COF-C03 Snowflake SnowPro Core Certification 2026 Exam Free Practice Exam Questions (2026 Updated)

 The COPY INTO command is used in Snowflake to unload data from a table into a file in a stage. This command allows for the export of data from Snowflake tables into flat files, which can then be used for further analysis, processing, or storage in external systems.

The purpose of an External Function in Snowflake is to call code that executes outside of the Snowflake environment. This allows Snowflake to interact with external servicesand leverage functionalities that are not natively available within Snowflake, such as calling APIs or running custom code hosted on cloud services3.

https://docs.snowflake.com/en/sql-reference/external-functions.html

In Snowflake, Streams are the objects that track Data Manipulation Language (DML) changes made to tables, such as inserts, updates, and deletes. Streams record these changes along with metadata about each change, enabling actions to be taken using the changed data. This process is known as change data capture (CDC)2.

The COPY command in Snowflake allows for the reordering of columns as they are loaded into a table, and it also permits the omission of columns from the source file during the load process. This provides flexibility in handling the schema of the data being ingested. References: [COF-C03] SnowPro Core Certification Exam Study Guide

To generate a report listing all Snowflake logins within the last 90 days, the ACCOUNT_USAGE.LOGIN_HISTORY view should be used. This view provides information about login attempts, including successful and unsuccessful logins, and is suitable for security audits4.

When a cloned table is replicated to a secondary database in Snowflake, the following occurs:

C. The physical data is replicated: The actual data of the cloned table is physically replicated to the secondary database. This ensures that thesecondary database has its own copy of the data, which can be used for read-only purposes or failover scenarios1.

E. Metadata pointers to cloned tables are replicated: Along with the physical data, the metadata pointers that refer to the cloned tables are also replicated. This metadata includes information about the structure of the table and any associated properties2.

It’s important to note that while the physical data and metadata are replicated, the secondary database is typically read-only and cannot be used for write operations. Additionally, while there may be additional storage costs associated with the secondary account, this is not a direct result of the replication process but rather a consequence of storing additional data.

Fail-safe is a feature in Snowflake that provides an additional layer of data protection. After the Time Travel retention period ends, Fail-safe offers a non-configurable 7-day period during which historical data may be recoverable by Snowflake. This period is designed to protect against accidental data loss and is not intended for customer access.

 Understanding and viewing Fail-safe |Snowflake Documentation

 Snowflake Time Travel is a powerful feature that allows users to access historical data within a defined period. It enables two key capabilities:

B. Restoring data-related objects that have been deleted within the past 90 days: Time Travel can be used to restore tables, schemas, and databases that have been accidentally or intentionally deleted within the Time Travel retention period.

C. Conducting point-in-time analysis for BI reporting: It allows users to query historical data as it appeared at a specific point in time within the Time Travel retention period, which is crucial for business intelligence and reporting purposes.

While Time Travel does allow querying of past data, it is limited to the retention period set for the Snowflake account, which is typically 1 day for standard accounts and can be extended up to 90 days for enterprise accounts. It does not enable querying or restoring objects created or deleted beyond the retention period, nor does it provide analysis over all periods of time.

In Snowflake, a Pipe is the object designed to enable the continuous, near-real-time loading of data from files as soon as they are available in a cloud storage location. Pipes use Snowflake’s COPY command to load data and can be associated with a Stage object to monitor for new files. When new data files appear in the stage, the pipe automatically loads the data into the target table.

 The correct statement to accommodate the request for a marketing co-worker to change the size of their medium virtual warehouse called mktg__WH is to grant the MODIFY privilege on the warehouse to the ROLE MARKETING. This privilege allows the role to change the warehouse size among other properties.

The result set cache in Snowflake is invalidated and no longer available when the underlying data of the query results has changed, ensuring that queries return the most current data. Additionally, the cache expires after 24 hours to maintain the efficiency and accuracy of data retrieval1.

A clustering key in Snowflake is used to co-locate similar data within the same micro-partitions to improve query performance, especially for large tables where data is not naturally ordered or has become fragmented due to extensive DML operations. The appropriate use of a clustering key can lead to improved scan efficiency and better column compression, resulting in faster query execution times.

The indicators that it may be appropriate to use a clustering key for a table include:

D. Queries on the table are running slower than expected: This can happen when the data in the table is not well-clustered, leading to inefficient scans during query execution.

E. The clustering depth for the table is large: A large clustering depth indicates that the table’s data is spread across many micro-partitions, which can degrade query performance as more data needs to be scanned.

