SnowPro Specialty: Native Apps free question 3 / 10 · Domain 2: Build Snowflake Native Applications
An app uses automated granting of privileges and received CREATE WAREHOUSE when the consumer installed it. Months later, the consumer's administrator decides to take that privilege back from the app. What does the automated granting page say?
- The administrator revokes it with REVOKE, as for other granted privileges
- Privileges granted this way at install or upgrade can't be revoked
- It can be revoked through Snowsight, but not with a SQL statement
- It can be revoked, and the next upgrade will not grant it to the app
Show the answer and explanation
Answer: B
Why this is correct
The section "Overview of automated granting of privileges" explains that apps often need privileges in the consumer account, for example to create and start warehouses and compute pools, access data or connect to external endpoints. With automated granting of privileges, the provider specifies the required privileges in the manifest file, and when the consumer installs or upgrades the app they are granted automatically. Because of this, the provider must communicate the privileges and their potential impact so that they are visible to the consumer when evaluating and installing the app. After privileges are automatically granted during installation or upgrade, these privileges cannot be revoked.
Why the other options are wrong
"The administrator revokes it with REVOKE, as for other granted privileges" … The page sets automatically granted privileges apart: after they are granted during installation or upgrade, they cannot be revoked.
"It can be revoked, and the next upgrade will not grant it to the app" … The page says such privileges cannot be revoked, and a consumer who installs the app agrees that it may be granted these privileges during upgrades without additional consent.
"It can be revoked through Snowsight, but not with a SQL statement" … The rule does not depend on the interface. Once granted automatically, the privileges cannot be revoked by either route.
Disclosure is the provider's job
Since the consumer cannot take these privileges back, the listing and readme should explain each one and why the app needs it. Snowsight also shows a notification about the requested privileges during installation.