Implement Data Protection and Encryption ARA-C01 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security administrator wants to prevent users from downloading sensitive data from Snowflake to their local machines via external stages. Which configuration should be implemented?

   • ACreate a network policy that blocks all IP addresses outside the corporate network.
   • BUse a masking policy to mask all columns in tables that contain sensitive data.
   • CRevoke the CREATE STAGE privilege from all users.
   • DImplement a combination of network policies, role-based access controls, and monitoring of external stage usage.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the default encryption behavior for files in internal stages in Snowflake?

   • AFiles are encrypted using the customer's KMS key
   • BFiles are not encrypted by default
   • CFiles are encrypted only if the user specifies a client-side key
   • DFiles are automatically encrypted using Snowflake-managed keys
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In Snowflake's encryption key hierarchy, which key is used to encrypt the table master keys?

   • AAccount master key
   • BData encryption key
   • CCustomer master key
   • DRoot key
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A data engineer needs to load encrypted files from an external stage on AWS S3 into Snowflake. The files are encrypted with a customer-managed KMS key. The stage is already configured with the correct encryption settings. However, the COPY INTO command fails with a 'file not found' error. What is the most likely cause?

   • AThe KMS key ID in the stage definition is incorrect.
   • BThe Snowflake account does not have permission to access the KMS key.
   • CThe file path in the COPY command does not match the actual file location in the stage.
   • DThe files are encrypted with client-side encryption, but the stage is configured for server-side encryption.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A company uses Snowflake on GCP and has an external stage pointing to Google Cloud Storage (GCS). They need to unload data to this stage, but the security policy requires that the data be encrypted with a customer-managed key (CMK) stored in GCP KMS. The stage currently uses no encryption. Which action should the administrator take?

   • AEnable Tri-Secret Secure on the account to use the GCP KMS key for external stage encryption.
   • BAlter the external stage to set ENCRYPTION = (TYPE = 'GCS_SSE_KMS', KMS_KEY_ID = '<key-id>').
   • CCreate a new external stage with ENCRYPTION = (TYPE = 'GCS_SSE') and use the default GCS-managed key.
   • DUse the COPY command with the ENCRYPTION option to specify the KMS key.
   Reveal Solution Discussion Select an answer first