Domain 1 Overview — Snowflake Architecture & AI Data Cloud
Why Domain 1 Matters Most
At 31% of the COF-C03 exam, Domain 1 is the single heaviest-weighted domain — roughly 31 questions out of 100. Mastering Snowflake's three-layer architecture, object hierarchy, storage mechanics, and the AI Data Cloud features is the fastest path to clearing the 750/1000 passing threshold. This domain was significantly expanded in the February 2026 launch to include Cortex AI, Snowpark, and Iceberg table coverage.
What Domain 1 Tests
- Three-layer architecture: Storage, Compute (Virtual Warehouses), Cloud Services — and how decoupling benefits performance and cost.
- Snowflake Editions: Standard vs. Enterprise vs. Business Critical vs. VPS — feature differences matter for scenario questions.
- Object hierarchy: Database → Schema → Objects (tables, views, stages, streams, tasks, pipes, functions, procedures).
- Table types: Permanent, Transient, Temporary, External, Dynamic, Iceberg — Time Travel and Fail-Safe support per type.
- Storage mechanics: Micro-partitions, partition pruning, columnar compression.
- Time Travel & Fail-Safe: Retention periods, who can access, which table types qualify.
- Zero-Copy Cloning: Instant, copy-on-write, no inherited Time Travel.
- Semi-structured data: VARIANT, OBJECT, ARRAY, FLATTEN(), PARSE_JSON().
- AI Data Cloud: Cortex LLM functions, Cortex Search, Cortex Analyst, Snowflake ML, Snowpark, Notebooks, Streamlit, Iceberg.
Exam Quick Facts — COF-C03
- Launched: February 16, 2026
- Format: Multiple choice and multi-select
- Passing score: 750 / 1000 (scaled)
- Duration: 115 minutes
- Cost: $175 USD
- Delivery: Pearson VUE (online proctored or test center)
- Validity: 2 years
Key Topics at a Glance
Core Concepts
1. Snowflake's Three-Layer Architecture
Storage Layer
Data is stored in Snowflake-managed cloud storage (Amazon S3, Azure Blob Storage, or Google Cloud Storage — depends on chosen cloud platform). All data is stored in a columnar compressed format. The storage layer is fully decoupled from compute.
- Micro-partitions: The smallest unit of storage. Each is 50–500 MB of compressed data (approximately 16 MB uncompressed). Immutable, automatically managed by Snowflake.
- Metadata tracked per micro-partition: min/max values, count, null count — used to enable partition pruning (skipping irrelevant partitions during queries).
- Benefit of decoupling storage: compute can be paused while data persists; you pay only for storage when idle.
Compute Layer — Virtual Warehouses
Virtual Warehouses (VW) are independent MPP (massively parallel processing) compute clusters. Multiple warehouses can read the same data simultaneously with no contention. Each VW maintains its own local disk cache for recently accessed data.
- Sizes: XS (1 server) → S (2) → M (4) → L (8) → XL (16) → 2XL (32) → 3XL (64) → 4XL (128) → 5XL (256) → 6XL (512)
- Each size up = 2× credit consumption per hour
- Billing: per-second, 60-second minimum per resume
- Auto-suspend: pauses after configurable idle period; minimum 60 seconds setting
- Auto-resume: restarts automatically when a query arrives (default: enabled)
Cloud Services Layer
The always-on, serverless brain of Snowflake. It coordinates everything across the platform. You do NOT provision or manage it — Snowflake runs it for you.
- Authentication & Authorization: user login, role-based access control
- Query optimization: parses, optimizes, and compiles queries
- Metadata management: stores object definitions, statistics, micro-partition metadata
- Infrastructure management: provisioning, monitoring, health
- Transaction management: ACID compliance, concurrency control
2. Snowflake Editions
| Edition | Key Features |
|---|---|
| Standard | Core features, 1-day Time Travel, all connectors |
| Enterprise | Multi-cluster warehouses, 90-day Time Travel, column-level security, materialized views |
| Business Critical | HIPAA, PCI-DSS, SOC 2 Type II, private connectivity, customer-managed keys (Tri-Secret Secure), database failover |
| Virtual Private Snowflake (VPS) | Dedicated metadata store, highest isolation, for regulated industries |
3. Multi-Cluster Warehouses (Enterprise+)
Scaling Out for Concurrency
Multi-cluster warehouses automatically add or remove clusters based on query concurrency demand. Available on Enterprise edition and above.