 To evaluate the details of dynamic data masking, the POLICY_REFERENCES and ACCESS_HISTORY views in the account_usage schema are used. The POLICY_REFERENCES view provides information about the objects to which a masking policy is applied, and the ACCESS_HISTORY view contains details about access to the masked data, which can be used to audit and verify the application of dynamic data masking policies.

 In Snowflake, when the account is located on Microsoft Azure, a valid source for an external stage can be an Azure container or a folder path within an Azure container. This includes Azure Blob storage which is accessible via the azure:// endpoint. A Windows server file share on Azure, if configured properly, can be a valid source for staging data files for Snowflake. Options A, B, and C are not supported as direct sources for an external stage in Snowflake on Azure12. References: [COF-C03] SnowPro Core Certification Exam Study Guide

Secure sharing in Snowflake allows users to share specific objects with other Snowflake accounts without physically copying the data, thus not consuming additional storage. Tables and Secure User Defined Functions (UDFs) are among the objects that can be shared using this feature. Materialized views, sequences, and procedures are not shareable objects in Snowflake.

 External stages can be altered and dropped in Snowflake. An external stage points to an external location, such as an S3 bucket, where data files are stored. Users can modify the stage’s definition or drop it entirely if it’s no longer needed. This is in contrast to table stages, which are tied to specific tables and cannot be altered or dropped independently.

Alation is known for specializing in data catalog solutions and is a partner of Snowflake. Data catalog solutions are essential for organizations to effectively manage their metadata and make it easily accessible and understandable for users, which aligns with the capabilities provided by Alation.

In Snowflake, Cloud Services costs are incurred when the Cloud Services usage exceeds 10% of the compute usage (measured in credits). Therefore, scenarios A and E would result in Cloud Services charges because the Cloud Services usage is more than 10% of the compute credits used.

In Snowflake, Data Shares can be created and managed in two primary ways:

Via the Snowflake Web Interface (UI): Users can create and manage shares through the graphical interface provided by Snowflake, which allows for a user-friendly experience.

Via SQL commands: Snowflake also allows the creation and management of shares using SQL commands. This method is more suited for users who prefer scripting or need to automate the process.

The ACCOUNTADMIN role is the most powerful role in Snowflake and should be limited to a select number of users within an organization. It is responsible for account-level configurations and should not be used for day-to-day object creation or management. Granting a custom role to ACCOUNTADMIN could inadvertently give broad access to users with this role, which is not a recommended security practice.

 One of the key features of Snowflake’s architecture is its unique approach to eliminating resource contention through the use of virtual warehouses. This is achieved by separating storage and compute resources, allowing multiple virtual warehouses to operate independently on the same data without affecting each other. This means that different workloads, such as loading data, running queries, or performing complex analytics, can be processed simultaneously without any performance degradation due to resource contention.

The auto-suspend and auto-resume settings in Snowflake apply to the entire virtual warehouse. These settings allow the warehouse to automatically suspend when it’s not in use, helping to save on compute costs. When queries or tasks are submitted to the warehouse, it can automatically resume operation. This functionality is designed to optimize resource usage and cost-efficiency.

The correct answer is B. To unload data to one output file .

The COPY INTO < location > command unloads data from a Snowflake table or query result into files in a stage. By default, Snowflake may unload data into multiple files depending on the amount of data and warehouse parallelism.

Why B is correct:

The SINGLE = TRUE option tells Snowflake to unload the result into a single file instead of multiple files.

Example:

COPY INTO @my_stage/output_file.csv

FROM my_table

FILE_FORMAT = (TYPE = CSV)

SINGLE = TRUE;

This is useful when a downstream process expects one output file.

Why the other options are incorrect:

A. SINGLE = TRUE does not control the file format or data type.

C. It is not an access-control setting for limiting a user’s behavior.

D. It does not control the number of attempts to load or unload data.

Official Snowflake documentation reference:

Snowflake documentation for COPY INTO < location > describes SINGLE as an option that specifies whether to generate a single output file or multiple files.

The Merge operator is considered a DML (Data Manipulation Language) operator in Snowflake. DML operators are used to modify data in tables, and the Merge operator specifically allows for conditional updates, inserts, or deletes in a target table based on the results of a join with a source table.

Snowflake Documentation: Query Profile Overview

Snowflake Documentation: MERGE Statement

The correct answer is D. Dynamic Data Masking .

Dynamic Data Masking is used to protect sensitive column values at query run time. It allows Snowflake to return different values depending on the user’s role or other policy logic.

