Snowflake NAS-C01 : SnowPro Specialty - Native Apps

You are setting up an external stage to host your Snowflake Native Application Package on AWS S3. You've created an IAM role and Snowflake integration. However, when you try to create the application package with 'EXTERNAL STAGE , you receive an error indicating that Snowflake cannot access the S3 bucket. Which of the following could be the potential causes and solutions?

• A. The Snowflake integration object is not correctly configured with the IAM role ARN. Solution: Verify the parameter in the integration object matches the IAM role ARN.
• B. The IAM role does not have sufficient permissions to access the S3 bucket. Solution: Update the IAM role's policy to grant 's3:GetObject' and 's3:ListBuckeV permissions on the bucket.
• C. The S3 bucket policy does not allow access from the Snowflake AWS account. Solution: Update the bucket policy to explicitly allow access from the Snowflake AWS account, using the IAM role's principal.
• D. The SNOWFLAKE DEPLOYMENT role is not granted access to the Integration object. Solution: Grant USAGE privilege on the Integration to the SNOWFLAKE DEPLOYMENT role.
• E. The external stage URL is incorrect. Solution: Ensure the URL provided in the 'CREATE APPLICATION PACKAGE EXTERNAL STAGE command is the correct S3 bucket URL.

You are tasked with deploying a Snowflake Native Application that performs real-time data analysis. The application requires a warehouse to run and a user with specific privileges to access dat a. You want to automate the deployment process as much as possible, including warehouse creation, user provisioning, and privilege granting, all within the application package. Given the security considerations and best practices for Snowflake Native Applications, which of the following approaches is the MOST secure and recommended?

• A. Utilize the 'INSTALL' privilege when creating the application package and execute the SQL script (containing 'CREATE WAREHOUSE, 'CREATE USER , and 'GRANT) within the application's setup script using the 'EXECUTE IMMEDIATE command. This allows the application to create resources within the consumer's account.
• B. Employ a secure deployment pipeline that leverages a separate, pre-authorized Snowflake account to provision the warehouse and useL The application package then only includes the application logic, assuming the resources already exist.
• C. Use a setup script within the application package, granting it the 'APPLY APPLICATION PASSTHROUGH PRIVILEGES privilege. This will enable the application to inherit the privileges of the user who installed the application, allowing it to create the warehouse and user on their behalf.
• D. Request the consumer to manually create the warehouse and user with the required privileges before installing the application. Provide detailed instructions in the application documentation.
• E. Include a SQL script within the application package that uses the 'CREATE WAREHOUSE, 'CREATE USER , and 'GRANT commands to create the warehouse, user, and grant necessary privileges. The script will be executed by the consumer upon installation.

A provider is developing a Snowflake Native App and utilizes event sharing to communicate state changes to consumers. After initial installation, a consumer reports not receiving any event notifications. The provider has verified the event table is populated correctly. Which of the following are the MOST likely reasons for this issue and how can the provider troubleshoot them?

• A. The event table function is not correctly filtering events based on the consumer's application instance I Review the function logic to ensure proper filtering using APP_INSTANCE_ID().
• B. Event sharing is inherently unreliable and Snowflake does not guarantee event delivery. The provider should implement alternative polling mechanisms.
• C. The consumer has not refreshed their application instance metadata. Ask the consumer to execute SYSTEM$REFRESH_EXTERNAL_FUNCTIONS() in the application database.
• D. The consumer has not explicitly granted the necessary privileges on the event table function to the role used by the app. Instruct the consumer to grant USAGE on the event table function to the app role.
• E. The consumer's event table function does not have the correct security invoker privileges. Grant EXECUTE TASK on the event table function to the consumer role.

You're developing a Snowflake Native Application with a front-end UI built using Streamlit, deployed as a UDF. This UI allows users to upload CSV files for processing. To adhere to security best practices and prevent unacceptable code practices in a Native App, what considerations should you prioritize in your development and deployment process specifically related to handling user-uploaded files ?

• A. Implement strict file size limits and file type validation on both the client-side (Streamlit UI) and server-side (Snowflake UDF) to prevent denial-of-service attacks and malicious file uploads. Sanitize and validate the contents of the uploaded CSV file, escaping special characters and preventing SQL injection vulnerabilities if data from the CSV is used in SQL queries.
• B. Allow user to execute scripts or upload executable file as part of CSV content
• C. Assume that all uploaded files are safe and trustworthy, and directly process them without any security checks.
• D. Store the uploaded CSV files directly within a Snowflake table without any validation to ensure high performance and minimal overhead.
• E. Disable any logging or auditing of file upload activity to protect user privacy and avoid unnecessary data storage.

You are developing a Snowflake Native Application that processes sensitive customer dat a. You need to ensure that the application is secure and compliant with data privacy regulations. Which of the following security measures are MOST effective when designing your application package? (Select TWO)

• A. Encrypt all data at rest and in transit using Snowflake's built-in encryption features.
• B. Implement role-based access control (RBAC) to restrict access to sensitive data based on user roles within the application.
• C. Store all sensitive data in external stages managed by the provider account to isolate it from the consumer's Snowflake environment.
• D. Use obfuscation techniques on the data within the application, making it harder to be read.
• E. Bypass Snowflake's RBAC and authentication to manage access within the application.