- Configure min and max cluster count
- Scaling Policy — Standard: maximize performance; add clusters immediately when queries queue
- Scaling Policy — Economy: minimize credit usage; wait before adding clusters; consolidate when possible
- Eliminates concurrency bottlenecks during peak loads without manual intervention
4. Snowflake Object Hierarchy
Hierarchy: Organization → Account → Database → Schema → Objects
Within a Schema, you can create: Tables, Views, Stages, Pipes, Streams, Tasks, Sequences, Functions (UDFs), Stored Procedures, File Formats.
5. Table Types
| Table Type | Time Travel | Fail-Safe | Scope / Notes |
|---|---|---|---|
| Permanent | Up to 90 days (Enterprise) / 1 day (Standard) | 7 days ✓ | Default table type; persists until dropped |
| Transient | Up to 1 day | None ✗ | For staging/ETL; lower cost; no Fail-Safe |
| Temporary | Up to 1 day | None ✗ | Session-scoped; auto-dropped at session end |
| External | None ✗ | None ✗ | Metadata in Snowflake; data in external stage; read-only |
| Dynamic | Yes (Permanent-backed) | Yes | Auto-refreshed from query definition; declarative pipelines |
| Iceberg | Via Snowflake catalog | None ✗ | Open format; data in external object storage; multi-engine |
6. View Types
Standard View
A stored SQL query. No performance benefit — executes the underlying query every time. No separate storage consumed.
Materialized View (Enterprise+)
Pre-computed result set stored on disk. Auto-refreshed when source data changes. Faster query performance. Consumes storage and compute credits for maintenance.
Secure View
Hides the view definition (DDL) from unauthorized users. Used for data sharing to prevent reverse-engineering of underlying logic. Can be standard or materialized.
7. Storage Features
Time Travel
- Query, clone, or restore data from any point in the retention window
- Standard: up to 1 day | Enterprise: up to 90 days
- SQL:
ATorBEFOREclauses with timestamp, offset, or query ID - Applies to: Permanent, Transient, Temporary tables
- User can access directly via SQL
Fail-Safe
- 7-day emergency recovery period after Time Travel expires
- Only Snowflake Support can recover data — not user-accessible
- Applies to Permanent tables only (not Transient, Temporary, External, Iceberg)
- Additional storage cost for 7 days beyond Time Travel window
Zero-Copy Cloning
- Instantly clone any Snowflake object: table, schema, database, or warehouse
- No data duplication at creation — metadata pointer only
- Copy-on-write: storage is only allocated when cloned data is modified
- Clones do NOT inherit the source object's Time Travel history
- Clones start fresh Time Travel at time of cloning
Micro-Partitions & Partition Pruning
- 50–500 MB compressed columnar files (≈16 MB uncompressed)
- Automatically managed, immutable
- Metadata stored: min/max values, row count, null count per column
- Partition pruning: Cloud Services uses metadata to skip irrelevant micro-partitions — massive query speedups without manual indexing
8. Semi-Structured Data
VARIANT, OBJECT, ARRAY
- VARIANT: Flexible column type for JSON, Avro, Parquet, ORC, XML. Max 16 MB per individual value.
- OBJECT: Represents key-value pairs (analogous to a JSON object)
- ARRAY: Ordered list of values (analogous to a JSON array)
- Access with dot notation:
col:key.subkeyor bracket notation:col['key'] FLATTEN(): lateral table function that expands arrays/objects into rows (enables joins)PARSE_JSON(): converts a JSON string into a VARIANT value
9. AI Data Cloud Features ★ New in COF-C03
Snowflake Cortex
Suite of AI/ML capabilities built directly into Snowflake. No data movement required — AI runs where your data already lives.
