COF-C03 Question 156
Single answerKey-pair authenticationA security team wants to eliminate password-based authentication for a service account used by an internal ETL application connecting to Snowflake with the Python connector. The team generated an RSA key pair, stored the private key securely on the application server, and now needs to configure Snowflake so the application can authenticate successfully using the public key. Which action should the Snowflake administrator take?
- A
Set the service user's RSA_PUBLIC_KEY property to the generated public key value.
- B
Upload the private key to a named internal stage and grant the service user access to that stage.
- C
Create a network policy that contains the public key so Snowflake can validate the client's signature during login.
- D
Store the public key in a Snowflake secret object and assign the secret to the service user.
Show answer and explanation
Correct answer: A
Explanation
In Snowflake key-pair authentication, the client keeps the private key and proves possession of it during login, while Snowflake stores the corresponding public key on the user object. Administrators configure this using ALTER USER ... SET RSA_PUBLIC_KEY = '<public_key>' (and optionally RSA_PUBLIC_KEY_2 for key rotation). This is a common setup for service accounts used by automation tools, connectors, and drivers when organizations want to avoid password-based authentication. Best practice is to protect the private key in secure client-side storage and rotate keys using the secondary public key field to minimize downtime. Snowflake documentation for key-pair authentication and ALTER USER covers this configuration pattern.
- A. Correct.
Correct. For Snowflake key-pair authentication, the administrator associates the user's public key with the Snowflake user object by setting the RSA_PUBLIC_KEY property (or RSA_PUBLIC_KEY_2 for rotation scenarios). During authentication, Snowflake uses the stored public key to verify that the client possesses the matching private key. This is the required Snowflake-side configuration for enabling key-pair authentication for a user.
- B. Incorrect.
Incorrect. Snowflake does not require or support uploading a user's private key into an internal stage for key-pair authentication. The private key must remain with the client application and should be protected outside Snowflake. Storing it in a stage would also conflict with the security principle that private keys should never be shared with the server they are authenticating to.
- C. Incorrect.
Incorrect. A network policy controls which IP addresses can connect to Snowflake. It does not store cryptographic key material for user authentication and is unrelated to validating a client's key-pair signature. Someone might choose this option because both network policies and authentication are security controls, but they serve different purposes.
- D. Incorrect.
Incorrect. Secret objects are not how Snowflake user key-pair authentication is configured for client logins. The public key for key-pair authentication must be assigned directly to the user object's RSA_PUBLIC_KEY property. This distractor is plausible because Snowflake has features for managing secrets in some integration scenarios, but that is separate from configuring a Snowflake user for key-pair login.