I85PREP
⌘ K
SnowPro Core study materials
SnowPro Core study resources

SnowPro Core practice questions

One question at a time. Build your SnowPro Core understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Snowflake AI Data Cloud Features and Architecture

Snowflake's architecture is organized into three layers. Which layer handles query parsing, optimization, access control, and metadata management?

  1. The storage layer, where micro-partition statistics are persisted
  2. The virtual warehouse layer, which also performs all metadata management
  3. The hybrid columnar layer, which manages object-level privileges
  4. The cloud services layer Correct answer.

Explanation

The cloud services layer is the brain of the account: it authenticates users, enforces access control, stores metadata, parses and optimizes queries, and coordinates transactions. Compute and storage are the other two layers and do not perform these coordination functions.

Question 2Snowflake AI Data Cloud Features and Architecture

Which factor determines the rate at which a running virtual warehouse consumes credits?

  1. The total number of rows returned by each query
  2. The number of concurrent users connected to the warehouse
  3. The warehouse size Correct answer.
  4. The retention period configured on the queried tables

Explanation

Credit consumption per hour is a function of warehouse size: each successive size doubles the credits consumed per hour, from X-Small upward. A suspended warehouse consumes no compute credits regardless of how much data it holds or how many users are assigned to it.

Question 3Snowflake AI Data Cloud Features and Architecture

Which description best characterizes a micro-partition in Snowflake?

  1. An immutable, compressed, columnar storage unit Correct answer.
  2. A mutable row block that is rewritten in place whenever a row is updated
  3. A fixed 16 MB block that holds exactly one column of a table
  4. A logical view definition cached by the cloud services layer

Explanation

Micro-partitions are immutable, compressed, columnar storage units of roughly 50 to 500 MB of uncompressed data that Snowflake creates automatically as rows are loaded. Because they are immutable, updates and deletes mark rows and write new micro-partitions rather than modifying existing ones.

Question 4Snowflake AI Data Cloud Features and Architecture

In an Enterprise Edition account, what is the maximum Time Travel retention period that can be set for a permanent table?

  1. 7 days
  2. 30 days
  3. 90 days Correct answer.
  4. 24 hours

Explanation

Standard Edition allows a Time Travel retention period of 0 to 1 day, while Enterprise Edition and above allow up to 90 days for permanent objects. Fail-safe adds a separate, non-configurable 7-day period after Time Travel expires.

Question 5Snowflake AI Data Cloud Features and Architecture

During the Fail-safe period, who can recover data that has been deleted or lost?

  1. Only Snowflake support Correct answer.
  2. A user holding the ACCOUNTADMIN role, using UNDROP
  3. Any role that has been granted the FAILSAFE privilege
  4. The table owner, by querying the FAILSAFE schema

Explanation

Fail-safe is a non-configurable 7-day disaster-recovery window that begins after Time Travel ends. Customers cannot query data during Fail-safe; only Snowflake support can restore it, so self-service recovery must happen while Time Travel is still active.

Question 6Snowflake AI Data Cloud Features and Architecture

A table T2 is created with CREATE TABLE T2 CLONE T1. Later, rows are deleted from T1 but T2 is untouched. What is the result?

  1. Snowflake copies every micro-partition of T1 into T2 at clone time
  2. T2 is also emptied, because clones share the same underlying storage
  3. T2 still returns its rows, because it references the original micro-partitions Correct answer.
  4. T2 becomes read-only until it is refreshed from the source table

Explanation

Zero-copy cloning copies metadata pointers, not data, so both tables initially reference the same micro-partitions. When either table changes, new micro-partitions are written for the affected rows and the other table continues to see the original data.

Question 7Snowflake AI Data Cloud Features and Architecture

Which sequence shows the correct containment hierarchy in Snowflake?

  1. Schema, then Database, then Table, then Column
  2. Database, then Schema, then Table, then Column Correct answer.
  3. Database, then Table, then Schema, then Column
  4. Account, then Database, then Table, then Schema

Explanation

Tables and views live inside schemas, schemas live inside databases, and databases live inside an account. Columns are contained within tables, making them the finest level of the hierarchy listed.

Question 8Snowflake AI Data Cloud Features and Architecture

Which prefix references a user's personal stage in commands such as PUT or COPY INTO?

  1. @~ Correct answer.
  2. @#
  3. @%
  4. @&

Explanation

Snowflake supports three stage types with distinct reference prefixes: @~ for the user stage, @% for a table stage, and @name for a named stage. The user stage exists automatically for every user and needs no CREATE statement.