Why D is correct:

A masking policy can be applied to a table or view column. When a query runs, Snowflake evaluates the masking policy and determines whether to return the original value, a partially masked value, or a fully masked value.

Example concept:

CREATE MASKING POLICY phone_mask AS (val STRING)

RETURNS STRING - >

CASE

WHEN CURRENT_ROLE() IN ( ' CUSTOMER_SUPPORT_FULL ' ) THEN val

ELSE CONCAT( ' XXX-XXX- ' , RIGHT(val, 4))

END;

This protects sensitive phone numbers at query time without changing the underlying stored data.

Why the other options are incorrect:

A. Object tagging classifies or labels data for governance, but it does not mask values at query runtime by itself.

B. Data encryption protects data at rest and in transit, but it does not dynamically change query results based on role.

C. UDFs can implement custom logic, but Snowflake’s built-in governance feature for runtime masking is Dynamic Data Masking.

Official Snowflake documentation reference:

Snowflake documentation describes Dynamic Data Masking as a column-level security feature that uses masking policies to selectively mask plain-text data in query results at runtime.

In Snowflake, when a table or schema is dropped, it is not immediately deleted but retained for the configured data retention period, also known as " Time Travel. " During this period, users can use commands like UNDROP to recover the dropped object if needed. After the retention period expires, the object is then moved to Fail-safe (if applicable) for an additional seven days before being permanently removed. This feature is intended to provide data protection and recovery options in case of accidental deletions.

In Snowflake,SAMPLE (5 ROWS)ensures an exact count of 5 rows is returned from MY_TABLE, regardless of table size. This is different from SAMPLE SYSTEM or SAMPLE BERNOULLI, which use percentage-based sampling, potentially returning varying row counts based on probabilistic methods.

The ROWS option is deterministic and does not depend on percentage, making it ideal when an exact row count is required.

Two key metrics in Snowflake’sQuery Profilethat provide insights for performance improvement are:

Remote Disk IO: This measures the time the query spends waiting on remote disk access, indicating potential performance issues related to I/O bottlenecks.

Pruning: This metric reflects how effectively Snowflake’s micro-partition pruning is reducing the data scanned. Better pruning (more partitions excluded) leads to faster query performance, as fewer micro-partitions need to be processed.

These metrics are essential for identifying and addressing inefficiencies in data retrieval and storage access, optimizing overall query performance.

The correct answer is B. SELECT * FROM table_A TABLESAMPLE (100); .

TABLESAMPLE (100) samples 100 percent of the table, so it returns all rows from table_A.

Why B is correct:

SELECT *

FROM table_A TABLESAMPLE (100);

This requests a 100 percent sample, which is effectively the full table.

Why the other options are incorrect:

A. TABLESAMPLE (0) returns 0 percent of the table, not all rows.

C. SAMPLE (10) returns approximately 10 percent of the rows, not all rows.

D. TABLESAMPLE BERNOULLI (10) samples each row with a 10 percent probability, not all rows.

Official Snowflake documentation reference:

Snowflake documentation explains that SAMPLE / TABLESAMPLE can specify a probability percentage. A value of 100 represents 100 percent of the table.

The correct answer is D. The volume of the data .

The NULL_COUNT Data Metric Function returns the number of NULL values in a column. This type of metric is used to verify data quality by measuring the amount, or volume, of missing values.

Why D is correct:

NULL_COUNT counts how many rows contain NULL in a specified column. Since it produces a count, it is used to evaluate the volume of missing data.

Example concept:

SELECT SNOWFLAKE.CORE.NULL_COUNT(

SELECT column_name FROM my_table

);

This returns the number of NULL values found in the selected column.

Why the other options are incorrect:

A. Accuracy verifies whether data values are correct, but NULL_COUNT only counts missing values.

B. Uniqueness is verified with metrics that check duplicate or distinct values, not NULL_COUNT.

C. Freshness measures how current or recent the data is, not how many nulls exist.

Official Snowflake documentation reference:

Snowflake documentation describes NULL_COUNT as a system Data Metric Function that returns the number of NULL values in a column.

The settings shown in the image indicate that the data retention time in days is configured at two different levels: the account level and the object level. At the account level, theMIN_DATA_RETENTION_TIME_IN_DAYSis set to 5 days, and at the object level, theDATA_RETENTION_TIME_IN_DAYSis set to 2 days. Since the object level setting has a lower value, it takes precedence over the account level setting for the specific object. Therefore, the data will be retained for 2 days at the object level.