the amount of data transferred or copied4, and the number and size of warehouses defined in the primary account do not affect the replication process5.
NEW QUESTION # 33
An Administrator wants to delegate the administration of a company's data exchange to users who do not have access to the ACCOUNTADMIN role.
How can this requirement be met?
- A. Grant modify on data exchange EXCHANGE_NAME to ROLE_NAME;
- B. Grant ownership on data exchange EXCHANGE_NAME to ROLE NAME;
- C. Grant usage on data exchange EXCHANGE_NAME to ROLE_NAME;
- D. Grant imported privileges on data exchange EXCHANGE_NAME to ROLE_NAME;
Answer: A
Explanation:
Explanation
According to the [GRANT MODIFY] documentation, the MODIFY privilege on a data exchange allows a role to perform administrative tasks on the data exchange, such as inviting members, approving profiles, and reviewing listings. This privilege can be granted by the ACCOUNTADMIN role or a role that already has the MODIFY privilege on the data exchange. Therefore, to delegate the administration of a company's data exchange to users who do not have access to the ACCOUNTADMIN role, the best option is to grant the MODIFY privilege on the data exchange to a role that the users can assume. The other options are incorrect because:
*A. There is no such privilege as IMPORTED PRIVILEGES in Snowflake. The correct privilege name is IMPORT SHARE, which allows a role to create a database from a share. This privilege is not related to the administration of a data exchange, but to the consumption of shared data.
*C. There is no such privilege as OWNERSHIP in Snowflake. The correct privilege name is OWNED BY, which indicates the role that owns an object and has full control over it. However, this privilege cannot be granted or revoked, but only transferred by the current owner to another role using the GRANT OWNERSHIP command. Therefore, this option is not feasible for delegating the administration of a data exchange.
*D. The USAGE privilege on a data exchange allows a role to access the data exchange and view the available data listings. This privilege does not allow a role to perform administrative tasks on the data exchange, such as inviting members, approving profiles, and reviewing listings. Therefore, this option is not sufficient for delegating the administration of a data exchange.
NEW QUESTION # 34
An Administrator receives data from a Snowflake partner. The partner is sharing a dataset that contains multiple secure views. The Administrator would like to configure the data so that only certain roles can see certain secure views.
How can this be accomplished?
- A. Create views over the incoming shared database and apply the desired RBAC onto these views.
- B. Individually grant imported privileges onto the schema in the share.
- C. Apply RBAC directly onto the partner's shared secure views.
- D. Clone the data and insert it into a company-owned share and apply the desired RBAC on the new tables.
Answer: A
Explanation:
Explanation
According to the Snowflake documentation1, secure views are only exposed to authorized users who have been granted the role that owns the view. Therefore, applying RBAC directly onto the partner's shared secure views (option A) is not possible, as the administrator does not own those views. Individually granting imported privileges onto the schema in the share (option B) is also not feasible, as the privileges granted on the schema do not apply to existing secure views, only tofuture ones2. Cloning the data and inserting it into a company-owned share (option C) is not recommended, as it would create unnecessary duplication of data and increase storage costs. The best option is to create views over the incoming shared database and apply the desired RBAC onto these views (option D). This way, the administrator can control the access to the data based on the roles in their account, without modifying the original data or views from the partner.
NEW QUESTION # 35
An organization's sales team leverages this Snowflake query a few times a day:
SELECT CUSTOMER ID, CUSTOMER_NAME, ADDRESS, PHONE NO
FROM CUSTOMERS
WHERE LAST UPDATED BETWEEN TO_DATE (CURRENT_TIMESTAMP) AND (TO_DATE
(CURRENT_TIMESTAMP) -7);
What can the Snowflake Administrator do to optimize the use of persisted query results whenever possible?
- A. Wrap the query in a User-Defined Function (UDF) to match syntax execution.
- B. Assign everyone on the sales team to the same security role.
- C. Leverage the CURRENT_DATE function for date calculations.
- D. Assign everyone on the sales team to the same virtual warehouse.
Answer: C
Explanation:
Explanation
According to the web search results from my predefined tool search_web, one of the factors that affects the reuse of persisted query results is the exact match of the query syntax1. If the query contains functions that return different values for successive runs, such as CURRENT_TIMESTAMP, then the query will not match the previous query and will not benefit from the cache. To avoid this, the query should use functions that return consistent values for the same day, such as CURRENT_DATE, which returns the current date without the time component2. Option A is incorrect because wrapping the query in a UDF does not guarantee the syntax match, as the UDF may also contain dynamic functions. Option B is incorrect because the virtual warehouse does not affect the persisted query results, which are stored at the account level1. Option C is incorrect because the security role does not affect the persisted query results, as long as the role has the necessary privileges to access the tables and views used in the query1.
1: Using Persisted Query Results | Snowflake Documentation 2: Date and Time Functions | Snowflake Documentation
NEW QUESTION # 36
Which masking policy will mask a column whenever it is queried through a view owned by a role named MASKED_VIEW_ROLE?
- A. create or replace masking policy maskstring as (val string) returns string -> case when is_role_in_session ('MASKED_VIEW_ROLE') then ' ** else val end;
*, - B. create or replace masking policy maskString as (val string) returns string -> case when current_role() in ('MASKED_VIEW_ROLE') then ' ********* ' else val end;
- C. create or replace masking policy maskstring as (val string) returns string -> case when invoker_role() in ('MASKED_VIEW_ROLE') then else val end;
' ** - D. create or replace masking policy maskString as (val string) returns string -> case when array_contains ('MASKED_VIEW_ROLE' :: variant, parse_json (current_available_roles ())) then
'*
else val
end;
** '
Answer: A
Explanation:
Explanation
A masking policy is a SQL expression that transforms the data in a column based on the role that queries the column1. The is_role_in_session function returns true if the specified role is in the current session2. Therefore, the masking policy in option A will mask the column data with asterisks whenever it is queried through a view owned by the MASKED_VIEW_ROLE3. The other options use different functions that do not check the ownership of the view, but rather the current role, the invoker role, or the available roles in the session45.