Question 9Snowflake AI Data Cloud Features and Architecture

Queries on a warehouse are queuing behind one another at peak times, and the warehouse is already sized appropriately for the memory needs of each query. Which change most directly addresses the concurrency problem?

  1. Increase the statement timeout so that queued queries wait longer before failing
  2. Convert it to a multi-cluster warehouse with MAX_CLUSTER_COUNT above 1 Correct answer.
  3. Enable the query acceleration service on that warehouse
  4. Lower AUTO_SUSPEND so that idle compute is released back to the pool sooner

Explanation

Multi-cluster warehouses add or remove clusters of the same size to serve more concurrent queries, which is the intended remedy for queueing. Warehouse size controls resources per query rather than the number of queries that can run at once.

Question 10Snowflake AI Data Cloud Features and Architecture

How does the Economy scaling policy differ from the Standard policy for multi-cluster warehouses?

  1. It caps the warehouse at one cluster regardless of configuration
  2. It starts new clusters immediately whenever queries begin to queue
  3. It bills extra clusters at half the normal credit rate
  4. It keeps clusters running longer before shutting them down Correct answer.

Explanation

Economy favors keeping already-running clusters alive for several minutes of idle time, which avoids the cost of repeatedly provisioning clusters for fluctuating workloads. Standard starts clusters as soon as queries are queued and shuts them down more aggressively once they are idle.

Question 11Snowflake AI Data Cloud Features and Architecture

A user re-runs an identical SELECT 30 minutes after the first execution, the underlying data has not changed, and the warehouse has since been suspended. What is the outcome?

  1. Only the local disk cache rebuilds the result set for the user
  2. The result cache returns the output without a running warehouse Correct answer.
  3. The query re-reads every micro-partition from remote storage and rebuilds the result
  4. The query fails until the warehouse is resumed by an administrator

Explanation

The result cache holds query results for 24 hours and is served by the cloud services layer, so a suspended warehouse is not required. Results are reused only when the query text matches and the underlying data has not changed, and no compute credits are consumed.

Question 12Snowflake AI Data Cloud Features and Architecture

What does the local disk cache on a virtual warehouse hold, and when is it cleared?

  1. Micro-partition metadata used for pruning; cleared when the table is reclustered
  2. Query results; cleared every 24 hours regardless of activity
  3. Staged data files; cleared when the stage object is dropped
  4. Micro-partitions read by queries; cleared when the warehouse suspends Correct answer.

Explanation

The local disk cache (warehouse cache) holds micro-partitions that the warehouse has read from remote storage, so repeat queries scan locally. It exists only while the warehouse is running and is dropped on suspend, which is why resuming a warehouse can make the first queries slower.

Question 13Snowflake AI Data Cloud Features and Architecture

A 10 TB table is repeatedly filtered on ORDER_DATE, and pruning currently eliminates very little data from the scan. What is the recommended remedy?

  1. Create a materialized view containing every column of the table
  2. Define ORDER_DATE as the clustering key Correct answer.
  3. Sort the table's rows by ORDER_DATE before each query runs
  4. Increase the warehouse size to improve scan throughput

Explanation

A clustering key co-locates rows with similar values into the same micro-partitions, which lets pruning skip far more partitions on the filtered column. Sorting manually is not a Snowflake operation on standard tables, and a larger warehouse only scans the same volume faster.

Question 14Snowflake AI Data Cloud Features and Architecture

What does a stream object record for its source table?

  1. Only the DDL changes made to the table's schema
  2. A full copy of every row as it existed when the stream was created
  3. Aggregated counts of inserts per micro-partition
  4. Row-level change records with metadata columns Correct answer.

Explanation

Streams implement change data capture by exposing inserted, updated, and deleted rows along with metadata columns such as METADATA$ACTION and METADATA$ISUPDATE. Consuming a stream with DML advances its offset so the same changes are not processed twice.

Question 15Snowflake AI Data Cloud Features and Architecture

In a Snowflake task graph, what causes a child task to run?

  1. Successful completion of its predecessor task Correct answer.
  2. A manual EXECUTE TASK statement issued against the child task
  3. The account-level scheduler firing on its one-minute interval
  4. An INSERT into the stream that feeds the graph

Explanation

Child tasks are defined with AFTER to depend on a predecessor and run when that predecessor completes successfully. Only the root task of a graph carries a schedule, and inserting into a stream does not by itself trigger task execution.

