SnowPro Core (COF-C03): A Condensed Learning Path

This is a compact study plan for Snowflake’s SnowPro Core certification, exam code COF-C03. It follows the five domains and 19 objectives in Snowflake’s official COF-C03 Exam Study Guide (last updated 8 July 2026).¹ Each topic links to the Snowflake documentation page that covers it, so you study from current docs instead of old blog posts. Every number in the “must know” lists was checked against those pages in October 2026.

Get the official guide too. It’s free from the certification page once you fill in a short form. The guide says its contents are for your own use, so this post summarises it in my own words and links to it rather than reproducing it. Use the guide’s outline as your checklist, as it suggests.¹

The exam at a glance

The official guide doesn’t give the question count, time limit or passing score. Those rows come from third-party sources. Check them on the registration page before your exam.

Assumed knowledge: the exam doesn’t test SQL basics or cloud fundamentals directly, but some questions assume you know them. That means tables and data types, querying and changing data, views, stored procedures and functions, authentication and authorisation, and how cloud storage and compute fit together.¹

Keeping it: you can renew the certification through Snowflake’s Continuing Education program. Either complete an eligible instructor-led course or pass an equivalent or higher SnowPro exam. Your certification has to still be valid to use the program.¹

The five domains

These weights come from the official guide.¹ It notes that the domain list doesn’t cover everything the exam may ask. Domain 1 is almost a third of the exam, so spend about a third of your time on it. Older study material, including some “SnowPro notes” still online, uses COF-C02’s six domains (24/18/18/16/12/12). Don’t plan your time around those numbers.

Not tested yet: two items in the guide are marked as untested until they’re generally available everywhere. They are Openflow (objective 3.2) and the default warehouse for Notebooks (objective 1.4).¹

The learning path

The path is four phases of roughly 8 to 10 hours each. The phases are ordered so each one builds on the last: architecture first, then moving data in, then securing and paying for it, then making it fast and sharing it. The hours are my own suggestion, not Snowflake’s. The guide says to set up a Snowflake University login and a 30-day free trial account before you start. Do every lab here in that trial.¹

1. Phase 1: The platform (Domain 1, 31%)
2. Phase 2: Getting data in and out (Domain 3, plus objective 4.4 on transformation)
3. Phase 3: Securing and paying for it (Domain 2)
4. Phase 4: Speed and sharing (Domains 4 and 5, then the practice exam)

Each phase ends with the free Snowflake University courses and “Getting Started with Snowflake” modules that the guide recommends for that domain.

Phase 1: The platform (Domain 1, 31%)

Objectives (from the official guide¹):

• 1.1: the three architecture layers and how the editions differ.
• 1.2: interfaces: Snowsight, the Snowflake CLI, and IDE integrations such as VS Code.
• 1.3: the object hierarchy, from the organisation and account down to database objects such as stages, UDFs, pipes, shares, sequences, ML models and applications. Also session context and parameter precedence.
• 1.4: configuring warehouses for different workloads.
• 1.5: storage, table types and view types.
• 1.6: AI/ML and app development features.

Read:

• Key concepts and architecture: the three layers are database storage, query processing (virtual warehouses), and cloud services.
• Snowflake editions: learn the feature matrix. The exam likes to ask which edition a feature first appears in.
• Snowflake CLI, VS Code extension, account identifiers.
• Overview of warehouses, warehouse considerations, multi-cluster warehouses, Gen2 warehouses, Snowpark-optimized warehouses.
• Micro-partitions and data clustering, temporary and transient tables, external tables, Apache Iceberg tables, dynamic tables, secure views.
• Parameters: account, session and object parameters, and how a lower level overrides a higher one.
• Cortex AI Functions, Cortex Search, Cortex Analyst, Snowflake ML, Streamlit in Snowflake, Snowflake Notebooks.

