COF-C03 Question 17
Single answerIDE integrations (e.g., Visual Studio Code)A data engineer uses Visual Studio Code with the Snowflake extension to develop and test SQL objects in a development account. The engineer wants to run ad hoc queries from the IDE, browse database objects, and avoid storing a username and password in the editor configuration. Which authentication approach best meets these requirements using supported Snowflake client connectivity patterns?
- A
Configure the VS Code Snowflake connection to use external browser authentication so the engineer signs in through the browser instead of saving a password locally
- B
Use a warehouse access token generated by SQL and paste it into the VS Code connection settings as a long-term credential
- C
Enable anonymous access in the Snowflake extension so the engineer can browse metadata without authenticating, then authenticate only when running queries
- D
Store the account administrator password in a shared VS Code workspace setting so all developers can reuse the same connection profile
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use external browser authentication. Snowflake supports multiple client authentication methods, and external browser authentication is commonly used with desktop tools and IDE integrations when organizations want to avoid saving passwords directly in local client configurations. This aligns with secure access practices and still enables developers to run SQL and inspect objects from tools such as Visual Studio Code. The other options are incorrect because Snowflake does not support anonymous IDE access, and using shared administrator credentials violates basic security and role-based access control practices. Candidates should recognize that Snowflake IDE integrations rely on standard authenticated client connectivity and that secure authentication choices, especially SSO-style flows such as external browser authentication, are preferred in real-world development workflows.
- A. Correct.
Correct. Snowflake clients support external browser authentication, which allows users to authenticate through a web browser instead of embedding a password in the client configuration. For IDE-based work such as running queries and browsing objects, this is a practical and supported approach that reduces the need to store credentials directly in VS Code.
- B. Incorrect.
Incorrect. This describes a capability that is not the standard supported method for authenticating from the Snowflake VS Code extension for routine IDE access. Warehouses do not provide a general long-term authentication token to be manually pasted into the extension as a replacement for supported authentication methods such as password, SSO/external browser, key-pair, or OAuth where supported.
- C. Incorrect.
Incorrect. Snowflake does not allow anonymous metadata browsing through the VS Code extension. Users must authenticate before accessing Snowflake objects or running queries. This option reflects a misconception based on public catalog-style tools rather than Snowflake client authentication requirements.
- D. Incorrect.
Incorrect. Sharing an account administrator password in workspace settings is a poor security practice and does not follow least-privilege principles. In real environments, developers should use individual identities and appropriate roles. Also, storing highly privileged credentials in shared IDE settings increases security risk.