COF-C03 Question 346
Single answerPrivateA financial services company stores highly sensitive customer data in Snowflake and must ensure that all client connections to Snowflake stay on private network paths rather than traversing the public internet. The security team also wants to restrict access so that only approved private endpoints can connect. Which Snowflake feature should the architect implement to meet these requirements?
- A
Configure Snowflake Private Connectivity and enforce a network policy that allows only the approved private endpoint connections
- B
Enable Tri-Secret Secure and require key rotation so that traffic is forced over private links
- C
Create masking policies on sensitive columns and use secure views to prevent public internet access
- D
Use a reader account and disable public sharing so consumers connect only through private routes
Show answer and explanation
Correct answer: A
Explanation
The correct solution is Snowflake Private Connectivity, which is the Snowflake capability for keeping traffic between customer environments and Snowflake on private cloud network paths rather than the public internet. In practice, this is implemented through the cloud provider's private networking service: AWS PrivateLink, Azure Private Link, or Google Cloud Private Service Connect. Because the scenario also requires limiting access to approved private endpoints, the architect should combine private connectivity with Snowflake network access controls, such as network policies and related endpoint restrictions, to ensure only authorized private connections are used. SnowPro Core expects candidates to distinguish between networking controls and other security features. Encryption features like Tri-Secret Secure address key management and data protection at rest, while masking policies and secure views address data exposure, not transport routing. Reference areas in Snowflake documentation include Private Connectivity / PrivateLink, network policies, and Snowflake security best practices for client connectivity.
- A. Correct.
Correct. Snowflake Private Connectivity is designed to provide private network access between customer environments and Snowflake without using the public internet, using cloud-provider private networking services such as AWS PrivateLink, Azure Private Link, or Google Cloud Private Service Connect. To further restrict which private connections are allowed, administrators can use network policies with allowed network rules or approved endpoints, depending on the setup, so only authorized private connectivity paths are permitted.
- B. Incorrect.
Incorrect. Tri-Secret Secure is an encryption and key management capability that adds customer-managed key control in addition to Snowflake-managed encryption. It protects data at rest but does not control whether client traffic uses public or private network paths. A common misconception is that stronger encryption settings also change the network routing model, but they do not.
- C. Incorrect.
Incorrect. Masking policies and secure views protect data access and visibility at the object level, not network transport paths. They are useful for limiting what users can see, but they do not prevent traffic from traversing the public internet. This distractor reflects confusion between data governance controls and network security controls.
- D. Incorrect.
Incorrect. Reader accounts are used to share data with parties that do not have their own Snowflake account. They do not inherently force private network connectivity for all access. Likewise, disabling public sharing does not change how network traffic reaches Snowflake. This option mixes account-sharing concepts with networking requirements.