Row access policies in Snowflake - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Row Access Policy Behavior

In Snowflake, a row access policy is applied to a table to control which rows a user can see based on a condition. Suppose you have a row access policy that allows users to see only rows where the column region matches their assigned region.

What happens when a user queries the table without any row access policy applied?

A The user sees only rows where region is NULL.

B The user sees no rows because no policy restricts access.

C The user sees all rows in the table regardless of region.

D The query fails with an error about missing row access policy.

💡 Hint

Think about what happens if no restrictions are applied.

If no row access policy is applied, Snowflake returns all rows in the table without filtering.

❓ Configuration

intermediate

Row Access Policy Syntax Validation

Which of the following Snowflake row access policy definitions is syntactically correct?

Assume the policy filters rows where department equals the current user's department.

Snowflake

CREATE ROW ACCESS POLICY dept_policy AS (department STRING) RETURNS BOOLEAN ->
  department = CURRENT_ROLE();

A CREATE ROW ACCESS POLICY dept_policy AS (department STRING) RETURNS BOOLEAN -> department = CURRENT_ROLE();

B CREATE ROW ACCESS POLICY dept_policy (department STRING) RETURNS BOOLEAN AS department = CURRENT_ROLE();

C CREATE ROW ACCESS POLICY dept_policy AS (department STRING) RETURNS BOOLEAN AS department = CURRENT_ROLE();

D CREATE ROW ACCESS POLICY dept_policy AS (department STRING) RETURNS BOOLEAN -> department == CURRENT_ROLE();

💡 Hint

Check the arrow syntax and comparison operator.

The correct syntax uses AS (params) RETURNS BOOLEAN -> condition; with a single equals sign for comparison.

❓ Architecture

advanced

Designing Row Access Policies for Multi-Region Data

You manage a Snowflake table with sales data for multiple regions. You want to ensure that users can only see sales data for their assigned region. Which architecture best enforces this using row access policies?

A Create a row access policy that filters rows where <code>region</code> equals the user's current role name, then apply it to the sales table.

B Create one row access policy that checks if the <code>region</code> column matches the user's assigned region stored in a session variable, then apply it to the sales table.

C Create separate tables for each region and grant access only to users assigned to those tables.

D Use a view that filters rows by region and grant users access to the view instead of the table.

💡 Hint

Consider how row access policies can use session variables for dynamic filtering.

Using a row access policy that compares the region column to a session variable holding the user's assigned region allows dynamic, centralized filtering.

❓ security

advanced

Row Access Policy Security Implications

Which of the following is a security risk when using row access policies in Snowflake?

A Applying a row access policy that uses a session variable that users can modify to bypass restrictions.

B Using a row access policy that filters rows based on a fixed column value.

C Applying row access policies only on sensitive columns, not on the entire table.

D Granting users only SELECT privileges on the table with row access policies applied.

💡 Hint

Think about how users might manipulate session variables.

If users can change session variables used in row access policies, they might see unauthorized rows, creating a security risk.

❓ service_behavior

expert

Row Access Policy Impact on Query Results

Given a Snowflake table employees with a row access policy that only allows rows where department = 'HR', what will be the result of this query by a user without any special roles?

SELECT COUNT(*) FROM employees;

A The query fails with an access denied error.

B The count of all rows in the employees table regardless of department.

C The query returns zero because the user has no roles.

D The count of only rows where department is 'HR'.

💡 Hint

Row access policies filter rows invisibly based on conditions.

The row access policy filters rows so the user only sees rows where department is 'HR', so the count reflects only those rows.