ADA-C02 Exam Dumps - Snowflake SnowPro Advanced: Administrator Questions and Answers

Snowflake Time Travel preserves historical data versions to support recovery operations such as querying previously modified data, cloning historical objects, and restoring dropped objects.

The default Time Travel retention period for transient databases, schemas, and tables is one day, regardless of whether the account uses Enterprise Edition or a higher edition.

Option A is therefore correct.

Unlike permanent tables, transient tables do not benefit from Snowflake's seven-day Fail-safe retention period. Their Time Travel retention can be configured to zero or one day, and historical data is not recoverable through normal Time Travel operations after the applicable period expires.

Option D is a plausible distractor because Enterprise Edition and higher support Time Travel retention periods of up to 90 days for permanent databases, schemas, and tables. However, this extended retention capability does not apply to transient tables.

Options B and C describe durations that are unavailable for transient tables.

Administrators should carefully distinguish between a database's default retention setting and the maximum retention supported by its contained table types. Creating a transient database does not provide extended historical recovery merely because the account uses Enterprise Edition.

Transient objects are primarily appropriate for intermediate, reproducible, or noncritical datasets where reduced storage overhead is more important than extended recovery protection.

Official Snowflake references: Working with Temporary and Transient Tables: Comparison of Table Types; Understanding & Using Time Travel.

Snowflake warehouses maintain a local cache of frequently accessed table data on their compute resources. This cache can reduce repeated remote storage reads when subsequent queries access the same micro-partitions.

Setting AUTO_SUSPEND to 0 or NULL disables automatic warehouse suspension. Consequently, the warehouse remains running and its local data cache remains available, assuming the underlying compute resources are retained.

Option C is correct because this can benefit dashboard workloads that repeatedly query overlapping datasets, particularly when different reports access similar table partitions.

Option D incorrectly associates warehouse suspension with the persisted query result cache. Snowflake maintains persisted query results independently of warehouse-local storage. Eligible results can be reused even after a warehouse has been suspended.

Option B contradicts the proposed configuration because disabling suspension causes the warehouse to remain active during idle periods.

Option A is not the primary caching rationale and is misleading as a general cost-saving claim.

Operational qualification: Snowflake explicitly cautions against disabling automatic suspension unless a continuously running warehouse is justified. A warehouse consumes credits while running, even without active queries. Snowflake recommends evaluating cache benefits against idle compute costs and generally suggests an auto-suspend interval of at least ten minutes for applicable BI workloads.

Official Snowflake references: Optimizing the Warehouse Cache; CREATE WAREHOUSE; Warehouse Considerations.

Snowflake resource monitors provide administrative controls for tracking virtual warehouse credit consumption and responding when configured thresholds are reached.

Option C is correct because resource monitors track consumption through Snowflake's account-management infrastructure rather than executing monitoring queries on the assigned virtual warehouses. Consequently, their monitoring activity does not impose additional workload on warehouse compute.

Option D is correct because a resource monitor supports multiple configurable triggers. Administrators can specify percentage thresholds that initiate notifications, suspend warehouses after running statements complete, or immediately suspend warehouses and cancel executing statements.

Option F is correct because a warehouse-level resource monitor can be assigned to multiple virtual warehouses. Their combined credit consumption is evaluated against the monitor's quota.

Option A is incorrect because Snowflake does not define the claimed daily monitoring charge.

Option B is incorrect because an individual virtual warehouse can be assigned to only one warehouse-level resource monitor.

Option E is incorrect as written. Although resource-monitor creation is restricted to ACCOUNTADMIN, Snowflake does not document the proposed CREATE MONITOR privilege as an alternative authorization mechanism for creating resource monitors. MONITOR and MODIFY are separate privileges that can be granted on existing resource monitors.

Official Snowflake references: Working with Resource Monitors; CREATE RESOURCE MONITOR.

Answer: B and C

Explanation

B. Administrators can monitor and understand usage across all accounts in the organization (Correct): Snowflake Organizations introduces the ORGANIZATION_USAGE schema and Snowsight Admin views. This allows users with the ORGADMIN role to centrally track credit consumption, storage usage, and billing across all accounts within the business entity.