Must know:

• Which edition each feature needs. Standard Edition includes 1-day Time Travel, Fail-safe, dynamic tables, Iceberg tables, and database replication. Enterprise adds Time Travel of up to 90 days, multi-cluster warehouses, materialized views, search optimization, query acceleration, masking and row access policies. Business Critical adds Tri-Secret Secure, private connectivity (PrivateLink), HIPAA/HITRUST support, and account failover/failback.⁵
• Billing: warehouses bill per second, with a 60-second minimum each time they start. Auto-suspend is on by default.⁶
• Scale up or scale out? Making a warehouse bigger (“scaling up”) helps large, complex queries. It isn’t meant for concurrency. For many users at once, scale out with a multi-cluster warehouse (Enterprise) or add separate warehouses. Running queries of similar complexity on the same warehouse gives the best results.⁷
• Multi-cluster warehouses run in maximized mode (minimum clusters = maximum) or auto-scale mode (maximum > minimum). The Standard scaling policy (the default) starts clusters to avoid queuing. Economy keeps the running clusters fully loaded and accepts some queuing to save credits.⁸
• Gen2 is the next generation of standard warehouses. New standard warehouses default to GENERATION = '2' where it’s available, but Gen2 doesn’t come in 5X-Large or 6X-Large. Snowpark-optimized warehouses give you more memory on a single node, for jobs like ML training.⁹¹⁰
• Account identifiers: the preferred form is orgname-accountname.¹¹
• Micro-partitions hold 50 to 500 MB of uncompressed data each, stored by column. They’re created automatically, and they’re what lets Snowflake skip data a query doesn’t need (pruning).¹²
• Table types: temporary tables last for the session. Temporary and transient tables get 0 or 1 day of Time Travel and no Fail-safe. Permanent tables get 7 days of Fail-safe. External tables query files in an external stage as if they were a table. Iceberg tables store Parquet files in an external volume you manage, and use either Snowflake or an external catalog.¹³¹⁴¹⁵
• Secure views exist because a normal view’s internal optimisations can indirectly expose data in the base tables.¹⁶
• The Cortex family:
  • AI functions run in SQL, such as AI_COMPLETE, AI_CLASSIFY, AI_FILTER, AI_AGG and AI_EXTRACT.¹⁷
  • Cortex Search is hybrid (vector and keyword) “fuzzy” search, often used for RAG.¹⁸
  • Cortex Analyst answers business users’ natural-language questions about structured data, through a REST API.¹⁹
  • Snowflake ML covers the Feature Store and Model Registry.²⁰

Recent changes: the original Notebooks are now called Legacy Notebooks. Their replacement is Notebooks in Workspaces, which is compatible with Jupyter.²¹ There’s also a newer Adaptive Compute option (Enterprise Edition and up, in some regions) that sizes and routes compute automatically.²² Adaptive Compute isn’t in the guide’s warehouse objectives, so spend your time on standard warehouses.¹

Lab: in a trial account, create an X-Small warehouse and change its size. Turn it into a multi-cluster warehouse with each scaling policy. Create a permanent, a transient and a temporary table, then run SHOW TABLES and compare the retention_time column.

Official resources:¹

• Data Warehousing Workshop (Badge 1)
• Level Up: Key Concepts and Architecture, Snowflake Ecosystem, Object Hierarchy, Accounts and Assurances
• Getting Started modules 1–2: the lab environment and the user interface

Phase 2: Getting data in and out (Domain 3, 18%, plus 4.4)

Objectives (from the official guide¹):

• 3.1: file formats, internal and external stages, server-side encryption, directory tables, COPY INTO and its error-handling options.
• 3.2: automated ingestion with Snowpipe, Snowpipe Streaming, streams, tasks and dynamic tables.
• 3.3: drivers, connectors, and storage, API and Git integrations.
• 4.4: transforming structured, semi-structured and unstructured data, including aggregate and window functions.

