Exam SnowPro Advanced Architect topic 1 question 11 discussion

Pipe does not have USAGE privilege and internal stage does not have READ privilege so has to be A

https://docs.snowflake.com/user-guide/data-load-snowpipe-auto-s3#step-4-configure-security

option B https://docs.snowflake.com/en/user-guide/data-load-snowpipe-intro#creating-pipes Creating pipes Creating and managing pipes requires a role with a minimum of the following privileges: Object Privilege Notes Database USAGE Schema USAGE, CREATE PIPE Stage in the pipe definition USAGE External stages only. Stage in the pipe definition READ Internal stages only. Table in the pipe definition SELECT, INSERT

To view details about the pipe, you must use a role with the MONITOR or OWNERSHIP privilege on the pipe and the USAGE privilege on both the database and schema that contain the pipe. See Pipe privileges for more details. https://docs.snowflake.com/user-guide/data-load-snowpipe-manage

Ans is A: -- Create a role to contain the Snowpipe privileges use role securityadmin; create or replace role snowpipe1; -- Grant the required privileges on the database objects grant usage on database snowpipe_db to role snowpipe1; grant usage on schema snowpipe_db.public to role snowpipe1; grant insert, select on snowpipe_db.public.mytable to role snowpipe1; grant usage on stage snowpipe_db.public.mystage to role snowpipe1; -- Grant the OWNERSHIP privilege on the pipe object grant ownership on pipe snowpipe_db.public.mypipe to role snowpipe1; -- Grant the role to a user grant role snowpipe1 to user jsmith; -- Set the role as the default role for the user alter user jsmith set default_role = snowpipe1;

Answer is A. OWNERSHIP on the named pipe, USAGE on the named stage, target database, and schema, and INSERT and SELECT on the target table

Answer is D and is validated

it doesn't exist a GRANT USAGE on PIPE https://docs.snowflake.com/en/user-guide/security-access-control-privileges#pipe-privileges As it is about auto-ingest, it's not possible with internal STAGE, so it is not B or C as READ grant is only for internal STAGE Thus, it it response D

C https://docs.snowflake.com/en/user-guide/data-load-snowpipe-intro#creating-pipes

https://docs.snowflake.com/en/user-guide/data-load-snowpipe-intro#owning-pipes