Account Access & Security - Quiz

Question 1

Snowflake uses the following access control schemes: Role Based Access Control (RBAC) and ___________.

Answer 1

Discretionary Access Control (DAC)

Question 2

Which system-define role is it recommended to assign custom roles to? Choose one correct value.
-ORGADMIN
-ACCOUNTADMIN
-SECURITYADMIN
-SYSADMIN
-USERADMIN

Answer 2

SYSADMIN

If custom roles are not assigned to the SYSADMIN role, system admins will not be able to manage the objects owned by the custom role.

Question 3

If the user property DISABLE_MFA was set to true, the user would need to re-enroll to use multi-factor authentication again. True or false?

Answer 3

True

Question 4

Network policies currently support which type of IP address?

Answer 4

IPv4

“Network policies currently support only Internet Protocol version 4 (i.e. IPv4) addresses.” - https://docs.snowflake.com/en/user-guide/network-policies.html

Question 5

Key rotation is the practice of transparently replacing existing account and table encryption keys every __ number of days.

Answer 5

30

Question 6

Only standard views can be designated as secure. True or false?

Answer 6

False

Question 7

The ACCOUNT_USAGE share contains a database called SNOWFLAKE. The views in this database are used to provide fine-grained metrics at the account and object level. What is the maximum number of months data in these views available for?

Answer 7

12

Certain account usage views provide historical usage metrics. The retention period for these views is 1 year.

Question 8

By default, which system-define role can access the SNOWFLAKE database?

Answer 8

ACCOUNTADMIN

Question 9

Account usage views record dropped objects. True or false?

Answer 9

True

Question 10

If the role ACCOUNTADMIN was currently active, what would a user see issuing a query that included an email column with the below column masking policy applied to it?

CREATE MASKING POLICY EMAIL_MASK AS (VAL STRING) RETURN STRING ->
CASE
WHEN CURRENT_ROLE() IN (‘ADMIN’) THEN VAL
WHEN CURRENT_USER() IN (‘DEVELOPER’) THEN REGEXP_REPLACE(VAL, ‘.+@’, ‘@’)
ELSE ‘**’
END;

Answer 10

A fully masked email

The ACCOUNTADMIN role would fall under the else condition in the policy body as it’s neither the ADMIN or DEVELOPER role, therefore returning the fully masked email.