Read:

• Overview of data loading, preparing your data files, loading considerations, COPY INTO <table>, unloading, directory tables.
• Snowpipe, streams, tasks, dynamic tables.
• Drivers, storage integrations, API integrations, Git repositories in Snowflake.
• Querying semi-structured data, FLATTEN, unstructured data, window functions.

Must know:

• Stages: each user has a user stage and each table has a table stage, and neither can be altered or dropped. A table stage only loads into its own table. Named internal and external stages are schema objects with their own privileges. PUT uploads files to an internal stage, and GET downloads unloaded files from one.²³²⁴
• Directory tables sit on top of a stage and store file-level metadata about its files. They aren’t separate objects and have no privileges of their own.²⁵
• File sizing: aim for files of about 100 to 250 MB compressed. How many files load in parallel depends on the warehouse size.²⁶
• Load metadata: COPY INTO remembers which files it has loaded for 64 days, so it won’t load the same file twice. FORCE = TRUE reloads everything regardless, which can duplicate data. A Snowpipe pipe remembers for 14 days, and truncating the target table doesn’t reset that.²⁷²⁸²⁹
• Error handling: ON_ERROR defaults to ABORT_STATEMENT for bulk COPY and SKIP_FILE for Snowpipe. SKIP_FILE is slower because it buffers whole files. PURGE = TRUE removes files from the stage after they load successfully.²⁸
• Unloading: COPY INTO <location> writes multiple files by default (SINGLE = FALSE).²⁴
• Snowpipe is a pipe (one COPY INTO statement) that runs on serverless compute. It’s triggered by cloud event notifications (AUTO_INGEST = TRUE) or the REST API. Snowpipe Streaming loads rows rather than files.²⁹
• Streams store an offset and no table data. Know the three types: standard, append-only and insert-only.³⁰
• Tasks run on a schedule or when an event happens, on serverless or user-managed compute. You can chain them into task graphs.³¹
• Dynamic tables are declarative: you write a SELECT and a TARGET_LAG, and Snowflake refreshes the table, incrementally or in full, in dependency order.³²
• Integrations:
  • A storage integration lets a stage reach cloud storage without passing credentials around.³³
  • An API integration stores the details of an HTTPS service.³⁴
  • A Git integration syncs a remote repository into a clone inside Snowflake, including all its branches, tags and commits.³⁵
• Unstructured files are reached through scoped URLs, file URLs or pre-signed URLs.³⁶

Lab: stage a JSON file, load it into a VARIANT column, flatten it with LATERAL FLATTEN, and then rebuild the same pipeline as a dynamic table. Load a file twice to see the load metadata skip it, then reload it with FORCE = TRUE.

Official resources:¹

• Level Up: Data Loading
• Getting Started modules 4–5: loading CSVs and JSON
• Best Practices for Data Unloading (Snowflake Community)

Phase 3: Securing and paying for it (Domain 2, 20%)

Objectives (from the official guide¹):

• 2.1: the security model: RBAC and DAC, the securable object hierarchy, network policies, authentication methods (MFA, federated SSO, OAuth and key pairs), and system, account, database, custom and secondary roles. Also account identifiers, logging and tracing.
• 2.2: governance: masking and row-level security, tagging, privacy policies, the Trust Center, encryption keys, alerts and notifications, replication and failover, and lineage.
• 2.3: monitoring and cost: resource monitors, warehouse credit usage, and the ACCOUNT_USAGE schema.

Read:

• Access control overview, configuring access control, secondary roles, caller’s and owner’s rights.
• MFA, federated authentication and SSO, OAuth, key-pair authentication, network policies.
• Dynamic Data Masking, row access policies, aggregation and projection policies, object tagging, Trust Center, encryption key management, alerts, data lineage, logging and tracing.
• Resource monitors, Account Usage.

