Covers user identity and authentication, data protection and governance, audit logging and compliance, threat detection and incident response, and securing AI, ML and application workloads.
12 free sample questions156 in the full practice test
Access Control and Identity Management · Authentication mechanisms
A security engineer is configuring authentication policies in Snowflake for a multinational enterprise. The organization has set an account-level authentication policy that requires multi-factor authentication (MFA) for all users. However, a specific service account named ETL_SVC_ACCOUNT is used by an automated pipeline that cannot process MFA prompts. The engineer creates a new authentication policy that disables the MFA requirement and assigns it directly to the ETL_SVC_ACCOUNT user. When the ETL pipeline attempts to connect, which of the following describes the outcome?
Answer and explanation
Correct answer: D
In Snowflake, when authentication policies are applied at multiple levels, the most granular level takes precedence. A policy attached directly to a user overrides a policy attached to the account. Therefore, the user-level policy disabling MFA will apply to the service account, allowing the automated pipeline to connect successfully.
Q2Question 2
IntermediateMultiple answers
Access Control and Identity Management · Access control model
An organization is enforcing strict discretionary access control (DAC) by utilizing Managed Access Schemas. A data engineer with a custom role named DATA_ENGINEER_ROLE creates a new table within a Managed Access Schema. Which of the following entities have the authority to grant privileges on this newly created table to other roles? (Select TWO)
Answer and explanation
Correct answers: B, C
In a Managed Access Schema, the schema owner manages all privilege grants, including future grants, on objects within the schema. The role that creates an object inside the schema (the object owner) loses the ability to grant privileges on that object to other roles.
Roles with the global MANAGE GRANTS privilege (typically SECURITYADMIN or ACCOUNTADMIN) bypass standard ownership restrictions and can grant or revoke privileges on any object, including those within a Managed Access Schema.
Q3Question 3
Advanced
Access Control and Identity Management · Authentication mechanisms
A financial services institution is building a custom web application that requires access to Snowflake data. The security architecture mandates the use of OAuth for delegating authorization. The application will act as an external OAuth client.
The security engineering team needs to configure a security integration in Snowflake for this custom client. The requirements stipulate that the access tokens issued must expire in exactly 30 minutes to minimize the window of exposure, and refresh tokens must not be issued to this specific client due to the application's stateless nature.
During the implementation, the lead engineer creates the security integration using the CREATE SECURITY INTEGRATION command. However, during testing, the security team notices that the application is still receiving refresh tokens, and the access tokens are valid for the default 10 minutes rather than the requested 30 minutes.
Based on this scenario, which combination of properties must be explicitly set on the security integration to meet the strict security requirements?
Answer and explanation
Correct answer: B
To configure a custom OAuth client in Snowflake, the security integration must be created with TYPE = OAUTH and OAUTH_CLIENT = CUSTOM. The OAUTH_ACCESS_TOKEN_VALIDITY property is specified in seconds, so 30 minutes equals 1800 seconds. To prevent the issuance of refresh tokens, OAUTH_ISSUE_REFRESH_TOKENS must be set to FALSE. Setting these exact parameters ensures the tokens adhere to the stringent 30-minute lifespan without refresh capabilities.
sequenceDiagram
participant App as Custom Web App
participant Auth as Authorization Server
participant SF as Snowflake
App->>Auth: Request Authorization
Auth-->>App: Authorization Grant
App->>Auth: Exchange Grant for Token
Auth-->>App: Access Token (Expires in 1800s, No Refresh)
App->>SF: API Request + Access Token
SF-->>App: Data Payload
Q4Question 4
Beginner
Access Control and Identity Management · Authentication mechanisms
A Snowflake administrator needs to group several AWS VPC endpoints and public IP addresses together so they can be referenced by multiple network policies across the account. Which Snowflake object should be created to fulfill this requirement?
Answer and explanation
Correct answer: D
A Network Rule is a Snowflake object that groups network identifiers, such as IPv4 addresses or VPC endpoints, into a single logical unit. These rules can then be referenced by network policies (or external access integrations) to control traffic flow, making administration much more scalable than defining IPs directly inside multiple policies.
Q5Question 5
Beginner
Access Control and Identity Management · Access control model
True or False: When a user executes the USE SECONDARY ROLES ALL command in a Snowflake session, they can only perform actions that require the intersection (overlap) of privileges from all their granted roles.
Answer and explanation
Correct answer: B
When USE SECONDARY ROLES ALL is executed, the user's session utilizes the aggregate (union) of all privileges granted to their primary role and all secondary roles, not the intersection. This allows the user to query cross-database objects seamlessly without constantly switching primary roles.
Q6Question 6
Intermediate
Access Control and Identity Management · Authentication mechanisms
A security engineer is performing an automated credential rotation for an application that connects to Snowflake via Key Pair Authentication. To achieve zero downtime during the rotation process, which operational sequence must the engineer follow?
Answer and explanation
Correct answer: C
Snowflake supports assigning up to two public keys to a single user (RSA_PUBLIC_KEY and RSA_PUBLIC_KEY_2). To achieve zero downtime during rotation, the engineer should assign the new key to RSA_PUBLIC_KEY_2. While both keys are active, the client is updated to use the new private key. Once the transition is verified, the old key can be safely removed from RSA_PUBLIC_KEY.
Register free for 6 more questions
Or unlock all 156 SEA-C01 questions with explanations, timed mode and flashcards.