- Cortex LLM Functions (SQL): Call LLMs directly in SQL — COMPLETE(), SUMMARIZE(), SENTIMENT(), TRANSLATE(), EXTRACT_ANSWER(). No setup required, positional function syntax.
- Cortex Search: Unstructured text search powered by vector embeddings — enables semantic search over documents.
- Cortex Analyst: Natural-language-to-SQL for business users — ask questions in plain English, get SQL queries back.
Snowflake ML
AutoML built into Snowflake. Supports classification, regression, forecasting, and anomaly detection via built-in ML functions — no external ML platform required.
Snowpark
Developer framework for running Python, Java, or Scala code inside Snowflake (pushdown computation). Core use cases: ETL pipelines, feature engineering, user-defined functions (UDFs), stored procedures.
Snowflake Notebooks
Interactive Python/SQL notebooks running within Snowflake. No external Jupyter server needed. Know the positioning and use cases — hands-on syntax not required for COF-C03.
Streamlit in Snowflake
Build data applications directly inside Snowflake — no external hosting or infrastructure required. Integrates with Snowflake data and compute natively.
Apache Iceberg Tables
Open table format standard. Data stored in external object storage (S3/GCS/ADLS), Snowflake provides the query engine. Know WHY: multi-engine interoperability (Spark, Flink, Trino can all read the same Iceberg tables). Operational details not required for the exam.
Memory Hooks — Make It Stick
Six mnemonics to lock in the most testable concepts for Domain 1.
3 Layers: Store → Compute → Think
Storage (your data at rest) / Virtual Warehouses (your compute muscle) / Cloud Services (the always-on brain that optimizes, authenticates, and manages everything). Decoupling = scale each independently and pause compute to save costs.
PTETI — Table Types
Permanent (Time Travel + Fail-Safe) → Transient (Time Travel only, no Fail-Safe) → External (no TT, no FS, read-only) → Temporary (session-only, no FS) → Iceberg (external storage, open format). Match the type to the requirement!
Time Travel = YOU. Fail-Safe = Support Only.
Time Travel: YOU query the past via SQL (AT/BEFORE). Standard = 1 day, Enterprise = up to 90 days. Fail-Safe: only Snowflake Support can recover it — 7 days after Time Travel expires. Permanent tables only.
Zero-Copy Clone = Instant Snapshot, Copy-on-Write
Creation is instant (metadata pointer only, no data duplication). Storage is charged only when cloned data is changed. Clones do NOT inherit the source Time Travel — they start fresh from the moment of cloning.
Micro-partitions: 50–500 MB compressed, ~16 MB uncompressed, auto-managed, immutable
Snowflake tracks min/max, count, nulls per column in metadata. This metadata powers partition pruning — the query optimizer skips irrelevant micro-partitions without you doing anything. No manual indexing needed.
Cortex = AI in SQL. Snowpark = Code in Snowflake. Notebooks = Interactive Python/SQL.
Cortex: call LLMs (SUMMARIZE, SENTIMENT, TRANSLATE) directly in SQL queries. Snowpark: bring your Python/Java/Scala code to the data (pushdown computation). Notebooks: interactive dev environment inside Snowflake, no external hosting.
Practice Quiz — 10 Questions
Select one answer per question, then click Submit Quiz to see your score and feedback.
Review the feedback above each question to reinforce weak areas.
Flashcards — Click to Flip
Click any card to reveal the answer. Click again to flip back.
2. Compute Layer — Virtual Warehouses (MPP clusters) that process queries; each has its own cache.
3. Cloud Services Layer — Always-on serverless brain: auth, query optimization, metadata, transactions.
Format: Columnar, compressed, immutable.
Management: Automatically created and managed by Snowflake.
Metadata tracked: min/max values, row count, null count per column.
Enables: Partition pruning — skip irrelevant micro-partitions without manual indexing.
Fail-Safe: 7 days AFTER Time Travel expires. Only Snowflake Support can recover. Permanent tables ONLY. Not user-accessible.
Transient: Time Travel ✓ (max 1d) + Fail-Safe ✗. Good for staging/ETL.
