Free Practice Questions for the Snowflake SnowPro Advanced: Administrator ADA-C02 Exam (2026 Updated)

Snowflake associates an account-level network policy through the NETWORK_POLICY account parameter. Administrators can inspect this parameter using SHOW PARAMETERS.

Option B is clearly intended to retrieve the account-level policy assignment, but its SQL contains a substantive error.

The source specifies NETWORK POLICY with a space. Snowflake's actual account parameter is NETWORK_POLICY, with an underscore.

The correct command is:

SHOW PARAMETERS LIKE 'NETWORK_POLICY'

IN ACCOUNT;

Snowflake uses SQL-style pattern matching for the LIKE filter. A space is not interchangeable with an underscore, so the original option B does not match the intended parameter.

Option A is not valid SHOW NETWORK POLICIES syntax for identifying the active account assignment.

Option C lists existing network policies but does not, by itself, identify the one assigned to the account.

Option D describes a specified network policy rather than retrieving the current account-level assignment.

The correct operational approach is to query the NETWORK_POLICY parameter or inspect the applicable policy references through Snowflake's supported administrative views and functions.

Mandatory correction: The supplied question has no fully correct SQL answer as written. Replace the space in option B with an underscore before publishing the item.

Official Snowflake references: Controlling Network Traffic with Network Policies; SHOW PARAMETERS; Parameter Management.

Snowflake database replication incurs costs associated with transferring changed data and performing replication operations. These expenses are attributed to the target account containing the secondary database.

Option B is correct because the volume of modified table data affects the amount of information that must be synchronized. Large INSERT, UPDATE, DELETE, and data-loading operations can increase replication activity and its associated charges.

Option C is correct because the secondary database's refresh frequency influences the overall replication workload. More frequent synchronization can create additional replication processing and transfer activity.

Snowflake explicitly identifies changed data volume and refresh frequency as the principal variables influencing monthly replication charges.

Option A concerns the frequency of individual source modifications rather than the documented billing dimensions. Numerous small changes and a smaller number of large changes can produce very different replication volumes.

Option D describes aspects of cross-region data movement, which can affect transfer pricing, but it is not the general cost-driver formulation requested by the question.

Option E is incorrect because replication is performed using Snowflake-managed resources rather than the primary account's virtual warehouse configuration.

Current-version qualification: Snowflake now documents multiple replication billing modes, including Replication Classic, Optimized Refresh, and RPO Assurance. Their compute charging models differ, but replicated data volume and refresh behavior remain important cost considerations.

Official Snowflake references: Understanding Replication Cost: Estimating and Controlling Costs.

Snowflake separates warehouse execution, monitoring, and administration through distinct privileges. The accountant role requires USAGE to execute financial-reporting queries and MONITOR to inspect warehouse activity and consumption statistics.

The USAGE privilege authorizes a role to submit queries to the specified virtual warehouse. Because report_wh has AUTO_RESUME=TRUE, Snowflake automatically resumes the suspended warehouse when a query is submitted. Consequently, the accountant role does not require OPERATE merely to execute reports.

The MONITOR privilege enables inspection of current and historical warehouse queries and usage statistics. This provides the necessary visibility into warehouse activity and compute consumption without allowing modification of warehouse configuration.

AUTO_SUSPEND=300 directs Snowflake to suspend the warehouse following approximately five minutes of inactivity, reducing unnecessary compute consumption.

Option A grants additional authority to suspend and resume the warehouse manually. Option B permits administrative configuration changes, including resizing. Option E grants full ownership-level control and violates the principle of least privilege.

Therefore, granting MONITOR and USAGE satisfies the specified operational requirements without introducing unnecessary administrative permissions.

For account-wide billing and consumption analysis, administrators should distinguish warehouse-level MONITOR from the separate global MONITOR USAGE privilege.

Official Snowflake references: Access Control Privileges: Virtual Warehouse Privileges; Configuring Access Control; Virtual Warehouse Credit Usage.

