Home labs & practical projects

Separate warehouse access from data access

A project to do with your own tools, with guidance on what to create and capture.

Vendor environment Suggested time: 2–3 hoursYour own authorised environment

What you could create

An analyst can start a Snowflake warehouse but cannot query the intended table. Another role has broader access than required.

Example evidence format

Project evidence map (example)

Role and privilege matrixScope and inputs

Query access tests and compute-use notesDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Role and privilege matrix	Show the inputs, scope and decisions behind this record. Compute access and object privileges are tested separately.
Query access tests and compute-use notes	Include the evidence supporting your conclusion. The final grant model contains no unexplained broad administrative permission.

What you'll need

Vendor environment

Use an authorised training account, a small synthetic table and two test roles. Record compute limits and suspend settings before running queries.

Project record

Keep the working files for role and privilege matrix and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Access may require a licence, trial or training subscription. Confirm availability and permitted use before committing; no free tenant is assumed.

Use an authorised training tenant with test identities and synthetic data. If access is unavailable, document the plan and label it untested.

Suggested milestones

1
Plan and investigate
Map the privileges needed for warehouse, database, schema and table access.
2
Develop your approach
Create a least-privilege analyst path and verify the unrelated role remains restricted.
3
Verify and explain
Inspect query behaviour and document compute usage and cleanup.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Role and privilege matrix
Show the inputs, scope and decisions behind this record. Compute access and object privileges are tested separately.
2
Query access tests and compute-use notes
Include the evidence supporting your conclusion. The final grant model contains no unexplained broad administrative permission.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your role and privilege matrix needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Use an authorised training account, a small synthetic table and two test roles. Record compute limits and suspend settings before running queries.

What a good result looks like

Compute access and object privileges are tested separately.
The final grant model contains no unexplained broad administrative permission.

Finish the project

Remove test identities, policies and data, restore the initial configuration, and check trial expiry or renewal settings.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.