Exam NAS-C01 Topic 1 Question 54 Discussion

Actual exam question for Snowflake's NAS-C01 exam
Question #: 54
Topic #: 1

You are developing a Snowflake Native App that requires granular access control to its underlying data for consumer accounts. You want to implement a secure pattern that limits direct access to the data while allowing specific operations through your app's procedures. Which of the following approaches represent the MOST secure and recommended practices regarding access control in the setup script, assuming you also want to grant USAGE on future schema?

A. Granting SELECT privilege directly on the underlying tables in the app's data schema to the consumer's role.

B. Creating secure views on top of the underlying tables and granting SELECT privilege on these views to the consumer's role, while ensuring consumers can only access the exposed view.

C. Creating stored procedures with the 'EXECUTE AS CALLER privilege and granting USAGE on the schema to the consumer's role. The stored procedures handle all data access logic.

D. Granting OWNERSHIP on the app's data schema to the consumer's role, allowing them full control over the data.

E. Creating stored procedures with the 'EXECUTE AS OWNER privilege and granting USAGE on the schema to the consumer's role. The stored procedures handle all data access logic.

Suggested Answer: C,E Vote an answer

Granting SELECT directly is insecure (A). Secure views provide some abstraction but still allow direct SELECT (B). Granting OWNERSHIP gives excessive privileges (D). Stored procedures with EXECUTE AS OWNER or 'EXECUTE AS CALLER , combined with limited schema privileges, offer the best control and security. 'EXECUTE AS OWNER' allows the procedure to run with the privileges of the app itself, bypassing consumer privileges, and 'EXECUTE AS CALLER' uses consumer's priviledges, but still contains the data logic. Both combined, gives the best secure and recommended access control.

by Eli at Jun 06, 2026, 11:22 AM

Limited Time Offer

15%

Off

Get Premium NAS-C01 Questions as Interactive Self Test Engine or PDF

Comments

0 Satisfied Customers

0 Shares

0 Demo Downloads

10 Years in Business