COF-C03 Question 146
Single answerAuthenticationA company uses Snowflake for analytics and wants to strengthen user authentication. Employees should sign in with their corporate identity provider so passwords are managed centrally, while a small group of external consultants should continue using Snowflake-managed usernames and passwords. The security team also requires MFA for the consultants without changing the employee sign-in experience. Which authentication approach best meets these requirements?
- A
Configure federated authentication with the corporate SSO provider for employees, and require Snowflake MFA for the consultant accounts that use Snowflake-native authentication.
- B
Configure key pair authentication for all human users so employees and consultants can sign in without passwords and without MFA.
- C
Configure OAuth for employee interactive logins and disable Snowflake-native users so all authentication is handled outside Snowflake.
- D
Configure programmatic access tokens for consultants and require employees to use username and password directly in Snowflake.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a hybrid authentication model: federated authentication for employees and Snowflake-native authentication for external consultants. In Snowflake, workforce SSO is typically implemented through federated authentication with a SAML 2.0 identity provider, allowing centralized identity lifecycle management and password policies outside Snowflake. For users who are not part of the enterprise IdP, Snowflake-native accounts remain appropriate, and MFA can be enforced for those accounts. This is aligned with Snowflake authentication best practices, which distinguish between interactive user authentication methods such as SSO and Snowflake MFA, and non-interactive methods such as key pair authentication for service accounts or automated tools. Candidates should recognize that key pair authentication and OAuth are often confused with user sign-in methods, but they do not best satisfy this mixed workforce-plus-external-user scenario.
- A. Correct.
Correct. Snowflake supports federated authentication using SAML 2.0-compliant identity providers for workforce SSO, which allows employee passwords and authentication policies to be managed centrally by the corporate IdP. Snowflake also supports Snowflake-native users authenticated with usernames and passwords, and MFA can be required for those users. This mixed model is common in practice when internal employees use SSO while external users who are not in the corporate directory use Snowflake-managed accounts.
- B. Incorrect.
Incorrect. Key pair authentication is intended primarily for programmatic access, such as service users connecting with SnowSQL, drivers, or connectors. It is not the best fit for broad interactive human user sign-in requirements, and it does not replace the need for an MFA strategy for human users. Using key pairs for all employees and consultants would not meet the stated requirement for corporate SSO.
- C. Incorrect.
Incorrect. OAuth can be used for authorization scenarios and certain client integrations, but it is not the standard approach for workforce interactive SSO into Snowflake compared with federated authentication via a SAML 2.0 identity provider. In addition, disabling Snowflake-native users would prevent the consultants from continuing to use Snowflake-managed credentials as required.
- D. Incorrect.
Incorrect. Programmatic access tokens are not the appropriate solution for consultant interactive user authentication. This option also reverses the requirement by making employees use direct Snowflake passwords instead of corporate SSO. It fails both the centralized password management goal for employees and the consultant MFA requirement.