A customer has installed your Snowflake Native Application, which utilizes a IJDF that performs complex calculations. The customer reports performance issues and sporadic errors. As the application provider, how can you BEST establish telemetry and observability to diagnose the problem, without compromising the customer's data security or privacy?

• A. Implement logging within the UDF to capture execution time, input parameters (anonymized), and error messages. Store this data in an Event Table within the application provider's account and expose aggregate statistics through a secure API endpoint for the consumer to monitor.
• B. Create a shared view on the UDF execution logs in the customer's account, granting you read-only access to the relevant information.
• C. Request direct access to the customer's Snowflake account to inspect the IJDF execution logs and query performance metrics.
• D. Utilize Snowflake's Query History to track the IJDF's performance in the customer's account and provide recommendations based on the observed query patterns.
• E. Instruct the customer to enable verbose logging in their Snowflake account and provide you with the log files for analysis.

You are tasked with designing a Snowflake Native App that requires multiple roles with different levels of access to its functionalities. The app needs to define which roles can perform specific actions, such as viewing data, modifying data, or managing app settings. Which of the following methods are CORRECT ways to control role-based access within a Snowflake Native App? (Select all that apply)

• A. Defining application roles within the provider account and mapping them to consumer roles during the installation process. These application roles can then be used for fine-grained access control.
• B. Using the 'allowed_roleS section in the manifest file to restrict access to certain functionalities based on the consumer's roles. This ensures that only authorized roles can interact with those components.
• C. Defining roles within the setup script with specific privileges and instructing the consumer to grant their existing roles to these newly created roles.
• D. Granting specific privileges to roles directly within the application's stored procedures and functions, checking the current role using and conditionally executing code based on the role.
• E. Creating separate versions of the application for each role, with each version containing only the functionalities that the role is allowed to access.

A consumer reports that your Snowflake Native Application is consistently failing with an 'Insufficient privileges' error when attempting to execute a specific function. As the provider, you need to diagnose the issue. Which of the following steps should you perform FIRST, considering the principles of least privilege and secure data access in Snowflake Native Apps?

• A. Grant the 'USAGE privilege on the entire application package to the consumer's account, ensuring they have access to all components.
• B. Grant the "APPLY MASKING POLICY privilege on the database to the application invoker role.
• C. Temporarily disable all security policies (e.g., row access policies, masking policies) in the consumer's account to isolate the problem.
• D. Examine the function's definition and the objects it accesses to ensure that the necessary privileges are granted to the application's invoker's rights (IR) role or owner's rights (OR) role, and that a data access framework is in place when needed.
• E. Request the consumer to grant 'OWNERSHIP of the target database to your application's service user.

A Native Application developer is creating a data product to be sold on the Snowflake Marketplace. The application needs read access to a shared database called 'RETAIL DATA'. The application logic includes a function that reads a lookup table, 'PRODUCT CATEGORIES', within this shared database. Which sequence of actions, executed by the application provider, ensures the application can access this table at installation time and after updates, following least privilege principles?

• A. Grant 'IMPORTED PRIVILEGES' on 'RETAIL DATA' to the application role. The application setup script should also GRANT USAGE on database RETAIL_DATA and then GRANT SELECT on to the application role.
• B. Grant 'SELECT on to the application role during the application's setup script. Do not grant 'IMPORTED PRIVILEGES' on the database.
• C. Grant 'IMPORTED PRIVILEGES' on 'RETAIL DATA to the application role. Rely on the consumer to grant 'SELECT access to tables within 'RETAIL DATA' to the application role.
• D. Grant USAGE on ' RETAIL_DATX to the application role during the application's setup script. Do not grant 'IMPORTED PRIVILEGES' on the database.
• E. Grant 'IMPORTED PRIVILEGES' on to the application role. Grant 'SELECT on to the application role during the application's setup script.