Snowflake supports automated identity provisioning through the System for Cross-domain Identity Management (SCIM) protocol. When Okta acts as the identity provider, a SCIM security integration establishes the provisioning interface used to create, update, and deactivate Snowflake users and roles.

For an existing integration named OKTA_PROVISIONING, the administrator can activate the ACCOUNTADMIN role and generate a SCIM access token using:

USE ROLE ACCOUNTADMIN;

SELECT SYSTEM$GENERATE_SCIM_ACCESS_TOKEN(

'OKTA_PROVISIONING'

);

```

Snowflake explicitly documents that the token returned by SYSTEM$GENERATE_SCIM_ACCESS_TOKEN remains valid for six months. Therefore, the 12-month rotation intervals in options A and B are incorrect.

Option C creates an integration but does not generate the access token required by the legacy token-based authentication workflow. Option D correctly identifies both token generation and the six-month expiration period.

The generated token must be securely configured within the Okta Snowflake provisioning application and renewed before expiration to prevent provisioning failures. Generating a replacement token does not automatically invalidate previously issued tokens.

Verification qualification: Option D assumes that the SCIM integration already exists. It is incomplete as an end-to-end configuration procedure. Snowflake now also documents External OAuth and programmatic access tokens for SCIM authentication, with the six-month SCIM access token described as a legacy method.

Official Snowflake references: SYSTEM$GENERATE_SCIM_ACCESS_TOKEN; CREATE SECURITY INTEGRATION (SCIM); Authenticating SCIM API Requests.

Snowflake configures OAuth 2.0 authentication through a security integration created using the CREATE SECURITY INTEGRATION statement. The integration defines the relevant OAuth authentication and authorization settings, depending on whether Snowflake OAuth or External OAuth is implemented.

Creating an OAuth security integration requires the global CREATE INTEGRATION privilege on the Snowflake account.

The ACCOUNTADMIN system role possesses this privilege by default. Therefore, ACCOUNTADMIN is the appropriate selection when evaluating the standard system-role configuration without additional privilege delegation.

Option A is incorrect because USAGE on an existing security integration does not provide authority to create a new integration.

Options B and C are incorrect because neither SYSADMIN nor SECURITYADMIN is inherently required to participate in creation. These roles also do not receive the required CREATE INTEGRATION privilege merely through their default administrative responsibilities.

The following statement illustrates the intended administrative context:

USE ROLE ACCOUNTADMIN;

CREATE SECURITY INTEGRATION oauth_integration

TYPE = OAUTH

ENABLED = TRUE

OAUTH_CLIENT = CUSTOM;

```

Additional integration parameters may be required depending on the OAuth implementation.

Verification qualification: The phrase "ACCOUNTADMIN only" is technically too restrictive. Snowflake explicitly permits the CREATE INTEGRATION privilege to be granted to other roles. Thus, D is the intended answer for default system-role privileges, but not an absolute authorization rule.

Official Snowflake references: CREATE SECURITY INTEGRATION (Snowflake OAuth); CREATE SECURITY INTEGRATION (External OAuth); Configure Snowflake OAuth for Partner Applications.

Snowflake implements a hierarchical system of predefined administrative roles to separate identity administration, security governance, and object management responsibilities.

USERADMIN is primarily responsible for creating and administering users and roles. It has the CREATE USER and CREATE ROLE global privileges by default.

SECURITYADMIN occupies a higher position in the standard role hierarchy and inherits USERADMIN's capabilities.

In addition, SECURITYADMIN possesses the global MANAGE GRANTS privilege, which authorizes administrators to grant and revoke privileges across the Snowflake account.

Option B is therefore correct because managing account-wide privilege grants is a capability assigned to SECURITYADMIN but not automatically granted to USERADMIN.

Option A is incorrect because USERADMIN can manage credentials for users it owns or otherwise has authorization to modify.

Options C and D are incorrect because user and role creation are foundational USERADMIN responsibilities.

An important security distinction is that MANAGE GRANTS enables privilege administration but does not automatically grant direct access to all protected data or confer object-creation privileges.