C. Administrators can simplify data movement across all accounts within the organization (Correct): Organizations streamline cross-account and cross-region operations by enabling native database replication, failover/failback groups, and secure data sharing without requiring custom pipeline infrastructure.

Why the Other Options Are Incorrect

A is incorrect: Account editions (Standard, Enterprise, Business Critical) cannot be switched dynamically or on-demand by an administrator; changing an existing account’s edition typically requires contacting Snowflake Support.

D is incorrect: User administration and access control remain account-scoped. Snowflake Organizations does not provide centralized, cross-account user identity management or unified SCIM provisioning.

E is incorrect: Although administrators can self-provision accounts across major supported cloud providers (AWS, Azure, GCP), this capability is bounded by organization contract agreements, account limits, and region availability (certain isolated or government cloud regions cannot be freely created on-demand).

Official Snowflake references: Introduction to Organizations; Working with Account Editions; Organization Users; January and May 2026 general-availability announcements.

Snowflake provides temporary MFA bypass functionality to recover user access when an enrolled authentication device becomes unavailable. The appropriate administrative action is to configure the MINS_TO_BYPASS_MFA property on the affected user.

For example:

ALTER USER user1

SET MINS_TO_BYPASS_MFA = 30;

This command permits the user to authenticate temporarily without completing MFA for the configured 30-minute period. Importantly, the operation does not revoke the user's existing MFA enrollment or permanently disable the authentication requirement.

Option B is unsuitable because DISABLE_MFA is a Boolean setting and does not automatically provide a 24-hour expiration period. It is not equivalent to a controlled, time-limited bypass.

Option C is incorrect because Snowflake supports MFA authentication through SnowSQL and other supported clients. Changing the connection client does not inherently eliminate MFA enforcement.

Option D proposes an unsupported URL-based authentication bypass.

From a security-administration perspective, the administrator should first validate the user's identity through an approved recovery procedure, establish the shortest practical bypass interval, and guide the user through registration of a replacement MFA method.

Current Snowflake documentation also describes ALTER USER ... ENROLL MFA as a recovery mechanism for users who must register a new authenticator.

Official Snowflake references: Multi-factor Authentication; Recovering a User Who Is Locked Out; ALTER USER.

Snowflake external tables provide a relational interface for querying structured and semi-structured data files stored outside Snowflake, typically in cloud object storage such as Amazon S3, Azure Blob Storage, or Google Cloud Storage.

An external table references files through an external stage. Snowflake maintains file-level metadata and exposes the external data through a table-like abstraction, allowing SQL queries without requiring an initial COPY INTO operation to populate an internal Snowflake table.

This simplifies data pipelines when source files must remain in cloud storage, particularly for data lakes, historical archives, and externally managed datasets.

Option A describes accessing Snowflake from another relational database, which is not the purpose of an external table.

Option B similarly concerns external database connectivity rather than querying files stored in an external stage.

Option C describes exporting data from Snowflake to external storage, a process generally implemented through unloading operations such as COPY INTO a storage location.

Option D correctly identifies the external-table use case.

External tables are read-only and do not support conventional INSERT, UPDATE, or DELETE operations. Query performance may also be lower than native Snowflake tables because the underlying data remains externally stored.

Official Snowflake references: Introduction to External Tables; Creating External Tables; Querying External Tables.

Snowflake provides the SIMULATED_DATA_SHARING_CONSUMER session parameter to allow data providers to validate how shared secure views behave when accessed from a specified consumer account.

This is important when secure views apply account-dependent filtering, such as restricting individual consumers to their permitted subsets of shared data.

An administrator can configure a test session using:

ALTER SESSION

SET SIMULATED_DATA_SHARING_CONSUMER =

'ORGNAME.ACCOUNTNAME';

The administrator can then query the secure view and inspect the rows that would be returned to the specified consumer account.

Option D is correct because it identifies the documented session parameter.

Options A, B, and C reference unsupported parameter names.

Snowflake requires the role executing the simulation to own the secure view. A session using a different role cannot perform the simulation merely because that role has SELECT access.

The parameter is intended specifically for testing shared secure views and secure materialized views, not for changing the actual consumer identity or granting access.

Administrative qualification: Snowflake explicitly advises against setting this parameter at the account level. Although the parameter's definition supports multiple configuration scopes, its effects should be limited to controlled testing sessions.

