Account Management and Data Governance

A data governance officer must produce a report for a compliance audit showing exactly which columns were read by user queries over the past 90 days, including which base table columns were accessed through views. The officer wants an authoritative source that captures column-level read and write lineage. Which Snowflake feature should be used?

A data governance analyst needs to audit which users queried a specific table over the past 18 months. They plan to use the ACCOUNT_USAGE schema in the SNOWFLAKE database. When they query the QUERY_HISTORY view, they discover that records older than one year are missing. What is the reason for this behavior?

A governance analyst must build a report that lists every query executed across the account over the past 180 days, including queries run by users whose accounts have since been dropped. The analyst wants the most complete historical coverage and is willing to accept some data latency. Which data source should the analyst query?

A data governance analyst needs to build a monthly report showing the total average bytes of storage consumed by each individual table across the entire account, including bytes attributable to Time Travel and Fail-safe. They want a single query that requires ACCOUNTADMIN-level visibility across all databases. Which approach should they use?

A new data engineer joins your team and needs to create and manage warehouses, databases, and roles across the account, but company policy strictly forbids granting anyone the ability to view billing information or manage account-level parameters unless they are a designated administrator. Which approach best follows Snowflake's principle of least privilege while meeting these requirements?

A finance operations team wants to track and receive email notifications when the combined monthly credit consumption of a specific set of warehouses, serverless features, and materialized view maintenance for a project exceeds a defined spending limit. They need this to span multiple object types and send alerts without automatically suspending anything. Which Snowflake feature best meets this requirement?

A data engineer creates a new table called SALES.RAW.ORDERS while operating under a custom role named LOAD_ROLE. Later, an analyst using the REPORTING_ROLE reports they cannot query the table, even though an ACCOUNTADMIN confirms the table exists. Aside from using a higher system-defined role, which action correctly reflects Snowflake's discretionary access control model to grant the analyst access?

A data engineering team creates dozens of new tables in the ANALYTICS schema each week. The security administrator wants the REPORTING role to automatically have SELECT privileges on every table created in that schema going forward, without manually granting access to each new table. Which command accomplishes this?

A data engineering team runs an automated ELT pipeline using a dedicated Snowflake service account. Security policy prohibits interactive password prompts and requires MFA for all human logins, but the service account must authenticate non-interactively from a scheduled job. Which authentication method should the team configure for the service account, and what best practice applies?

A data governance team must ensure that a customer email column in the CUSTOMERS table shows real values only to users with the PII_ADMIN role, while all other users see a fully masked value. The solution must apply automatically to every query, including SELECT *, and must be reusable across multiple columns. Which Snowflake feature should the team implement?

A security administrator at a financial services firm wants to reduce the risk of compromised credentials for a small group of privileged users who authenticate with username and password. The firm does not use an identity provider for SSO. Management asks for the fastest way to add a second authentication factor for these specific users without changing how the rest of the organization logs in. What should the administrator do?

A security engineer configures an account-level network policy with an allowed IP list of 203.0.113.0/24 and a blocked IP list that includes 203.0.113.55. A user attempts to connect to Snowflake from the IP address 203.0.113.55. What is the result of the connection attempt?

A data engineer needs to safely drop a base table but first wants to identify every view and materialized view and external table that references it, so nothing breaks after the change. Which Account Usage view should the engineer query to perform this impact analysis?

A data governance team at a healthcare company wants to classify columns containing PII across many tables. They create a tag named PII_CLASS and assign it to a specific column. Later, a developer clones the entire schema into a development environment. What is the expected behavior of the tag assignment, and how can the team find all objects using this tag account-wide?

A data engineering team has three warehouses: WH_ETL, WH_BI, and WH_ADHOC. Leadership wants a single overall credit cap of 5,000 credits per month across the entire Snowflake account, regardless of how many warehouses exist. When any warehouse consumes credits toward this shared limit and 100% is reached, all warehouses should be suspended. How should an administrator configure resource monitors to meet this requirement?

A data engineering team creates a resource monitor with a credit quota of 5000 and sets the frequency to MONTHLY. Halfway through the month, the account has consumed 4800 credits and the team wants to understand what happens to the used-credit total at the start of the next calendar month. What behavior should they expect?

A data engineering team wants to be alerted when their dedicated warehouse consumes 80% of its monthly credit quota, but under no circumstances should Snowflake suspend the warehouse or block queries. They configure a resource monitor assigned to the warehouse with a monthly quota. Which trigger action configuration meets this requirement?

A data engineering team runs several warehouses under a single account. The FinOps lead wants to guarantee that once a monthly credit quota is reached, all associated warehouses stop consuming credits, even canceling any queries that are currently running. They also want an email warning when usage reaches 80% of the quota, without taking any action at that threshold. Which resource monitor configuration meets these requirements?

A Snowflake administrator creates a custom role hierarchy for an analytics team. The role DATA_ANALYST is granted to the role TEAM_LEAD, and TEAM_LEAD is granted to SYSADMIN. The DATA_ANALYST role has SELECT privileges on the SALES schema. A user is granted only the TEAM_LEAD role and uses it as their active role. Which statement correctly describes the privileges available to this user?

A global sales company stores all order records in a single table. Regional analysts should only see rows for their own region, while a global compliance team must see all rows. The security team wants to enforce this filtering automatically at query time without maintaining separate tables or views per region. Which Snowflake governance feature should they implement?