COF-C03 Question 18
Single answerIDE integrations (e.g., Visual Studio Code)A data engineer uses Visual Studio Code with the Snowflake extension to develop and test SQL scripts against a Snowflake environment. The engineer wants to improve productivity by avoiding repeated credential entry while still using a secure authentication method supported by Snowflake clients. Which approach is the most appropriate?
- A
Configure a named connection in the Snowflake extension and use browser-based SSO (external browser authentication) for sign-in
- B
Store the Snowflake password directly inside each SQL file so the extension can reuse it automatically
- C
Use a warehouse object to manage user authentication centrally for Visual Studio Code sessions
- D
Create a database role that contains the user's password and assign it to the Visual Studio Code connection
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a reusable connection profile in the Visual Studio Code Snowflake extension together with a supported secure authentication method such as external browser authentication. In practice, this lets developers connect efficiently without hardcoding passwords or misusing Snowflake objects. Snowflake distinguishes authentication methods (such as username/password, key-pair, OAuth, or browser-based SSO depending on client support) from authorization constructs like roles. Warehouses are compute resources only. Best practices also discourage storing secrets in code files or source repositories. This aligns with Snowflake client connection guidance and the principle of separating authentication, authorization, and compute configuration.
- A. Correct.
Correct. The Snowflake extension for Visual Studio Code supports creating and reusing connection profiles, and Snowflake clients support secure authentication methods such as browser-based SSO through external browser authentication. This reduces repeated manual credential entry while aligning with secure access practices commonly used in enterprise environments.
- B. Incorrect.
Incorrect. Credentials should not be embedded in SQL files. This is insecure, creates risk of credential leakage through source control, and is not a supported best practice for Snowflake IDE integration. SQL files are for statements and scripts, not secure secret storage.
- C. Incorrect.
Incorrect. A warehouse provides compute resources for executing queries and other workloads. It does not manage authentication or credential reuse for client tools such as Visual Studio Code.
- D. Incorrect.
Incorrect. Database roles are used for granting privileges to database objects. They do not store passwords or serve as an authentication container for IDE connections. Authentication and authorization are separate concepts in Snowflake.