For example, SECURITYADMIN may grant SELECT on a table to a role without necessarily having the SELECT privilege itself.

Organizations should delegate these responsibilities through appropriate custom roles rather than granting SECURITYADMIN broadly to users performing routine identity-management tasks.

Official Snowflake references: Overview of Access Control: System-defined Roles; Access Control Best Practices.

The ORGADMIN role provides organization-level administrative capabilities across Snowflake accounts. Its responsibilities are distinct from database administration and object-level security management within individual accounts.

Option A is correct because organization administrators can create and manage Snowflake accounts across supported cloud platforms and regions. This enables centralized account provisioning without requiring independent account-creation procedures for each deployment.

Option B is correct because organization administrators can execute SHOW REGIONS to identify the regions available for account creation. The returned information includes Snowflake region identifiers and their corresponding cloud providers.

Option D is correct because organization administrators can access organization-wide consumption and administrative information through the SNOWFLAKE.ORGANIZATION_USAGE schema, subject to the applicable organization-account access model.

Option C is incorrect because creating secure views requires the appropriate privileges within the account containing the database objects.

Option E is incorrect because zero-copy cloning is controlled by database and object-level privileges rather than organization-administrator authority.

Option F is incorrect because reader-account creation is an account-level data-sharing operation.

Important current documentation update: Snowflake is phasing out ORGADMIN administration in regular accounts for multi-account organizations. The recommended approach is to use GLOBALORGADMIN in a dedicated organization account. The original answer remains valid for the ORGADMIN role described in the question.

Official Snowflake references: Organization Administrators; SHOW REGIONS; Organization Usage.

Snowflake Dynamic Data Masking enforces column-level protection at query execution time. Masking policies determine whether the querying context receives the original value or a transformed representation.

Option B is correct because the same masking policy can be assigned to multiple compatible columns across different tables or views. This supports centralized governance and consistent protection of sensitive fields throughout an environment.

Option C is also correct. Snowflake supports assigning a masking policy to an external table's automatically generated VALUE column. The policy must accept and return the VARIANT data type, and the assignment must be performed using an ALTER TABLE statement rather than during initial external-table creation.

Option A is incorrect because a masking policy cannot normally be dropped while it remains associated with a column or tag. The administrator must first remove the applicable assignment.

Option D is incorrect because creating a policy does not automatically authorize viewing unmasked data. Visibility depends on the policy expression and execution context.

Option E is incorrect because a masking policy's argument and return signatures impose data-type compatibility requirements. One policy cannot be freely attached to columns of unrelated types.

This distinction is important when implementing reusable policies and managing external data.

Official Snowflake references: Understanding Column-level Security; DROP MASKING POLICY; Tag-based Masking Policies.

Snowflake Secure Data Sharing allows accounts within the same region to access shared datasets without copying the underlying data into separate consumer storage.

This makes direct sharing particularly suitable for offices operating within a common Snowflake region.

However, accounts deployed in different geographical regions or cloud platforms cannot use ordinary direct shares to access the same underlying regional dataset without an appropriate cross-region fulfillment mechanism.

Option D combines direct regional sharing with replication between the European Azure and North American AWS environments.

By limiting replication to datasets requiring cross-region access, the company can reduce unnecessary data movement and associated storage and transfer charges.

Option A unnecessarily replicates data within regions where direct sharing would be sufficient.

Option B introduces external file-management infrastructure and operational overhead.

Option C conflicts with the stated data-residency requirements and could create regulatory problems.

Technical qualification: Snowflake database replication is not automatically bidirectional for a single primary database. Each region's independently owned datasets require appropriately configured replication and sharing arrangements. Snowflake also offers Cross-Cloud Auto-fulfillment for listings.

Most importantly, European PII must not be replicated to another region unless the organization has the necessary legal and regulatory authorization. The question does not establish which datasets are eligible for international transfer.

Official Snowflake references: Share Data Securely Across Regions and Cloud Platforms; Data Sharing and Collaboration in Snowflake; Manage Data Listings.