Simulation also does not replace end-to-end validation of consumer privileges, authentication, and share configuration.

Official Snowflake references: Parameters — SIMULATED_DATA_SHARING_CONSUMER; Create and Configure Shares; Use Secure Objects to Control Data Access.

The ORGADMIN role provides organization-level administrative capabilities across Snowflake accounts. Its responsibilities are distinct from database administration and object-level security management within individual accounts.

Option A is correct because organization administrators can create and manage Snowflake accounts across supported cloud platforms and regions. This enables centralized account provisioning without requiring independent account-creation procedures for each deployment.

Option B is correct because organization administrators can execute SHOW REGIONS to identify the regions available for account creation. The returned information includes Snowflake region identifiers and their corresponding cloud providers.

Option D is correct because organization administrators can access organization-wide consumption and administrative information through the SNOWFLAKE.ORGANIZATION_USAGE schema, subject to the applicable organization-account access model.

Option C is incorrect because creating secure views requires the appropriate privileges within the account containing the database objects.

Option E is incorrect because zero-copy cloning is controlled by database and object-level privileges rather than organization-administrator authority.

Option F is incorrect because reader-account creation is an account-level data-sharing operation.

Important current documentation update: Snowflake is phasing out ORGADMIN administration in regular accounts for multi-account organizations. The recommended approach is to use GLOBALORGADMIN in a dedicated organization account. The original answer remains valid for the ORGADMIN role described in the question.

Official Snowflake references: Organization Administrators; SHOW REGIONS; Organization Usage.

Snowflake implements a hierarchical system of predefined administrative roles to separate identity administration, security governance, and object management responsibilities.

USERADMIN is primarily responsible for creating and administering users and roles. It has the CREATE USER and CREATE ROLE global privileges by default.

SECURITYADMIN occupies a higher position in the standard role hierarchy and inherits USERADMIN's capabilities.

In addition, SECURITYADMIN possesses the global MANAGE GRANTS privilege, which authorizes administrators to grant and revoke privileges across the Snowflake account.

Option B is therefore correct because managing account-wide privilege grants is a capability assigned to SECURITYADMIN but not automatically granted to USERADMIN.

Option A is incorrect because USERADMIN can manage credentials for users it owns or otherwise has authorization to modify.

Options C and D are incorrect because user and role creation are foundational USERADMIN responsibilities.

An important security distinction is that MANAGE GRANTS enables privilege administration but does not automatically grant direct access to all protected data or confer object-creation privileges.

For example, SECURITYADMIN may grant SELECT on a table to a role without necessarily having the SELECT privilege itself.

Organizations should delegate these responsibilities through appropriate custom roles rather than granting SECURITYADMIN broadly to users performing routine identity-management tasks.

Official Snowflake references: Overview of Access Control: System-defined Roles; Access Control Best Practices.

Snowflake Secure Data Sharing allows a provider to expose selected database objects to consumers in other Snowflake accounts without transferring ownership of the underlying data.

When a secure view implements account-dependent row filtering, the provider must identify the consumer account executing the query. The CURRENT_ACCOUNT() function provides this information and can be incorporated into the view's filtering logic.

For example, a secure view can restrict rows to the requesting consumer:

CREATE SECURE VIEW SHARED_CUSTOMERS AS

SELECT *

FROM CUSTOMER_DATA

WHERE CONSUMER_ACCOUNT = CURRENT_ACCOUNT();

Option B is correct because CURRENT_ACCOUNT identifies the account associated with the requesting session.

Options A and C are unsuitable for this particular cross-account authorization mechanism. Snowflake documents that CURRENT_ROLE and CURRENT_USER return NULL in shared secure-view contexts because the provider does not control the identities and roles belonging to the consumer account.

Option D is incorrect because CURRENT_CLIENT is not the documented context function for identifying a Snowflake data-sharing consumer.

Current functionality qualification: Shared database roles provide another mechanism for controlling access to shared objects. Snowflake also supports the IS_DATABASE_ROLE_IN_SESSION function for applicable database-role-based security policies. However, when authorization depends specifically on the consumer's account identity, CURRENT_ACCOUNT remains the appropriate answer.

Official Snowflake references: Working with Secure Views: Secure Views and Data Sharing; Understanding Column-level Security.