Free SEA-C01 sample questions

Correct answer: The connection will succeed because user-level authentication policies override account-level authentication policies.

In Snowflake, when authentication policies are applied at multiple levels, the most granular level takes precedence. A policy attached directly to a user overrides a policy attached to the account. Therefore, the user-level policy disabling MFA will apply to the service account, allowing the automated pipeline to connect successfully.

Correct answers: The role that owns the Managed Access Schema.; Any role with the global `MANAGE GRANTS` privilege.

In a Managed Access Schema, the schema owner manages all privilege grants, including future grants, on objects within the schema. The role that creates an object inside the schema (the object owner) loses the ability to grant privileges on that object to other roles.

Roles with the global `MANAGE GRANTS` privilege (typically `SECURITYADMIN` or `ACCOUNTADMIN`) bypass standard ownership restrictions and can grant or revoke privileges on any object, including those within a Managed Access Schema.

Correct answer: OAUTH_CLIENT = 'CUSTOM', OAUTH_CLIENT_TYPE = 'PUBLIC', OAUTH_ACCESS_TOKEN_VALIDITY = 1800, and OAUTH_ISSUE_REFRESH_TOKENS = FALSE

To configure a custom OAuth client in Snowflake, the security integration must be created with `TYPE = OAUTH` and `OAUTH_CLIENT = CUSTOM`. The `OAUTH_ACCESS_TOKEN_VALIDITY` property is specified in seconds, so 30 minutes equals 1800 seconds. To prevent the issuance of refresh tokens, `OAUTH_ISSUE_REFRESH_TOKENS` must be set to `FALSE`. Setting these exact parameters ensures the tokens adhere to the stringent 30-minute lifespan without refresh capabilities. sequenceDiagram participant App as Custom Web App participant Auth as Authorization Server participant SF as Snowflake App->>Auth: Request Authorization Auth-->>App: Authorization Grant App->>Auth: Exchange Grant for Token Auth-->>App: Access Token (Expires in 1800s, No Refresh) App->>SF: API Request + Access Token SF-->>App: Data Payload

Correct answer: Network Rule

A Network Rule is a Snowflake object that groups network identifiers, such as IPv4 addresses or VPC endpoints, into a single logical unit. These rules can then be referenced by network policies (or external access integrations) to control traffic flow, making administration much more scalable than defining IPs directly inside multiple policies.

Correct answer: False

When `USE SECONDARY ROLES ALL` is executed, the user's session utilizes the aggregate (union) of all privileges granted to their primary role and all secondary roles, not the intersection. This allows the user to query cross-database objects seamlessly without constantly switching primary roles.

Correct answer: Assign the new public key to the user's `RSA_PUBLIC_KEY_2` property, update the client to use the new private key, and optionally remove the old key from `RSA_PUBLIC_KEY`.

Snowflake supports assigning up to two public keys to a single user (`RSA_PUBLIC_KEY` and `RSA_PUBLIC_KEY_2`). To achieve zero downtime during rotation, the engineer should assign the new key to `RSA_PUBLIC_KEY_2`. While both keys are active, the client is updated to use the new private key. Once the transition is verified, the old key can be safely removed from `RSA_PUBLIC_KEY`.