Question 16Snowflake AI Data Cloud Features and Architecture

At which levels can a resource monitor be attached?

  1. Only at the database or schema level, scoped to objects inside them
  2. Only at the individual warehouse level, one monitor per warehouse
  3. Only at the account level, applying to every warehouse in the account
  4. At the account level or on specific warehouses Correct answer.

Explanation

A resource monitor can be set at the account level to track all compute credit usage, or attached to individual warehouses to track their consumption separately. Monitors can suspend warehouses or notify when credit thresholds are reached.

Question 17Snowflake AI Data Cloud Features and Architecture

A provider must share data with a partner organization that does not have a Snowflake account of its own. What should the provider create?

  1. A reader account for the consumer Correct answer.
  2. A share with PUBLIC access enabled so anyone can query it
  3. An external stage mounted by the partner over SFTP
  4. A new copy of the database deployed in the consumer's region

Explanation

Reader accounts give consumers without Snowflake accounts a way to query shared data; the provider creates the account and pays for the compute it consumes. Readers can query shared data but cannot load data or create shares themselves.

Question 18Snowflake AI Data Cloud Features and Architecture

Under what condition are cloud services credits billed to an account?

  1. They are billed at the same rate as compute credits in every case
  2. Only when they exceed 10% of daily compute credits Correct answer.
  3. Whenever a user queries the INFORMATION_SCHEMA views
  4. Only when a resource monitor threshold has been reached

Explanation

Snowflake does not charge for cloud services usage that stays below 10% of the total compute credits consumed that day. Any usage above that threshold is billed as cloud services credits.

Question 19Snowflake AI Data Cloud Features and Architecture

Which compute resources does Snowpipe use to load files into a table?

  1. The cloud services layer, which charges standard compute credits
  2. The virtual warehouse named in the COPY statement
  3. The warehouse assigned to the pipe owner's default role
  4. Snowflake-provided serverless compute Correct answer.

Explanation

Snowpipe loads files using serverless compute managed by Snowflake, so no user-managed warehouse needs to be running. Billing is based on the serverless compute time and the number of files loaded.

Question 20Snowflake AI Data Cloud Features and Architecture

A team needs a table that refreshes itself from a defined query as base data changes, with Snowflake scheduling and performing incremental refreshes automatically. Which object fits this requirement?

  1. A transient table refreshed by a scheduled task
  2. A materialized view over the base table
  3. A dynamic table with a target lag Correct answer.
  4. An external table over the base table's storage

Explanation

Dynamic tables declare a query plus a target lag, and Snowflake schedules and performs incremental refreshes to keep the result within that lag. They are suited to multi-step transformation pipelines that a single materialized view cannot express.

Question 21Snowflake AI Data Cloud Features and Architecture

Which workload is the best fit for the Query Acceleration Service?

  1. Many small point-lookup queries returning a handful of rows
  2. Queries dominated by complex joins across many small tables
  3. Scan-heavy queries with selective filters Correct answer.
  4. Write-heavy ingestion pipelines loading files continuously

Explanation

The Query Acceleration Service offloads portions of scan and aggregation work to shared compute, so it benefits queries that scan large volumes with selective filters. It does not help point lookups or workloads dominated by small-table joins and writes.

Question 22Snowflake AI Data Cloud Features and Architecture

A large table is queried with highly selective equality predicates such as WHERE CUSTOMER_ID = 12345, and normal pruning still scans many micro-partitions. Which feature is designed for this pattern?

  1. The search optimization service Correct answer.
  2. A multi-cluster warehouse configuration
  3. The query acceleration service
  4. A clustering key on an unrelated high-cardinality column

Explanation

The search optimization service builds a search access path that lets Snowflake locate matching rows for equality, IN, and substring predicates without scanning every micro-partition. It targets selective point-lookup style queries rather than broad scans.

Question 23Snowflake AI Data Cloud Features and Architecture

Which statement about hybrid tables is accurate?

  1. They are a specialized form of external table that reads Iceberg files
  2. They can be created in any database and used inside shared databases
  3. They store data in micro-partitions and support Time Travel and cloning
  4. They use row-based storage and enforce primary keys Correct answer.

Explanation

Hybrid tables provide row-based storage with primary key and foreign key enforcement and row-level locking, aimed at transactional workloads that need low-latency single-row operations. They are distinct from standard micro-partition tables and are limited by constraints such as not being shareable.

Question 24Snowflake AI Data Cloud Features and Architecture

Which Snowflake edition is required for a secondary account to perform failover in a replication setup?

