SnowPro Specialty: Native Apps free question 2 / 10 · Domain 1: Design Snowflake Native Applications
A Declarative Share manifest gives the marketing app role a filtered view built on customer_table. A reviewer wants to be sure that marketing users can never reach the unfiltered rows. What does the app roles page say to do with customer_table itself?
- Add customer_table under a second role that marketing users hold
- Add customer_table with the marketing role so the view can resolve
- Add customer_table with the marketing role and a warning comment
- Leave customer_table out of the manifest content for that view
Show the answer and explanation
Answer: D
Why this is correct
The section "Assign application roles to content in the manifest file" gives the steps for assigning roles in a Declarative Share. Roles are defined in the top-level roles field and then assigned to content as lists. For filtered data, the page is explicit: when adding a filtered view of a table, don't add the underlying table; this prevents users from accessing the unfiltered data. The same rule applies to notebooks: when adding a notebook that references a filtered view of a table, don't add the underlying table. The filtered view is the only thing the marketing role should receive.
Why the other options are wrong
"Add customer_table with the marketing role so the view can resolve" … Giving the table the marketing role hands marketing users the unfiltered table next to the filtered view, which is the exposure the reviewer wants to avoid.
"Add customer_table under a second role that marketing users hold" … Any role that marketing users hold opens the table to them, whatever its name. The unfiltered rows would again be within their reach.
"Add customer_table with the marketing role and a warning comment" … A comment describes a role or object; it does not limit access. With the marketing role assigned, the users can query the unfiltered table regardless of the comment.
Design the views first
Application roles let a provider categorize data so that consumers can delegate each category to a team. The protection depends on what the manifest exposes: a filtered view protects data only if the table behind it stays out of the shared content.