COF-C03 Question 147
Single answerAuthenticationA company uses Snowflake to support internal analytics and wants to strengthen authentication controls. Employees should sign in with their corporate identity provider so password policies are managed centrally, while an external ETL tool must connect programmatically without interactive sign-in. The security team also wants to avoid sharing user passwords with the ETL vendor. Which authentication approach best meets these requirements?
- A
Configure federated authentication with SAML 2.0 for employees, and use key pair authentication for the ETL service user
- B
Configure MFA for all Snowflake users, including the ETL service user, and have the ETL vendor store the MFA recovery codes securely
- C
Use Snowflake username/password authentication for employees, and require the ETL tool to connect through a user authenticated with SSO
- D
Configure OAuth for employees through the corporate identity provider, and require the ETL tool to use the same employee's OAuth refresh token
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SAML 2.0 federated authentication for employees and key pair authentication for the ETL service user. In Snowflake, SSO for workforce users is commonly implemented with SAML 2.0 integration to an external identity provider, which centralizes authentication policy enforcement. For automated clients and service accounts, key pair authentication is a recommended approach because it eliminates the need to store and share passwords. This design separates human and machine authentication patterns appropriately and aligns with Snowflake security best practices. Snowflake documentation on federated authentication and key pair authentication supports these use cases: SAML-based federated authentication for users and key pair authentication for programmatic access.
- A. Correct.
Correct. SAML 2.0 federated authentication is the standard approach for workforce single sign-on to Snowflake, allowing the corporate identity provider to manage employee authentication policies such as password rotation and MFA. For non-interactive programmatic access, key pair authentication is a strong choice because the ETL service user can authenticate using a public/private key pair instead of a stored password. This meets the requirement to avoid sharing user passwords with the vendor and is a common best practice for service accounts and automation.
- B. Incorrect.
Incorrect. MFA is valuable for interactive human access, but it is not an appropriate primary authentication pattern for a non-interactive ETL service account. Requiring the ETL vendor to manage MFA recovery codes is insecure and operationally fragile. Service users should typically use a non-interactive authentication method such as key pair authentication or, in some scenarios, OAuth.
- C. Incorrect.
Incorrect. This does not satisfy the requirement for centralized employee authentication through the corporate identity provider because employees would still use Snowflake-managed usernames and passwords. It also incorrectly assumes an ETL tool can practically operate by using an SSO-authenticated interactive user session, which is not a good fit for unattended programmatic workloads.
- D. Incorrect.
Incorrect. OAuth can be used with Snowflake in supported scenarios, but this option is flawed because it proposes reusing an employee's OAuth refresh token for an ETL tool. That creates security and governance problems, ties automation to an individual user identity, and violates the requirement to avoid sharing user credentials or personal authentication artifacts with the vendor.