Temporary: Time Travel ✓ (max 1d) + Fail-Safe ✗. Session-scoped; auto-dropped when session ends.
XS=1 server · S=2 · M=4 · L=8 · XL=16 · 2XL=32 · 3XL=64 · 4XL=128 · 5XL=256 · 6XL=512.
Billing: per-second, 60-second minimum per resume. Auto-suspend pauses to save credits; auto-resume restarts on query.
Standard policy: maximize performance — add clusters immediately when queries queue.
Economy policy: minimize credits — wait before adding, consolidate when possible.
Use case: eliminating concurrency bottlenecks during peak loads.
col:key.sub) or bracket (col['key']) notation.FLATTEN(): A lateral table function that expands arrays or objects into rows. Used to "flatten" nested semi-structured data for relational-style querying.
Snowpark: Developer framework — run Python, Java, or Scala code inside Snowflake (pushdown). Used for ETL, feature engineering, UDFs, stored procedures. Code-first approach.
Study Advisor — Targeted Focus Areas
Select a category to see targeted study tips, common exam traps, and what to prioritize.
🏗️ Architecture Layers — Study Tips
- Know all three layers by name and function: Storage (columnar compressed, object storage), Compute (Virtual Warehouses, MPP), Cloud Services (auth, query optimization, metadata, transactions).
- Decoupling is the #1 exam theme: Multiple VWs can query the same data simultaneously with no contention. Compute can be paused while storage persists — you only pay for storage when idle.
- Trap: Caching lives in the Compute layer (VW local disk cache), NOT in Cloud Services. Cloud Services manages metadata — different from data caching.
- Cloud Services is always-on and serverless — you don't provision it. Exam questions sometimes imply you "configure" Cloud Services; you don't.
- Micro-partition facts: 50–500 MB compressed, ~16 MB uncompressed. The difference is important — exams test both numbers.
- Partition pruning is enabled by micro-partition metadata (min/max, nulls) — this is automatic, not manual indexing. Know this distinction.
📦 Object Types — Study Tips
- Table type matrix is heavily tested: Memorize Time Travel and Fail-Safe support for each type. Use the PTETI mnemonic (Permanent, Transient, External, Temporary, Iceberg).
- External tables: metadata only in Snowflake; data in external stage; read-only; no Time Travel; no Fail-Safe. Do NOT confuse with Iceberg tables.
- Iceberg tables: open format; data in external object storage; Snowflake queries it but doesn't own it; multi-engine interop is the WHY. Know the "why", not the operational how.
- Dynamic tables: auto-refreshed from a query definition — used for declarative data pipeline patterns. Different from materialized views in management model.
- Secure views: hides DDL from unauthorized users — important for data sharing security. Don't confuse with materialized views (performance) or standard views (simplicity).
- Zero-Copy Clone: Clones do NOT inherit Time Travel history. This is a frequent exam trap — a clone starts fresh from the clone moment.
⏱️ Time Travel & Fail-Safe — Study Tips
- Know the periods cold: Time Travel Standard = 1 day, Enterprise = up to 90 days. Fail-Safe = always 7 days (after TT expires). No exceptions on the exam.
- Fail-Safe access: ONLY Snowflake Support can recover Fail-Safe data. Not ACCOUNTADMIN, not SYSADMIN, not OWNERSHIP — only Snowflake Support. This is a frequent trap.
- Which tables have Fail-Safe: Permanent tables ONLY. Transient, Temporary, External, Iceberg have NO Fail-Safe.
- Time Travel SQL: Use AT or BEFORE clauses. Know you can specify a timestamp, a relative offset (negative seconds), or a query ID. Syntax depth not heavy on COF-C03.
- Cost tradeoff: Longer Time Travel = more storage cost (historical data retained). Enterprise 90-day TT = significantly more storage overhead than Standard 1-day.
- Zero-Copy Clone + Time Travel: Clones don't inherit source Time Travel history. This comes up in scenario questions frequently.
🤖 AI & Cortex — Study Tips
- Cortex = AI in SQL, no data movement: The defining characteristic of Cortex LLM functions is that they run inside Snowflake — no external API calls, no data leaving Snowflake.