Must know:

• Access control models: in DAC, every object has an owner, who can grant access to it. In RBAC, privileges go to roles and roles go to users. UBAC grants privileges to users directly.³⁷

• System roles: ACCOUNTADMIN includes SYSADMIN and SECURITYADMIN. SECURITYADMIN inherits USERADMIN and has MANAGE GRANTS. ORGADMIN is being phased out in favour of GLOBALORGADMIN, which older material won’t mention.³⁷

• Secondary roles: objects are created with the primary role’s privileges, but secondary roles add their privileges to other statements.³⁸

• Stored procedures run with owner’s rights by default. Declare EXECUTE AS CALLER if the procedure should use the caller’s own privileges instead.³⁹

• Authentication:

  • MFA is for human users who sign in with a password. Snowflake is moving to require MFA for all password sign-ins.⁴⁰
  • Service users authenticate another way, such as a key pair, which needs at least a 2048-bit RSA key.⁴⁰⁴¹
  • Federated SSO works through SAML 2.0 or OpenID Connect identity providers.⁴²
  • OAuth comes in two kinds: Snowflake OAuth and External OAuth.⁴³

• Governance policies are all schema-level objects:

  • Masking policies mask column values at query time.⁴⁴
  • Row access policies decide which rows a query returns.⁴⁵
  • Aggregation policies make queries aggregate rows into groups of a minimum size.⁴⁶
  • Projection policies decide whether a column can appear in query output.⁴⁷

  Masking, row access, aggregation and projection policies all need Enterprise Edition.⁵

• Tags are key-value pairs. Child objects inherit them, and they can be set to propagate automatically.⁴⁸ Lineage shows where an object’s data comes from and where it goes, and needs Enterprise Edition.⁴⁹

• Encryption: all data is encrypted by default with AES, using a hierarchical key model. Snowflake rotates the keys automatically, and Enterprise adds periodic rekeying.⁵⁰⁵

• Trust Center checks an account against scanners and reports findings.⁵¹ An alert is a schema-level object that checks a condition on a schedule and runs an action when it’s met.⁵²

• Resource monitors only cover warehouses, not serverless features. Only ACCOUNTADMIN can create one. A monitor’s credit quota counts cloud services usage too.⁵³

• ACCOUNT_USAGE vs INFORMATION_SCHEMA: ACCOUNT_USAGE includes dropped objects, lags by 45 minutes to 3 hours, and keeps data for 1 year. INFORMATION_SCHEMA has no lag, but only keeps 7 days to 6 months.⁵⁴

Lab: build a small role hierarchy under SYSADMIN, then add a masking policy that shows full email addresses to one role only. Write one owner’s-rights and one caller’s-rights procedure and compare what a low-privilege role can do with each. Set a resource monitor on your warehouse with a low quota and watch it trigger.

Official resources:¹

• Courses: Level Up: Resource Monitors, FinOps for Snowflake
• Getting Started module 9: roles, account admin and Account Usage
• Reading: Quickly Visualize Snowflake’s Roles, Grants and Privileges, Definitive Guide to Managing Spend in Snowflake

Phase 4: Speed and sharing (Domains 4 and 5, 31% together)

Objectives (from the official guide¹):

• 4.1: evaluating query performance with Query Profile and query insights. Look for spilling, inefficient pruning, exploding joins and queuing. Use the ACCOUNT_USAGE views for query history and cost attribution, and group similar workloads together.
• 4.2: query acceleration, search optimization, clustering keys and materialized views.
• 4.3: the result, metadata and warehouse caches.
• 5.1: replication and failover, secure sharing, cloning, Time Travel and Fail-safe.
• 5.2: provider, consumer and reader accounts, direct shares, resharing and clean rooms.
• 5.3: Marketplace, private and public listings, and Native Apps.

Read:

• Query Profile in Snowsight, query insights, QUERY_ATTRIBUTION_HISTORY.
• Query Acceleration Service, search optimization, clustering keys, materialized views, persisted query results.
• Time Travel, Fail-safe, cloning, TRUNCATE TABLE, replication and failover.
• Secure Data Sharing, reader accounts, listings, Snowflake Marketplace, Native App Framework, Data Clean Rooms.

