You are developing a Snowflake Native Application that interacts with sensitive customer dat a. You want to implement robust security scanning before publishing to the Snowflake Marketplace. Which of the following strategies are MOST effective to detect and prevent potential vulnerabilities before submitting your application, considering limitations on marketplace pre-publication scanning capabilities?

• A. Rely solely on Snowflake's built-in scanning during the Marketplace submission process, as it covers all known vulnerabilities.
• B. Employ a third-party penetration testing service to perform a black-box test of the application after deployment in a staging environment but prior to Marketplace submission.
• C. Implement a comprehensive CI/CD pipeline that includes static code analysis (SAST) using tools like SonarQube or similar, focusing on SQL injection, cross-site scripting (XSS), and insecure deserialization vulnerabilities. Include unit and integration tests with parameterized inputs. Regularly update dependency versions and scan for known vulnerabilities in third-party libraries included in your application's code (e.g., Python libraries).
• D. Manually review all code for potential security flaws and ensure adherence to secure coding practices.
• E. Only use Snowflake provided templates and example codes as these are already pre-approved from security perspectives

You are developing a Snowflake Native Application with a custom setup script. Within the setup script, you need to perform different actions based on whether the application is being installed for the first time in a consumer's account, or if it's an upgrade from a previous version. Which of the following functions or techniques can you reliably use within the setup script to determine if the current execution is a fresh installation vs. an upgrade? (Assume the app version is maintained and accessible as a variable 'current_version' .)

• A. Use 'SYSTEM$GET_PREVIOUS_VERSION()' function inside the setup script. If it returns NULL, it is the first install.
• B. Use the table 'APPLICATION_REGISTRY' function to check for an existing entry for the application in the current account.
• C. Attempt to read a known persistent setting from the application's metadata. If the setting exists, it's an upgrade; otherwise, it's a fresh install. (Requires metadata setup in a previous version)
• D. Query the 'INFORMATION_SCHEMAPPLICATIONS' view to check if the application name already exists in the consumer's account.
• E. Check if the current version is '1.0', assuming the initial version of the application will always be '1.0'.

A data science team is developing a Native App on Snowflake that requires access to data from multiple customer accounts (Reader Accounts). They need to ensure strict data governance and minimize the risk of data leakage. Which of the following approaches provides the MOST secure and scalable solution for accessing and managing this cross-account data?

• A. Package the data extraction logic directly into the Native App using User-Defined Functions (UDFs) that establish secure connections to each consumer account using separate credentials stored securely within the application package.
• B. Grant SELECT privileges directly to the application role on all relevant tables in the consumer accounts.
• C. Utilize secure data sharing with data clean rooms, exposing the required datasets via views on each data clean room.
• D. Implement a data access service within the Native App that uses external functions to query data from consumer accounts, relying on network policies for security.
• E. Create a shared database from each consumer account containing views over the required tables, granting SELECT privileges on these views to the application role.

You are developing a Snowflake Native Application that needs to access data residing in the consumer's account. The application requires specific permissions to read certain tables and execute specific functions. How should you define and manage these access privileges to ensure both security and functionality?

• A. Use the 'GRANT OWNERSHIP' command to transfer ownership of the required tables and functions to the application's service account. This gives the application full control over these resources.
• B. Rely on the consumer to manually grant the necessary privileges to the application's service account after installation. Provide clear instructions in the application's documentation.
• C. Grant the 'ACCOUNTADMIN' role to the application. This provides unrestricted access to all resources in the consumer's account, simplifying development and deployment.
• D. Create a new database role and grant the required permissions to the database role, later grant the database role to the application role. Use secure views for access to consumer data.
• E. Define a custom role within the application package with the minimum required privileges (e.g., 'SELECT on specific tables, 'USAGE on specific functions). The consumer then grants this role to the application during installation. Use secure views if needed.