- Know the five LLM function names: COMPLETE, SUMMARIZE, SENTIMENT, TRANSLATE, EXTRACT_ANSWER. Positional syntax (no named parameters required). COF-C03 tests recognition, not memorization of syntax.
- Cortex Search vs Cortex Analyst: Search = unstructured text/semantic search. Analyst = natural language to SQL for business users. Don't mix them up.
- Snowpark vs Cortex: Snowpark is for developers writing Python/Java/Scala code. Cortex is for SQL users calling AI functions. Different personas, different tools.
- Snowflake Notebooks: Interactive Python/SQL inside Snowflake. Know the use case (data exploration, ML experimentation) — not the hands-on API.
- Iceberg WHY: Multi-engine interoperability. Other tools (Spark, Flink, Trino) can read the same Iceberg tables. Snowflake acts as the query engine without owning the data.
- Streamlit in Snowflake: Build data apps without external hosting. Know it's for building UIs on Snowflake data.
🏭 Virtual Warehouses — Study Tips
- Sizing doubles: Each size up = 2× credit consumption. XS=1 server, S=2, M=4… Know this pattern.
- Billing model: Per-second billing with a 60-second minimum each time a warehouse resumes. Auto-suspend after configurable idle time (minimum 60 seconds for the setting).
- Auto-resume is ON by default: A warehouse automatically restarts when a query arrives. Exam may test whether auto-resume requires manual intervention — it does not by default.
- Multi-cluster = Enterprise+ only: Not available on Standard edition. Exam scenarios often test whether a described situation requires Enterprise features.
- Scaling policies: Standard = maximize performance (add clusters aggressively). Economy = minimize credits (add clusters conservatively). Match policy to business need in scenario questions.
- No contention on reads: Multiple VWs can read the same Snowflake data simultaneously. Storage decoupling means no locking on reads across warehouses.
- VW local cache: Each VW caches recently used data locally on its compute nodes. Cache is lost when VW is suspended. Re-warming cache after resume is a cold-start consideration.
Resources & Next Steps
Official Snowflake Resources
- SnowPro Core COF-C03 Certification Page — Official exam guide, domains, and registration
- Snowflake Architecture Key Concepts — Three-layer architecture documentation
- Virtual Warehouses Overview — Sizing, billing, auto-suspend/resume
- Table Storage Considerations — Time Travel, Fail-Safe, table types
- Snowflake Cortex Documentation — LLM functions, Cortex Search, Cortex Analyst
- Snowpark Developer Guide — Python/Java/Scala in Snowflake
This Series — SnowPro Core COF-C03 (5 Pages)
- Page 1 (This Page): Architecture, Object Hierarchy & AI Data Cloud — Domain 1 (31%)
- Page 2: Data Movement, Stages, Pipes & Loading — Domain 2
- Page 3: Data Transformation, Streams, Tasks & Queries — Domain 3
- Page 4: Access Control, Security & Data Sharing — Domain 4
- Page 5: Performance Optimization, Cost Management & Administration — Domain 5
Study Tips for COF-C03 Domain 1
- Domain 1 is 31% of the exam — the single largest domain. Allocate proportional study time.
- The AI Data Cloud section (Cortex, Snowpark, Iceberg, Notebooks) is new in the COF-C03 launch (Feb 2026). Older study materials will not cover it adequately.
- Know use cases and positioning for AI features, not hands-on syntax — the exam tests when and why to use each capability.
- Table types (Permanent/Transient/Temporary/External/Iceberg) are heavily tested in scenario questions. Build the Time Travel + Fail-Safe matrix from memory.
- Time Travel "who can access" vs. Fail-Safe "who can access" is a near-certain exam topic.
- Practice with exam-style questions — reading comprehension and scenario elimination are key skills for this exam format.
Practice with FlashGenius
- Create a free account to access full COF-C03 practice exams
- Exam-style questions with detailed explanations across all 5 domains
- Performance tracking to identify weak areas
- Timed practice mode to simulate the 115-minute exam experience