  1. Enterprise Edition
  2. Virtual Private Snowflake only
  3. Standard Edition
  4. Business Critical Edition or higher Correct answer.

Explanation

Database replication is available from Standard Edition upward, but failover and failback, including redirecting clients to a secondary account, require Business Critical Edition or higher. Snowflake recommends that primary and secondary accounts use the same edition.

Question 25Snowflake AI Data Cloud Features and Architecture

An Iceberg table is created in Snowflake using an external Iceberg catalog that is not Snowflake Open Catalog. What access does Snowflake provide for that table?

  1. Write access, but only through Snowpipe streaming
  2. Write access, but only when the table has a clustering key
  3. Read-only access to the Iceberg table Correct answer.
  4. Full read-write access with Snowflake-managed metadata

Explanation

When the Iceberg catalog is external, Snowflake can read the table's metadata and data files but cannot write to it. Write support requires Snowflake to manage the table's metadata through Snowflake Open Catalog or a Snowflake-managed Iceberg table.

Question 26Snowflake AI Data Cloud Features and Architecture

Snowflake separates storage from compute. Which component handles authentication, access control, query parsing and optimization, and metadata management?

  1. The remote storage layer
  2. The virtual warehouse layer
  3. The cloud services layer Correct answer.
  4. The local disk cache on warehouse nodes

Explanation

The cloud services layer is the brain of the account: it authenticates users, enforces access control, parses and optimizes SQL, and maintains metadata such as micro-partition statistics. It is provisioned by Snowflake and consumes cloud services credits rather than warehouse credits.

Question 27Snowflake AI Data Cloud Features and Architecture

A permanent table is created without specifying DATA_RETENTION_TIME_IN_DAYS, and the account-level parameter has not been changed. How much Time Travel retention does the table have?

  1. 0 days
  2. 1 day Correct answer.
  3. 90 days
  4. 7 days

Explanation

The default DATA_RETENTION_TIME_IN_DAYS for permanent objects is 1 day. Accounts on Enterprise Edition or higher can raise it to as much as 90 days, but only if the parameter is explicitly set.

Question 28Snowflake AI Data Cloud Features and Architecture

How is credit consumption metered for a running virtual warehouse?

  1. Per minute, with no minimum charge for short queries
  2. Per query, based on the number of rows returned
  3. Per hour, always rounded up to the next full hour
  4. Per second, with a 60-second minimum on each start Correct answer.

Explanation

Warehouses are billed on a per-second basis once running, but each time a warehouse starts it is charged for at least 60 seconds. This means very short queries still incur a full minute of credit consumption.

Question 29Snowflake AI Data Cloud Features and Architecture

When rows in a table are updated or deleted, what happens to the micro-partitions that currently hold those rows?

  1. They are merged with adjacent micro-partitions to keep the table compact
  2. New micro-partitions are written; existing ones are left unchanged Correct answer.
  3. They are updated in place, and partition metadata is recalculated immediately
  4. They are split into smaller micro-partitions to preserve column statistics

Explanation

Micro-partitions are immutable. DML operations write new micro-partitions containing the changed rows, and the older partitions are simply no longer referenced by the current table version, though they remain available for Time Travel.

Question 30Snowflake AI Data Cloud Features and Architecture

A virtual warehouse is resized from X-Small to Medium and runs a full hour at each size. How does credit consumption compare?

  1. Eight times as many credits per hour
  2. Four times as many credits per hour Correct answer.
  3. The same credits per hour, with twice the throughput
  4. Twice as many credits per hour

Explanation

Each size increase doubles the number of compute nodes, and credits per hour double with each step. X-Small consumes 1 credit per hour and Medium consumes 4, a fourfold increase across two steps.

Question 31Snowflake AI Data Cloud Features and Architecture

A team must query files in an S3 bucket from Snowflake without storing AWS access keys in a stage definition. Which Snowflake object enables this?

  1. A secret object referenced by a file format
  2. A storage integration referenced by an external stage Correct answer.
  3. A named internal stage with directory tables enabled
  4. A network policy attached to the warehouse

Explanation

A storage integration stores the cloud provider identity and trust configuration so Snowflake can access the bucket without embedding long-lived credentials. An external stage then references that integration along with the URL and file format.

Question 32Snowflake AI Data Cloud Features and Architecture

Which statement about Fail-safe is accurate?