Must know (performance):

• Query Profile signs to recognise:

  • Bytes spilled to local or remote storage: the warehouse ran out of memory, so try a bigger size.
  • Poor pruning: compare partitions scanned with the total.
  • The most expensive nodes in the plan.⁵⁵

  Query insights flags exploding joins, joins without a condition, filters that can’t prune, remote spilling, and queries that waited too long in a warehouse’s queue.⁵⁶ QUERY_ATTRIBUTION_HISTORY shows the warehouse compute cost of individual queries.⁵⁷

• Which tool for which problem:

  • QAS offloads the heavy parts of outlier queries to shared serverless compute.⁵⁸
  • Search optimization speeds up selective point lookups.⁵⁹
  • Clustering keys are for very large tables where the natural data order is poor.⁶⁰
  • Materialized views query a single table only and are kept up to date in the background.⁶¹

• Caches: the result cache keeps a query’s result for 24 hours, and each reuse resets the clock, up to 31 days in total. A reuse only happens if the underlying data hasn’t changed and the role has access.⁶² The other two caches to know are the metadata cache and the warehouse (local disk) cache.¹

Must know (protection and sharing):

• Time Travel keeps 1 day by default. Permanent objects can be set to anything from 0 to 90 days, but values above 1 day need Enterprise Edition. After Time Travel comes Fail-safe: 7 days that you can’t configure, where only Snowflake Support can recover data.⁶³⁶⁴
• Cloning copies the structure but not the data.
  • A cloned database or schema keeps the grants on its child objects, but not the grants on the container itself.
  • Internal named stages are only cloned with INCLUDE INTERNAL STAGES.
  • Unconsumed records in a cloned stream are inaccessible, much as a cloned table’s history starts when the clone is made.⁶⁵
• TRUNCATE vs DELETE: both keep the deleted data for Time Travel. TRUNCATE also clears the table’s load metadata, so the same files can be loaded again.⁶⁶
• Replication: replication groups produce read-only secondaries. Failover groups can be promoted to primary, and failover needs Business Critical.⁶⁷
• Sharing: shared objects are read-only and no data is copied. Consumers only pay for the compute they use. A reader account is created and paid for by the provider, for consumers who don’t have a Snowflake account.⁶⁸⁶⁹

Lab: run the same query twice and watch the second run come back from the result cache. Drop a table and UNDROP it. Clone a schema that contains a stream, and check which grants came with it and what the cloned stream returns. Share a secure view with a reader account.

Official resources:¹

• Courses: Data Application Builders Workshop (Badge 3), Level Up: Query History and Caching, Level Up: Context in Snowflake, Collaboration, Marketplace & Cost Estimation Workshop (Badge 2), Level Up: Native App Development for Beginners
• Getting Started modules: 7 (caching and cloning), 6 (Marketplace data), 8 (Time Travel), 10 (sharing via Marketplace)
• Reading: Understanding Result Caching, Local and Remote Disk Spilling, Search Optimization: When & How to Use

Before you book

The official guide recommends four habits:¹

1. Set a date and plan backwards from it.
2. Weight your time by the domain percentages.
3. Use the outline as a checklist of what you know and what you don’t.
4. Take the official practice exam to get used to the question style.

If you’d rather have an instructor, the guide suggests two routes. One is Snowflake Fundamentals followed by the SnowPro Core On-Demand Preparation Course. The other is Snowflake Foundations, then Administering Snowflake, then the same preparation course.¹

The guide’s sample questions are scenarios: a requirement changes, and you pick the right setting or command. You can’t answer those from memorised definitions alone, which is why every phase above has a lab. Stay away from “exam dump” sites. They aren’t official, and they’re often written for the old exam anyway.

References

Most links below go to Snowflake’s documentation, study guide and certification pages. Entries marked (Unofficial) are third-party sources, used only for exam details the official guide doesn’t state.