COF-C03 Question 148
Single answerMulti-Factor Authentication (MFA)A Snowflake account administrator is reviewing interactive access to a production account. The security team wants to reduce the risk of credential theft for Snowflake web UI users, but they do not want to disrupt service accounts and automated jobs that connect programmatically. Which action best meets this requirement?
- A
Require users who sign in with username and password to enroll in and use Snowflake MFA for interactive login, while keeping key pair, OAuth, and other non-interactive service connections unchanged
- B
Enable MFA for the entire account so that every connection method, including key pair authentication and automated JDBC jobs, must provide a second factor
- C
Replace all Snowflake passwords with RSA key pairs so that human users can sign in to Snowsight without any additional authentication steps
- D
Disable password-based authentication for all users and require every user and service account to authenticate through the same browser-based MFA flow
Show answer and explanation
Correct answer: A
Explanation
The best answer is to require MFA for interactive users who authenticate with username and password, while leaving non-interactive service connections on suitable programmatic authentication methods such as key pair authentication or OAuth. In Snowflake, MFA is primarily intended to protect human interactive access and is not a blanket control for every connection type. This is a common real-world design decision: apply stronger authentication where users are most exposed to phishing and password theft, while avoiding unnecessary changes to automation. Snowflake documentation and security best practices distinguish between interactive authentication for users and programmatic authentication for service accounts, making option 1 the most accurate and practical choice.
- A. Correct.
Correct. Snowflake MFA is designed to strengthen interactive authentication for users who log in with username/password, such as through Snowsight or other interactive flows. This approach targets the primary credential-theft risk without unnecessarily affecting non-interactive service accounts that commonly use other authentication methods such as key pair authentication or OAuth. It aligns with the requirement to protect human access while avoiding disruption to automated workloads.
- B. Incorrect.
Incorrect. This reflects a common misconception that Snowflake MFA applies uniformly to every authentication method. In practice, MFA is intended for interactive user authentication and is not something automated jobs using methods like key pair authentication can generally satisfy in the same way. Forcing all connection types through MFA would not be a practical or accurate implementation approach for service accounts.
- C. Incorrect.
Incorrect. Key pair authentication is commonly used for programmatic access, but it is not a replacement for secure interactive user authentication in Snowsight. Human users typically need interactive sign-in methods, and moving everyone to key pairs would not address the need for stronger login protection for browser-based users. It also creates operational overhead and does not reflect Snowflake MFA best practices for human access.
- D. Incorrect.
Incorrect. While reducing password usage can be a valid security strategy in some environments, this option does not match the stated requirement. It would disrupt service accounts and automated jobs by forcing them into a browser-based interactive flow that they are not designed to use. The goal is to secure interactive users with MFA while preserving automation.