  1. Fail-safe keeps data for seven days and is reachable only via Support Correct answer.
  2. Users can query Fail-safe data with AT or BEFORE clauses
  3. Fail-safe applies to transient and temporary tables as well as permanent tables
  4. Fail-safe retains data for 14 days after Time Travel ends

Explanation

After the Time Travel retention period passes, permanent tables enter a fixed seven-day Fail-safe period. The data can be recovered only by Snowflake Support; customers cannot query it directly.

Question 33Snowflake AI Data Cloud Features and Architecture

A developer wants to call a large language model from SQL to summarize text stored in a table. Which statement about Snowflake Cortex LLM functions is true?

  1. They run as serverless functions and need no warehouse to execute Correct answer.
  2. They are available only through the Snowpark Container Services runtime
  3. They copy the prompt text to an external model provider account
  4. They require a dedicated warehouse to be provisioned per model

Explanation

Cortex LLM functions are managed by Snowflake and execute serverlessly, so no virtual warehouse is required. Prompts and responses stay inside Snowflake's security and governance perimeter.

Question 34Snowflake AI Data Cloud Features and Architecture

A view is created with the SECURE keyword. What does this change?

  1. The view owner's privileges are no longer used when queried
  2. The view result is cached permanently until the base table changes
  3. The view runs on serverless compute rather than a warehouse
  4. The view definition and internal query details are hidden Correct answer.

Explanation

Secure views hide the view definition, the underlying objects, and internal query details from users who do not have sufficient privileges. They also prevent certain optimizer-driven behaviors that could leak information about the source data.

Question 35Snowflake AI Data Cloud Features and Architecture

Which objects can be added to a share in Snowflake?

  1. Individual tables, views, and schemas chosen one at a time
  2. Databases, which give the consumer access to the objects inside Correct answer.
  3. Warehouses, so the consumer can run queries without its own compute
  4. Stages, so the consumer can read the underlying files directly

Explanation

A share is populated by granting privileges on a database, and the consumer then sees the schemas and objects contained in that database. Compute is never shared, so each consumer uses its own warehouse.

Question 36Snowflake AI Data Cloud Features and Architecture

Which set of languages can be used to build Snowpark client applications that push DataFrame operations into Snowflake?

  1. Python, R, and Go
  2. Python, Java, and Scala Correct answer.
  3. SQL, Python, and Java
  4. Python, JavaScript, and C#

Explanation

Snowpark provides client-side APIs for Python, Java, and Scala, letting developers build dataframes and push processing into Snowflake. SQL is a query language rather than a Snowpark client API.

Question 37Snowflake AI Data Cloud Features and Architecture

Which statement about a masking policy applied to a column is accurate?

  1. A second masking policy can be added to the same column by a role with MANAGE GRANTS on the table
  2. One policy can apply to many columns, but a column has at most one masking policy Correct answer.
  3. The policy is evaluated only when rows are inserted or updated in the column
  4. A masking policy can be applied only to columns whose type is VARCHAR or NUMBER

Explanation

A masking policy is a reusable schema-level object that can be attached to many columns, including columns of different tables. Each column, however, can have only one masking policy attached at a time, and the policy is evaluated at query time.

Question 38Snowflake AI Data Cloud Features and Architecture

Which statement describes Tri-Secret Secure in Snowflake?

  1. It encrypts data three times before it is written to storage
  2. It requires three separate identity providers for login
  3. It combines a Snowflake key with a customer-managed key Correct answer.
  4. It stores three copies of every key in separate regions

Explanation

Tri-Secret Secure uses a composite master key made up of a Snowflake-managed key and a key held in the customer's own cloud key management service. Removing the customer key renders the account's data unreadable, and the feature requires Business Critical Edition or higher.

Question 39Snowflake AI Data Cloud Features and Architecture

In a schema with managed access enabled, which roles can grant privileges on objects in that schema?

  1. The schema owner role, not the owners of the individual objects Correct answer.
  2. Only ACCOUNTADMIN, because object ownership is transferred to it
  3. Any role that owns an object in the schema, as in a normal schema
  4. Any role that has been granted USAGE on the schema by its owner

Explanation

Managed access schemas centralize privilege management in the schema owner, who must hold the MANAGE GRANTS privilege globally or on the schema. Object owners no longer control grants on their own objects, which prevents privilege sprawl.

Question 40Snowflake AI Data Cloud Features and Architecture

How is Snowflake storage usage billed?

