Snowflake NAS-C01 : SnowPro Specialty - Native Apps

You're developing a Snowpark Container Services application. Your 'service.yaml' file defines a service named 'data_processor'. You want to create a service endpoint, 'ingest_endpoint' , that is secured and accessible only by authorized consumers of your Snowflake Native Application. Select the TWO SQL statements that, when used together, will correctly create and bind the service endpoint, ensuring proper OAuth authentication and authorization.

• A. BIND SERVICE ENDPOINT ingest_endpoint FOR SERVICE data_processor WITH AUTHENTICATION TYPE = NONE TO APPLICATION PACKAGE;
• B. ALTER SERVICE data_processor ADD ENDPOINT ingest_endpoint WITH AUTHENTICATION TYPE = OAUTH;
• C. CREATE SERVICE ENDPOINT ingest_endpoint FOR SERVICE data_processor WITH AUTHENTICATION TYPE = OAUTH;
• D. BIND SERVICE ENDPOINT ingest_endpoint FOR SERVICE data_processor WITH AUTHENTICATION TYPE = OAUTH TO APPLICATION PACKAGE;
• E. CREATE OR REPLACE SERVICE ENDPOINT ingest_endpoint FOR SERVICE data_processor WITH AUTHENTICATION TYPE = SNOWFLAKE_JWT;

You are developing a Snowflake Native Application that needs to securely access data in a consumer's account. The application requires the consumer to grant specific privileges to a custom role created and managed within the application package. Which of the following steps are absolutely essential for correctly configuring the application package to ensure this secure data access, and how should the setup script handle the privilege granting?

• A. Define the required privileges in the application package manifest (snowflake.yml). Ensure that the setup script includes commands to grant the specific privileges on the consumer's data to the application's custom role, using 'GRANT ON TO ROLE within an EXECUTE IMMEDIATE statement in the setup script. The setup script should also define the application role.
• B. Utilize a service account to access the data, providing the service account's credentials as part of the application setup. The application will then use the service account to access the consumer's data.
• C. Create a share from the provider account to the consumer account, granting the consumer read access to the application package's data. Then, use a setup script to grant ownership of the data to the application role after installation.
• D. The consumer must manually grant the necessary privileges to the application's role after the application is installed, as the application package cannot automatically modify the consumer's security settings.
• E. Grant the 'USAGE privilege on the consumer's database and schema to the application's role within the setup script. This implicitly allows the application to read all data within that schema.

You are managing a Snowflake Native Application that allows consumers to configure certain aspects of its behavior through a dedicated configuration table. The application logic relies on specific values within this table to function correctly. During a new version deployment, you need to ensure that existing consumer configurations are migrated to the new version's configuration table structure without disrupting the application's availability. Which of the following strategies would you use to perform a zero-downtime configuration migration?

• A. Drop the existing configuration table and recreate it with the new schema during the application upgrade process. The application will automatically adapt to the new schema once the upgrade is complete.
• B. Deploy the new application version with a feature flag that disables the configuration table dependency. Run a script in the background to migrate the data to the new table and then flip the feature flag to enable the new configuration.
• C. Rename the existing configuration table to a backup name. Create a new configuration table with the new schema. The application will start using the new empty table, and consumers can manually reconfigure their settings.
• D. Implement a parallel migration strategy. Create a new configuration table with the new schema alongside the existing one. Update the application code to read from both tables concurrently, prioritizing the new table if values are present. Schedule a background job to migrate data from the old table to the new table. Once the migration is complete and verified, switch the application to solely read from the new table and eventually drop the old one.
• E. Perform an in-place alteration of the existing configuration table to match the new schema. This might involve adding, dropping, or renaming columns. Update the application code to reflect these changes. If you need to rename tables, then use SALTER TABLE ... RENAME to minimize downtime.

Consider the following SQL code snippet within a Snowflake Native Application:

• A. The statement will execute successfully, but the 'session_id' will always be null as the 'READ SESSION' privilege does not apply within stored procedures.
• B. The statement will execute successfully, returning the session ID of the user who installed the Native Application.
• C. The statement will execute successfully, returning the session ID of the current session in which the stored procedure is running, provided the Native App has the 'READ SESSION' privilege (implicitly or explicitly).
• D. The statement will fail because the READ SESSION' privilege is not automatically granted to stored procedures. You must explicitly grant the privilege to the stored procedure's owner.
• E. The statement will execute successfully, returning the session ID of the current session in which the stored procedure is running, provided the caller has USAGE privilege on the database.

A data engineering team is developing a Snowflake Native Application that processes sensitive PII dat a. They need to update the application frequently with bug fixes and performance improvements without disrupting user access. Which of the following strategies BEST balances rapid iteration with data security and minimal downtime? Consider that the application uses a secure UDF that needs to be updated in conjunction with other application code.

• A. Completely rebuild the application package for each release, pushing a new application to Snowflake Marketplace, forcing users to uninstall and reinstall. This guarantees a clean state but may cause disruptions.
• B. Use versioning, leveraging application roles and grants to control access to specific application versions. Employ automated rollout procedures to progressively expose new versions to consumers using application lifecycle management features.
• C. Use versioning, creating a new version of the application package for each set of changes, and instruct consumers to manually update their application instances to the latest version.
• D. Implement in-place upgrades to the application package every time a bug fix is released, granting UPDATE privileges on the underlying data tables to the application.
• E. Release patches as separate SQL scripts that consumers must manually apply to their installed application instances using the ACCOUNTADMIN role.