Snowflake SnowPro Specialty - Native Apps Sample Questions:

1. You are tasked with developing a Snowflake Native App that leverages a Partner provided secret using an external function which will send the processed data to their system. You plan to store the OAuth information to be used by the external function in a secret object managed by Snowflake. Which of the following steps are NECESSARY to ensure secure and correct setup of this app? Select all the options that apply.

A) Grant the 'USAGE privilege on the API integration to the application role if the external function requires an API integration. GRANT USAGE ON API INTEGRATION TO APPLICATION ROLE
B) Bypass storing the OAuth token in Snowflake and instead rely on passing it as a parameter to the external function from the consumer account, documented clearly for the consumer's security responsibilities.
C) Store the OAuth token directly within the external function's definition as a variable, ensuring it is encrypted using AES ENCRYPT before deployment.
D) Grant the 'IMPORTED PRIVILEGES privilege on the database containing the Secret object to the application role. GRANT IMPORTED PRIVILEGES ON DATABASE TO APPLICATION ROLE '
E) Create a Secret object in Snowflake to store the OAuth token securely and reference it within the external function using 'SYSTEM$GET_SECRET function. Ensure proper access rights on the Secret object.

2. You've installed a Snowflake Native Application in your consumer account. You are trying to establish observability and telemetry to monitor its performance and identify potential issues. However, you notice that you only have limited visibility into the application's internal operations. Which actions should you take to enhance observability, assuming the provider has implemented appropriate mechanisms?

A) Subscribe to events shared by the application provider through Snowflake's event sharing mechanism, if the provider has enabled it. Leverage shared views exposing specific metrics.
B) Request the application provider to grant you direct access to the application's internal logs and system tables.
C) Use Snowflake's Query Profile to analyze the execution plans of queries initiated by the application.
D) Examine the APPLICATION USAGE view in the SNOWFLAKE database to track resource consumption and query performance of the application's components.
E) Enable detailed logging in your consumer account to capture all SQL statements executed by the application, then analyze these logs.

3. You are developing a Snowflake Native Application that provides data enrichment services. You want to monetize your application through the Snowflake Marketplace using a custom, usage-based pricing model. You need to track the number of API calls made by each consumer account and bill them accordingly. Which of the following steps are necessary to implement this in your application and listing configurations?

A) Implement a metering function within your Native Application using 'snowflake.snowpark.functions.metering'. Configure your application listing with a CONSUMPTION listing type and define metering events based on API calls made. Set the cost per metering event.
B) Implement a metering function using stored procedures, record API usage in a dedicated table within your application's container and use 'CREATE NOTIFICATION INTEGRATION' to send billing data to an external system for invoice generation.
C) Implement custom code to track API calls in a table within the application package and use a scheduled task to generate billing reports manually. This report is then shared outside of Snowflake Marketplace.
D) Implement a metering function within your Native Application using 'snowflake.snowpark.functions.metering'. Configure your application listing with a STANDARD listing type and set a base price.
E) Use Snowflake's data sharing capabilities to share a billing table with consumer accounts, tracking API calls externally and managing billing outside of the Snowflake Marketplace.

4. You are designing a Snowflake Native Application that requires managing application roles and permissions. Which of the following best practices should be followed regarding application roles and permissions in a Snowflake Native Application?

A) Use the 'EXECUTE AS OWNER clause for all stored procedures to avoid granting explicit privileges to the application roles.
B) Bundle all application logic within a single stored procedure owned by the 'APPLICATION' role.
C) Define granular application roles with specific permissions, and provide documentation to the consumer on how to grant these roles to their users.
D) Avoid using application roles altogether and rely solely on the consumer's existing roles and permissions.
E) Grant all necessary privileges to the 'APPLICATION' role during setup, as this simplifies permission management for consumers.

5. A Native Application developer is creating a data product to be sold on the Snowflake Marketplace. The application needs read access to a shared database called 'RETAIL DATA'. The application logic includes a function that reads a lookup table, 'PRODUCT CATEGORIES', within this shared database. Which sequence of actions, executed by the application provider, ensures the application can access this table at installation time and after updates, following least privilege principles?

A) Grant 'IMPORTED PRIVILEGES' on 'RETAIL DATA to the application role. Rely on the consumer to grant 'SELECT access to tables within 'RETAIL DATA' to the application role.
B) Grant USAGE on ' RETAIL_DATX to the application role during the application's setup script. Do not grant 'IMPORTED PRIVILEGES' on the database.
C) Grant 'IMPORTED PRIVILEGES' on to the application role. Grant 'SELECT on to the application role during the application's setup script.
D) Grant 'IMPORTED PRIVILEGES' on 'RETAIL DATA' to the application role. The application setup script should also GRANT USAGE on database RETAIL_DATA and then GRANT SELECT on to the application role.
E) Grant 'SELECT on to the application role during the application's setup script. Do not grant 'IMPORTED PRIVILEGES' on the database.

Solutions: