SnowPro Advanced: Data Engineer free question 10 / 10 · Domain 5: Data Transformation
You tried to show a PDF in an internal stage that was created without specifying encryption to a BI tool through a pre-signed URL, but the file that opens is corrupted and cannot be read. Which fix matches the documentation?
- Create a new internal stage with SNOWFLAKE_SSE encryption and put the files in it again
- Change the encryption of the internal stage to SNOWFLAKE_SSE with ALTER STAGE and keep using the files as they are
- Extend the expiration of GET_PRESIGNED_URL to the maximum and issue the URL again
- Stop using pre-signed URLs and distribute the files with file URLs from BUILD_STAGE_FILE_URL
Show the answer and explanation
Answer: A
Why this is correct
If you do not specify server-side encryption when you create an internal stage, files are encrypted on the client side. The encryption key is held by Snowflake, so a file encrypted on the client side cannot be read by users or external tools, whether retrieved through a pre-signed URL, a file URL, or a scoped URL. An internal stage that serves unstructured data is created with CREATE STAGE specifying the encryption type SNOWFLAKE_SSE. The encryption type of an internal stage cannot be changed after it is created, so you create a new stage and put the files in it again.
Why the other options are wrong
"Change the encryption of the internal stage to SNOWFLAKE_SSE with ALTER STAGE and keep using the files as they are" … The encryption type of an internal stage cannot be changed after the stage is created. You cannot fix it while keeping the same stage.
"Extend the expiration of GET_PRESIGNED_URL to the maximum and issue the URL again" … The expiration only decides how long the URL can be used, and it does not change the problem that files encrypted on the client side cannot be read.
"Stop using pre-signed URLs and distribute the files with file URLs from BUILD_STAGE_FILE_URL" … Files encrypted on the client side cannot be read through file URLs either. Changing the kind of URL does not fix it unless the encryption of the stage changes.
Related settings
If you need Tri-Secret Secure for compliance, set the internal stage's encryption type to SNOWFLAKE_FULL. SNOWFLAKE_SSE does not support Tri-Secret Secure. The expiration of a pre-signed URL is specified in seconds, and the default is 3600 seconds.