  1. By the total uncompressed size of every table, measured once at the end of each billing month
  2. By the average amount of compressed data stored per day, including Time Travel and Fail-safe Correct answer.
  3. By the number of read and write operations the account issues against the storage layer
  4. By the peak volume of data stored on the account on any single day within the billing month

Explanation

Storage is metered on the average daily volume of compressed data held in the account, computed from hourly measurements across the month. The total includes table data, Time Travel versions, Fail-safe data, and internal stages.

Question 41Account Access and Security

Which system-defined role is intended to own the warehouses, databases, and other objects that make up the data warehouse?

  1. SECURITYADMIN
  2. USERADMIN
  3. PUBLIC
  4. SYSADMIN Correct answer.

Explanation

SYSADMIN is the system-defined role designed to create warehouses, databases, and other objects, and it owns those objects once created. Security-related duties belong to SECURITYADMIN and USERADMIN, which keeps administrative concerns separated.

Question 42Account Access and Security

Which role is automatically granted to every user in a Snowflake account and cannot be revoked?

  1. PUBLIC Correct answer.
  2. ACCOUNTADMIN
  3. USERADMIN
  4. SYSADMIN

Explanation

PUBLIC is granted to every user and every role in the account, and it cannot be revoked from them. It grants no privileges by default until an administrator explicitly grants privileges to it.

Question 43Account Access and Security

Snowflake multi-factor authentication is available for accounts that authenticate using which method?

  1. Password-based Correct answer.
  2. SAML federation
  3. OAuth token
  4. Key pair

Explanation

MFA is supported for users who sign in with a Snowflake username and password. Users authenticated through federated SAML or key pair authentication rely on the external identity provider or key possession instead.

Question 44Account Access and Security

Which Snowflake object restricts connections to an account or user based on IP address ranges?

  1. Session policy
  2. Network policy Correct answer.
  3. Resource monitor
  4. Secondary role

Explanation

A network policy lists allowed and blocked IP address ranges and can be attached at the account level or to individual users. It is the mechanism Snowflake provides for IP allow-listing and block-listing.

Question 45Account Access and Security

In key pair authentication, what does the client use to sign each authentication request?

  1. The private key Correct answer.
  2. A one-time passcode
  3. A shared secret string
  4. The public key only

Explanation

The user's public key is stored on the Snowflake user object, while the client keeps the private key and uses it to sign the JWT sent during authentication. Snowflake verifies the signature with the stored public key.

Question 46Account Access and Security

Which privilege on a warehouse allows a role to start a suspended warehouse?

  1. USAGE
  2. OWNERSHIP
  3. MONITOR
  4. OPERATE Correct answer.

Explanation

OPERATE allows a role to start, stop, and abort queries on a warehouse. USAGE only lets the role run queries on a running warehouse, and MONITOR only exposes usage statistics.

Question 47Account Access and Security

A role must be able to pass a privilege it already holds on to another role. Which privilege modifier makes this possible?

  1. TRANSFER OWNERSHIP
  2. WITH GRANT OPTION Correct answer.
  3. FUTURE GRANTS
  4. GRANT ALL

Explanation

When a privilege is granted WITH GRANT OPTION, the receiving role can grant that same privilege to other roles. Without it, the role can use the privilege but cannot extend it to anyone else.

Question 48Account Access and Security

What does a future grant accomplish in Snowflake?

  1. It defers privilege checks until the object is queried
  2. It grants a privilege on all objects that already exist in the database
  3. It grants a privilege on objects created later in the schema Correct answer.
  4. It transfers ownership of new objects to a system role

Explanation

A future grant, written with ON FUTURE <object type> IN SCHEMA or IN DATABASE, applies a privilege automatically to objects of that type created afterward. Existing objects are unaffected and must be granted separately.

Question 49Account Access and Security

In a schema that has managed access enabled, which roles can grant privileges on the objects inside that schema?

  1. Any role that has been granted SELECT on the object
  2. The PUBLIC role
  3. The schema owner and roles with MANAGE GRANTS Correct answer.
  4. Any role that has USAGE on the parent database

Explanation

With managed access, privilege granting is centralized: only the schema owner, or a role holding the global MANAGE GRANTS privilege, can grant on objects in the schema. Individual object owners lose the ability to grant on their own objects.

Question 50Account Access and Security

A user without an authorized role queries a column protected by a masking policy. What does the user see?

  1. An error that blocks the query
  2. Nothing, because the column is dropped from the result
  3. The real value, flagged as sensitive
  4. A masked value in place of the real one Correct answer.

Explanation

A masking policy returns an alternate value, such as a fixed string, a hash, or NULL, when the querying role does not meet the policy condition. The query still runs and the column still appears, but its content is transformed.