Manage Access Control for Data Pipelines DEA-C02 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A data pipeline uses a stream on a source table and a task that consumes the stream. The team wants to ensure that only the role PIPELINE_OWNER can modify the task definition, but a separate role DATA_SCIENCE should be able to read the stream's data for analysis without affecting the pipeline. What is the minimum privilege to grant to DATA_SCIENCE on the stream?

   • AMONITOR on the stream.
   • BOWNERSHIP on the stream.
   • CSELECT on the stream.
   • DOPERATE on the stream.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A data engineering team manages a pipeline that loads sensitive financial data from an external stage into a table, then runs a series of tasks. The compliance team requires that no single engineer can both modify the pipeline definition and execute it in production. The pipeline is currently owned by a single role, PIPELINE_OWNER, which all engineers hold. What should the team implement to satisfy the separation-of-duties requirement?

   • AGrant all engineers the MONITOR privilege on the tasks and rely on access history to detect unauthorized changes after the fact.
   • BKeep the single PIPELINE_OWNER role but require engineers to use a different warehouse for production runs than for development changes.
   • CCreate a single role PIPELINE_ADMIN with all privileges and require engineers to log in with a shared service account for all pipeline operations.
   • DCreate two roles: PIPELINE_DEFINER with OWNERSHIP on the tasks and stages, and PIPELINE_EXECUTOR with only EXECUTE TASK and USAGE on the stage. Assign engineers to only one role based on their function.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security auditor needs to determine if any user has accessed a specific stage used by a pipeline via the GET command, which downloads files from the stage. The auditor has access to the ACCESS_HISTORY view. What additional information might they need to correlate the access with the GET command specifically?

   • AQuery the INFORMATION_SCHEMA.STAGE_STORAGE_USAGE view.
   • BQuery the TASK_HISTORY view to see if the access was from a task.
   • CCross-reference the ACCESS_HISTORY entries with the QUERY_HISTORY view to find the specific GET statements.
   • DUse the SHOW STAGES command to see the stage's URL.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a data pipeline, a developer creates tasks and a separate administrator approves and monitors their execution. Which access-control principle does this arrangement primarily support?

   • ASeparation of duties
   • BMandatory access control
   • CLeast privilege
   • DRole hierarchy
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which Snowflake object is used to grant a role the ability to execute a task that runs SQL statements on a schedule?

   • ATask
   • BStage
   • CWarehouse
   • DStream
   Reveal Solution Discussion Select an answer first