These functions may not return the desired result if the role that owns the view is different from the role that queries the view.
NEW QUESTION # 37
An Administrator needs to create a sample of the table LINEITEM. The sample should not be repeatable and the sampling function should take the data by blocks of rows.
What select command will generate a sample of 20% of the table?
- A. select * from LINEITEM sample system (20);
- B. select * from LINEITEM sample bernoulli (20);
- C. select * from LINEITEM tablesample block (20 rows);
- D. select * from LINEITEM tablesample system (20) seed (1);
Answer: A
Explanation:
Explanation
This command will generate a sample of 20% of the table by using the SYSTEM (or BLOCK) sampling method, which selects each block of rows with a probability of 20/100. This method is suitable for taking data by blocks of rows, as the question requires. According to the Snowflake documentation, "SYSTEM (or BLOCK): Includes each block of rows with a probability of p/100. Similar to flipping a weighted coin for each block of rows. This method does not support fixed-size sampling." The other options are either incorrect or do not meet the requirements of the question. Option A uses the BERNOULLI (or ROW) sampling method, which selects each row with a probability of 20/100, but does not take data by blocks of rows. Option C uses the BLOCK sampling method, but specifies a fixed number of rows (20) instead of a percentage (20%).
Option D uses the SYSTEM sampling method, but specifies a seed value (1), which makes the sampling repeatable, contrary to the question.
NEW QUESTION # 38
What information is required from the Identity Provider (IdP) to enable federated authentication in Snowflake? (Select TWO).
- A. IdP account details
- B. SAML response format
- C. Authentication certificate
- D. URL endpoint for SAML requests
- E. IdP encryption key
Answer: C,D
Explanation:
To enable federated authentication (aka SSO via SAML 2.0) in Snowflake, the integration with an Identity Provider (IdP) must be configured. This setup involves configuring external authentication via SAML, and Snowflake needs specific information from the IdP.
Required Information from IdP:
URL Endpoint for SAML Requests (B)
This is often referred to as the SSO URL or SAML 2.0 Endpoint (HTTP).
It's the URL that Snowflake redirects users to for authentication.
In Snowflake's SAML configuration, this is required as the SAML2_ISSUER or SAML2_SSO_URL.
Authentication Certificate (D)
This is the X.509 certificate issued by the IdP.
It's used by Snowflake to validate the digital signature of the SAML assertions sent by the IdP.
It ensures that the SAML response is authentic and not tampered with.
❌ Why Other Options Are Incorrect:
A . IdP account details
Not needed. Snowflake doesn't require credentials or internal details from the IdP. It relies on assertions sent via SAML, not stored accounts.
C . SAML response format
Snowflake adheres to SAML 2.0 standard, and expects a compliant format. There's no need to specify format explicitly - it's part of the standard protocol.
E . IdP encryption key
Not required by Snowflake. Snowflake verifies SAML assertions via signature validation, not encryption using the IdP's private key.
SnowPro Administrator Reference:
Snowflake Documentation - Federated Authentication Setup
https://docs.snowflake.com/en/user-guide/security-fed-auth-use
https://docs.snowflake.com/en/user-guide/security-fed-auth-config
Required IdP Metadata for Snowflake SAML Configuration:
SAML2_SSO_URL: SAML 2.0 POST binding endpoint
SAML2_X509_CERT: Public cert used to validate IdP signatures
NEW QUESTION # 39
What roles or security privileges will allow a consumer account to request and get data from the Data Exchange? (Select TWO).
- A. IMPORT PRIVILEGES and SHARED DATABASE
- B. ACCOUNTADMIN
- C. IMPORT SHARE and CREATE DATABASE
- D. SYSADMIN
- E. SECURITYADMIN
Answer: B,C
Explanation:
Explanation
According to the Accessing a Data Exchange documentation, a consumer account can request and get data from the Data Exchange using either the ACCOUNTADMIN role or a role with the IMPORT SHARE and CREATE DATABASE privileges. The ACCOUNTADMIN role is the top-level role that has all privileges on all objects in the account, including the ability to request and get data from the Data Exchange. A role with the IMPORT SHARE and CREATE DATABASE privileges can also request and get data from the Data Exchange, as these are the minimum privileges required to create a database from a share. The other options are incorrect because:
*A. The SYSADMIN role does not have the privilege to request and get data from the Data Exchange, unless it is also granted the IMPORT SHARE and CREATE DATABASE privileges. The SYSADMIN role is a pre-defined role that has all privileges on all objects in the account, except for the privileges reserved for the ACCOUNTADMIN role, such as managing users, roles, and shares.
*B. The SECURITYADMIN role does not have the privilege to request and get data from the Data Exchange, unless it is also granted the IMPORT SHARE and CREATE DATABASE privileges. The SECURITYADMIN role is a pre-defined role that has the privilege to manage security objects in the account, such as network policies, encryption keys, and security integrations, but not data objects, such as databases, schemas, and tables.
*E. The IMPORT PRIVILEGES and SHARED DATABASE are not valid privileges in Snowflake. The correct privilege names are IMPORT SHARE and CREATE DATABASE, as explained above.
NEW QUESTION # 40
......
Tested Material Used To ADA-C01 Test Engine: https://www.passtorrent.com/ADA-C01-latest-torrent.html
Steps Necessary To Pass The ADA-C01 Exam: https://drive.google.com/open?id=1GQfcscxH8_tw8SN5V58JfjeABLm7UD-n