Snowflake ' s Streams feature is specifically designed for change data capture (CDC). A stream records insert, update, and delete operations performed on a table, and allows users to query these changes. This enables actions to be taken on the changed data, facilitating processes like incremental data loads and real-time analytics. Streams provide a powerful mechanism for applications to respond to data changes in Snowflake tables efficiently.
References: Snowflake Documentation on Streams

A directory table in Snowflake is used to store file-level metadata about the data files in a stage. It is conceptually similar to an external table and provides information such as file size, last modified timestamp, and file URL. References: [COF-C03] SnowPro Core Certification Exam Study Guide

A pre-signed URL provides a way to access objects stored in a stage without requiring authentication to Snowflake. This URL contains all the necessary information for access control, including an expiration time, and it's signed by the service ' s credentials. This mechanism allows users or applications to access specific files stored in a cloud storage location (stage) directly, bypassing the need to authenticate into Snowflake, ensuring secure and temporary access to the data.
References: Snowflake Documentation on Stages and Data Loading

The correct answer is B. Restrict access to Snowflake to known networks using a network policy .
A network policy improves account access security by allowing or blocking access based on IP address ranges. This helps ensure that users can connect to Snowflake only from approved networks.
Why B is correct:
Network policies can restrict inbound access to Snowflake by defining allowed and blocked IP address ranges. This is a direct security control for user access to a Snowflake account.
Example concept:
CREATE NETWORK POLICY corp_network_policy
ALLOWED_IP_LIST = ( ' 203.0.113.0/24 ' );
ALTER ACCOUNT SET NETWORK_POLICY = corp_network_policy;
Why the other options are incorrect:
A). A UDF is not the correct tool for managing account access security. Monitoring security parameters may provide visibility, but it does not directly restrict access.
C). A short session timeout can reduce risk from idle sessions, but making it "very short" can harm usability and is not as direct as network restrictions.
D). Every user already has access to the PUBLIC role by default. Setting restrictive permissions on PUBLIC is good practice, but it is not as direct as restricting access through a network policy.
Official Snowflake documentation reference:
Snowflake documentation describes network policies as security controls that restrict access to Snowflake based on allowed and blocked IP address lists.
Reference: Snowflake Documentation - Network policies; Snowflake Documentation - Network policy best practices; SnowPro Core Study Guide - Security and Access Control.
==

The ACCOUNTADMIN role is required for a user to create and manage accounts in Snowflake.This role has the highest level of privileges and is responsible for managing all aspects of the Snowflake account, including the ability to create and manage other user accounts1.
https://docs.snowflake.com/en/user-guide/security-access-control-considerations.html