You are implementing a data share between two Snowflake accounts. The provider account wants to grant the consumer account access to a function that returns anonymized customer data based on a complex algorithm. The provider wants to ensure that the consumer cannot see the underlying implementation details of the anonymization algorithm. Which of the following approaches can achieve this goal? (Select TWO)

• A. Create a secure UDF in the provider account and grant usage on the secure UDF to the share. Share the share with the consumer account.
• B. Create a standard UDF in the provider account and grant usage on the UDF to the share. Share the share with the consumer account.
• C. Create a view that calls the secure UDF and share that view with the consumer account.
• D. Create an external function in the provider account and grant usage to the share. Share the share with the consumer account.
• E. Share the underlying table and provide the consumer account with the anonymization algorithm separately.

You have a table 'EMPLOYEE DATA' containing Personally Identifiable Information (PII), including 'salary' and 'email'. You need to implement column-level security such that: 1) The 'salary' column is only visible to users in the 'FINANCE ROLE. 2) The 'email' column is masked with a SHA256 hash for all users except those in the 'HR ROLE. You create the following masking policies:

Which of the following SQL statements correctly applies these masking policies to the 'EMPLOYEE DATA table?

• A. ALTER TABLE EMPLOYEE_DATA MODIFY COLUMN salary SET MASKING POLICY = mask_salary; ALTER TABLE EMPLOYEE_DATA MODIFY COLUMN email SET MASKING POLICY = mask email;
• B. ALTER TABLE EMPLOYEE_DATAALTER COLUMN salary SET MASKING POLICY mask_salary; ALTER TABLE EMPLOYEE_DATAALTER COLUMN email SET MASKING POLICY mask email;
• C. ALTER TABLE EMPLOYEE_DATA MODIFY COLUMN salary SET MASKING POLICY mask_salary; ALTER TABLE EMPLOYEE_DATA MODIFY COLUMN email SET MASKING POLICY mask email;
• D. ALTER TABLE EMPLOYEE_DATAAPPLY MASKING POLICY mask_salary ON COLUMN salary; ALTER TABLE EMPLOYEE_DATAAPPLY MASKING POLICY mask email ON COLUMN email;
• E. CREATE OR REPLACE TAG employee_data.salary VALUE 'mask_salary'; CREATE OR REPLACE TAG employee_data.email VALUE 'mask_email';

Consider a scenario where you have a Snowflake table named 'CUSTOMER DATA' containing customer IDs (INTEGER) and encrypted credit card numbers (VARCHAR). You need to create a secure JavaScript UDF to decrypt these credit card numbers using a custom encryption key stored securely within Snowflake's internal stage, and then mask all but the last four digits of the decrypted number for data protection. Which of the following actions are necessary to ensure both functionality and security while adhering to Snowflake's best practices for UDF development and security?

• A. Store the encryption key in a separate file on an internal stage accessible only by the UDF's service account and load the key from the file within the UDF at runtime.
• B. Use Snowflake's Secure Vault (Secret) feature to store the encryption key and retrieve it securely within the UDF.
• C. Encrypt the key using a weaker encryption algorithm before storing it in an internal stage to balance security and performance.
• D. Store the encryption key directly within the JavaScript UDF code as a string variable.
• E. Pass the encryption key as an argument to the UDF each time it is called.

A company stores raw clickstream data in AWS S3. They need to query this data occasionally (less than once per day) for ad-hoc analysis and auditing purposes without ingesting it into Snowflake. Which of the following approaches is MOST suitable and cost- effective, and which considerations regarding data freshness are crucial?

• A. Load the data into a Snowflake table using COPY INTO and schedule a daily task to refresh the table. Data freshness is guaranteed by the scheduled task.
• B. Create an external table pointing directly to the S3 bucket. The data freshness depends on manually refreshing the metadata using 'ALTER EXTERNAL TABLE ... REFRESH'. Automate this refresh with a scheduled task.
• C. Create an external table pointing directly to the S3 bucket. The data freshness depends on the automatic refresh enabled using the object. Ensure a metadata notification service (e.g., SQS) is configured to trigger the metadata refresh whenever new files are added to S3.
• D. Create an internal stage in Snowflake and regularly copy the data from S3 into the internal stage using a Snowpipe. Query the data in the internal stage. Data freshness depends on the Snowpipe configuration.
• E. Create an external table pointing directly to the S3 bucket. Data freshness is automatically maintained by Snowflake whenever the external table is queried. No additional configuration is required.

You have an external table named in Snowflake that points to a set of CSV files in an AWS S3 bucket. The CSV files have a header row, and the data is comma-separated. However, some of the files in the S3 bucket are gzipped. You need to define the external table to correctly read both compressed and uncompressed files. Which of the following SQL statements BEST achieves this?

• A. Option D
• B. Option A
• C. Option C
• D. Option B
• E. Option E