Snowflake streams provide change data capture functionality by recording an offset against the underlying change-tracking metadata of a source object. A stream allows downstream processes to identify inserted, updated, and deleted records without repeatedly scanning the entire source table.

Creating a stream on a standard table requires CREATE STREAM on the destination schema and SELECT on the underlying source table. The role also requires sufficient privileges on the parent database and schema to resolve and access the relevant objects.

Option D correctly places CREATE STREAM at the schema level while retaining USAGE on the database and schema and SELECT on the table.

For example:

GRANT USAGE ON DATABASE PROD TO ROLE ETL_ROLE;

GRANT USAGE ON SCHEMA PROD.WORKING

TO ROLE ETL_ROLE;

GRANT CREATE STREAM ON SCHEMA PROD.WORKING

TO ROLE ETL_ROLE;

GRANT SELECT ON TABLE PROD.WORKING.SOURCE_TABLE

TO ROLE ETL_ROLE;

```

Options A and C incorrectly place CREATE STREAM on the table or database. Option B omits the necessary creation privilege.

Important qualification: If change tracking has not already been enabled on the source table, the initial stream creation may require the source table's OWNERSHIP privilege to enable change tracking automatically. Therefore, D represents the minimum grants when the source is appropriately prepared, but it is not universally sufficient for every new source table.

Official Snowflake references: CREATE STREAM: Access Control Requirements; Introduction to Streams.

Snowflake distinguishes between cluster-level scaling and warehouse-level automatic suspension.

A multi-cluster warehouse operating in auto-scale mode can start additional clusters when query concurrency increases. As demand declines, Snowflake removes excess clusters according to the configured scaling policy until the warehouse returns to its minimum cluster count.

Automatic suspension operates at the warehouse level rather than independently suspending each cluster.

Snowflake explicitly specifies that automatic suspension occurs when the minimum number of clusters is running and the warehouse has remained inactive for the configured AUTO_SUSPEND interval.

For example, consider a warehouse configured with MIN_CLUSTER_COUNT=2, MAX_CLUSTER_COUNT=8, and AUTO_SUSPEND=300.

After a workload peak, Snowflake progressively scales down additional clusters. Once the warehouse has returned to two clusters and satisfies the inactivity condition, automatic suspension can occur.

Option A is incomplete because it does not account for the minimum-cluster requirement in Snowflake's documented suspension process.

Option B incorrectly associates automatic suspension with reaching the maximum cluster count.

Option D is incorrect because multi-cluster warehouses fully support automatic suspension.

Administrators should remember that Snowflake evaluates suspension periodically, so the configured interval is not an exact real-time shutdown guarantee.

Official Snowflake references: Overview of Warehouses: Auto-suspension and Auto-resumption; Multi-cluster Warehouses.

Snowflake provides temporary MFA bypass functionality to recover user access when an enrolled authentication device becomes unavailable. The appropriate administrative action is to configure the MINS_TO_BYPASS_MFA property on the affected user.

For example:

ALTER USER user1

SET MINS_TO_BYPASS_MFA = 30;

This command permits the user to authenticate temporarily without completing MFA for the configured 30-minute period. Importantly, the operation does not revoke the user's existing MFA enrollment or permanently disable the authentication requirement.

Option B is unsuitable because DISABLE_MFA is a Boolean setting and does not automatically provide a 24-hour expiration period. It is not equivalent to a controlled, time-limited bypass.

Option C is incorrect because Snowflake supports MFA authentication through SnowSQL and other supported clients. Changing the connection client does not inherently eliminate MFA enforcement.

Option D proposes an unsupported URL-based authentication bypass.

From a security-administration perspective, the administrator should first validate the user's identity through an approved recovery procedure, establish the shortest practical bypass interval, and guide the user through registration of a replacement MFA method.

Current Snowflake documentation also describes ALTER USER ... ENROLL MFA as a recovery mechanism for users who must register a new authenticator.

Official Snowflake references: Multi-factor Authentication; Recovering a User Who Is Locked Out; ALTER USER.

Snowflake persisted query results enable the query engine to reuse previously computed results when eligible identical queries are executed again.

