COF-C03 Question 145
Single answerNetwork PoliciesA Snowflake administrator needs to restrict user access so that employees can connect only from the corporate office IP range 203.0.113.0/24 or the company VPN range 198.51.100.0/24. However, the security team also wants to ensure that one known malicious public IP address, 203.0.113.45, is blocked even though it falls within the corporate range. Which configuration best meets this requirement?
- A
Create a network policy with ALLOWED_IP_LIST = ('203.0.113.0/24','198.51.100.0/24') and BLOCKED_IP_LIST = ('203.0.113.45') and assign the policy to the account or relevant users.
- B
Create a network policy with only BLOCKED_IP_LIST = ('203.0.113.45') and assign it to the account, because blocked IPs implicitly deny all other IPs.
- C
Create two network policies: one with the corporate range and one with the VPN range, then assign both policies to the same user so Snowflake evaluates them together.
- D
Create a network policy with ALLOWED_IP_LIST = ('203.0.113.45','198.51.100.0/24') because a specific IP entry overrides the broader subnet restriction.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a single network policy that includes the approved corporate and VPN CIDR ranges in ALLOWED_IP_LIST and the malicious address in BLOCKED_IP_LIST. In Snowflake, network policies are used to control inbound access based on client IP address. A key behavior is that BLOCKED_IP_LIST takes precedence over ALLOWED_IP_LIST when an IP matches both conditions. This makes it possible to block a specific address inside an allowed subnet. For the SnowPro Core exam, candidates should also know that network policies can be assigned at the account level or user level, and that user-level policies can be used for more specific control. This aligns with Snowflake documentation and common security best practices for implementing least-privilege network access.
- A. Correct.
Correct. Snowflake network policies support both an allowed list and a blocked list. When the same IP appears to match both, the blocked list takes precedence. This lets the administrator allow the corporate and VPN CIDR ranges while explicitly denying the malicious IP address within an otherwise allowed subnet. The policy can then be applied at the account level or user level as appropriate.
- B. Incorrect.
Incorrect. A policy with only BLOCKED_IP_LIST denies only the listed IPs and permits connections from other IPs unless restricted elsewhere. It does not create an implicit allowlist model for only approved ranges. This is a common misunderstanding between deny lists and allow lists.
- C. Incorrect.
Incorrect. Snowflake does not combine multiple network policies for a single user or account in the way this option suggests. A user or account can have a network policy assigned, but you cannot stack multiple policies and expect Snowflake to merge their rules for evaluation.
- D. Incorrect.
Incorrect. This option reverses the intended logic and would not allow the full corporate subnet. Also, putting 203.0.113.45 in the allowed list would explicitly permit that IP rather than block it. In Snowflake, blocked entries override allowed entries, not the other way around.