Exam NAS-C01 Topic 1 Question 234 Discussion

Actual exam question for Snowflake's NAS-C01 exam
Question #: 234
Topic #: 1

You are designing the setup script for a Snowflake Native Application. This application requires the creation of several views based on data residing in the consumer's account. These views need to be dynamically created based on a configuration table that is part of your application package. The configuration table contains view names, the underlying tables in the consumer's account, and the specific SQL queries for each view. The design must adhere to best practices for security and data governance. Which approach would you use for designing this setup script, considering security vulnerabilities and execution context?

A. Directly construct and execute the 'CREATE VIEW' statements within the setup script using string concatenation, reading the view definitions from the configuration table. This minimizes code complexity and ensures immediate view creation. B. Employ parameterized SQL (using '?' 7 placeholders) within the 'CREATE VIEW' statements, binding the view names and queries read from the configuration table. Execute these statements using 'EXECUTE IMMEDIATE to prevent SQL injection vulnerabilities. C. Use dynamic SQL generation with proper escaping functions (e.g., to prevent SQL injection. Store the generated SQL in a temporary table, and then execute each statement from the temporary table using 'EXECUTE IMMEDIATE D. Use a stored procedure, owned by the application, to dynamically generate and execute the 'CREATE VIEW statements. The stored procedure reads the view definitions from the configuration table and creates the views using dynamic SQL. E. Create a series of static 'CREATE VIEW' statements within the setup script, each targeting a predefined table in the consumer's account. The application will handle data filtering within these views.

Suggested Answer: D Vote an answer

Option D represents the most secure and maintainable approach. By using a stored procedure owned by the application, you encapsulate the dynamic SQL generation and execution within a controlled environment. This reduces the risk of SQL injection vulnerabilities because the stored procedure is executed with the privileges of the application, and not the installer or end user. Parameterized SQL (Option B) is not directly supported for object names or complex SQL structures in Snowflake. String concatenation (Option A) is highly vulnerable to SQL injection. Using a temporary table (Option C) adds unnecessary complexity without significantly improving security. Static views (Option E) are inflexible and don't address the requirement of dynamic view creation.

by Julie at Sep 17, 2026, 04:10 PM

Limited Time Offer

15%

Off

Get Premium NAS-C01 Questions as Interactive Self Test Engine or PDF

Comments

0 Satisfied Customers

0 Shares

0 Demo Downloads

10 Years in Business