Option D is the intended optimization because CURRENT_DATE expresses the business requirement using date-level precision rather than calculating an execution-time timestamp and subsequently converting it to a date.

This is more appropriate for reports whose date boundaries change daily rather than with every query execution.

Option A is incorrect because wrapping SQL inside a UDF does not automatically make queries eligible for persisted-result reuse.

Option B is incorrect because persisted query results are not tied to the local data cache of a particular virtual warehouse.

Option C is unnecessary because Snowflake can reuse eligible persisted SELECT results across roles when the executing roles have the required access privileges.

Snowflake also requires compatible query text, unchanged underlying data, an available cached result, and appropriate configuration settings. Persisted results generally expire after 24 hours, although successful reuse can extend their availability.

Critical source-query warning: The exhibit reverses its BETWEEN boundaries: the current date appears before the date seven days earlier. This must be corrected before deployment. Furthermore, CURRENT_DATE is session-time-zone-dependent, and Snowflake does not guarantee cache reuse merely because CURRENT_TIMESTAMP is replaced. The answer is the best of the available choices, not a guaranteed cache optimization.

Official Snowflake references: Using Persisted Query Results; CURRENT_DATE; Context Functions.

Snowflake distinguishes between scaling up a warehouse to improve the resources available to individual statements and scaling out through multiple clusters to accommodate concurrent workloads.

Option C is the intended answer because a multi-cluster warehouse can increase parallel query-processing capacity without requiring a continuously running 2X-Large warehouse. Smaller clusters reduce the cost of each running cluster, while auto-scaling provides additional clusters when concurrency increases.

Option A introduces another expensive warehouse without addressing inefficient workload execution. Option B increases compute capacity but does not necessarily improve the throughput of numerous small INSERT statements. Option D introduces additional tables without establishing that table-level contention is the primary bottleneck.

However, Snowflake's official cost-optimization guidance explicitly identifies frequent single-row INSERT operations as inefficient. These operations can generate substantial cloud-services overhead because Snowflake is designed primarily for analytical workloads rather than traditional OLTP processing.

Technical qualification: Option C is the strongest available answer, but it does not address the principal ingestion-design problem. Snowflake recommends batching INSERT operations or using bulk-loading mechanisms such as COPY INTO whenever appropriate. Smaller multi-cluster warehouses are not guaranteed to outperform a larger single warehouse for every DML workload.

For a production-quality examination item, the scenario should distinguish concurrency bottlenecks from inefficient ingestion architecture.

Official Snowflake references: Optimizing Cloud Services for Cost; Planning a Data Load; Multi-cluster Warehouses.

Snowflake warehouses maintain a local cache of frequently accessed table data on their compute resources. This cache can reduce repeated remote storage reads when subsequent queries access the same micro-partitions.

Setting AUTO_SUSPEND to 0 or NULL disables automatic warehouse suspension. Consequently, the warehouse remains running and its local data cache remains available, assuming the underlying compute resources are retained.

Option C is correct because this can benefit dashboard workloads that repeatedly query overlapping datasets, particularly when different reports access similar table partitions.

Option D incorrectly associates warehouse suspension with the persisted query result cache. Snowflake maintains persisted query results independently of warehouse-local storage. Eligible results can be reused even after a warehouse has been suspended.

Option B contradicts the proposed configuration because disabling suspension causes the warehouse to remain active during idle periods.

Option A is not the primary caching rationale and is misleading as a general cost-saving claim.

Operational qualification: Snowflake explicitly cautions against disabling automatic suspension unless a continuously running warehouse is justified. A warehouse consumes credits while running, even without active queries. Snowflake recommends evaluating cache benefits against idle compute costs and generally suggests an auto-suspend interval of at least ten minutes for applicable BI workloads.

Official Snowflake references: Optimizing the Warehouse Cache; CREATE WAREHOUSE; Warehouse Considerations.