SnowflakeProfessional levelADA-C01Page 2 of 6

ADA-C01 exam dumps: questions 101 to 200 of 565

Page 2 of the free ADA-C01 question bank for the SnowPro® Advanced: Administrator exam. Questions 101 to 200 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated April 2026

Start timed practice exam Questions 101 to 200

Free ADA-C01 practice questions

Questions 101 to 105 of 565

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

ADA-C01 Question 101

Single answer1.6 Set up and manage network and private connectivity.

A company uses Snowflake Business Critical Edition on AWS and must ensure that data engineers connect to Snowflake only through private network paths from their VPC. Security policy prohibits any access from the public internet, even if source IPs are allowlisted. The team also wants to continue using Snowsight and JDBC/ODBC drivers with minimal application changes. Which action should the Snowflake administrator take to meet these requirements?

A
Create a network policy that allows only the corporate NAT gateway public IP addresses and attach it at the account level.
B
Configure AWS PrivateLink for Snowflake, use the private connectivity URL for users and applications, and optionally enforce access with a network rule or network policy that restricts connectivity to the private endpoint path.
C
Enable Tri-Secret Secure so that all traffic between the VPC and Snowflake is forced over a private channel instead of the public internet.
D
Deploy a customer-managed VPN tunnel to Snowflake and update JDBC/ODBC clients to connect through the VPN endpoint.
E
Use an internal stage with server-side encryption so that all access to Snowflake services remains on the AWS backbone and bypasses public endpoints.

Show answer and explanation

Correct answer: B

Explanation

The key requirement is to eliminate public internet access to Snowflake while preserving usability for browser-based and driver-based clients. In Snowflake, this is achieved through private connectivity rather than through IP allowlisting alone. For AWS-hosted Snowflake accounts, the supported approach is AWS PrivateLink. Private connectivity provides private endpoints and private URLs so traffic stays on private network paths within the cloud provider environment. Network policies and network rules are complementary controls: they can restrict who may connect and from where, but they do not themselves convert public connectivity into private connectivity. Security-focused features such as Tri-Secret Secure address encryption and key management, not routing. Best practice is to set up the cloud-provider private endpoint, configure the required DNS/private URL resolution, validate client access through the private endpoint, and then use Snowflake network controls to restrict or deny undesired public access paths. This aligns with Snowflake documentation for private connectivity and network policies.

A. Incorrect.
Incorrect. An account-level network policy that allowlists the company's public NAT IP addresses can restrict who connects, but the traffic still uses Snowflake public endpoints over the internet. The scenario explicitly requires private network paths only and disallows public internet access even when IPs are allowlisted. This is a common misconception: network policies control allowed source locations, not whether connectivity is public or private.
B. Correct.
Correct. On AWS, Snowflake private connectivity is implemented with AWS PrivateLink for eligible editions such as Business Critical. PrivateLink allows clients in the customer's VPC to reach Snowflake through private endpoints rather than public internet routes. Using the private connectivity URL supports common tools such as Snowsight and JDBC/ODBC with limited client-side change, typically just endpoint configuration and DNS setup. Administrators can further tighten access using Snowflake network controls so users connect only through approved private paths.
C. Incorrect.
Incorrect. Tri-Secret Secure is related to key management and encryption control, not network routing. It does not change how clients reach Snowflake endpoints and does not provide private network connectivity. Someone might choose this option because it sounds security-related, but it addresses encryption governance rather than access path isolation.
D. Incorrect.
Incorrect. Snowflake does not require or support a customer-managed site-to-site VPN as the standard mechanism for private service connectivity in this scenario. On AWS, the supported private connectivity pattern is AWS PrivateLink. This distractor targets the common assumption that all private access requirements are solved with VPNs.
E. Incorrect.
Incorrect. Internal stages and encryption settings affect data storage and file staging behavior, not how users and applications establish sessions to Snowflake services. Snowflake account access still depends on the configured service endpoints. This option confuses storage security features with network connectivity controls.

ADA-C01 Question 102

Single answer1.6 Set up and manage network and private connectivity.

A financial services company has a Snowflake account on AWS that must be accessed only from resources inside its AWS VPCs. The security team does not want traffic to traverse the public internet, and they also want to prevent users from connecting from home networks even if they have valid Snowflake credentials. The company has already provisioned AWS PrivateLink endpoints for Snowflake in the VPCs used by its analytics applications. Which additional configuration should the Snowflake administrator implement to best meet these requirements?

A
Create a network policy that allows only the organization’s public NAT gateway IP addresses, and rely on PrivateLink for private routing when available.
B
Create a network rule containing the AWS VPCE IDs for the approved PrivateLink endpoints, then create a network policy that allows only those VPCE IDs and assign it to the account or relevant users.
C
Enable Tri-Secret Secure so that only traffic from approved private endpoints can authenticate to Snowflake.
D
Configure client redirect so users are automatically routed to the nearest Snowflake endpoint, which avoids public internet exposure.

Show answer and explanation

Correct answer: B

Explanation

To satisfy both requirements in the scenario, the administrator must combine private connectivity with access control that explicitly permits only approved private endpoints. On AWS, Snowflake private connectivity is implemented with AWS PrivateLink. However, provisioning PrivateLink alone does not automatically prevent users from connecting over Snowflake’s public endpoint if that endpoint remains reachable and credentials are valid. To enforce the intended restriction, Snowflake administrators should use network rules and network policies that allow only the designated private endpoint identifiers (for AWS, VPCE IDs). This approach is more precise than IP-based allowlisting because it validates the approved private connectivity path itself rather than just the apparent source IP. This aligns with Snowflake best practices for network access management and private connectivity, where network policies are used to restrict client connections and can be configured to work with private connectivity identifiers.

A. Incorrect.
This is not the best solution for the stated requirement. Allowlisting public NAT gateway IP addresses can restrict access by source IP, but it does not enforce that clients use AWS PrivateLink. Traffic could still originate from those public IPs and connect over Snowflake’s public endpoint. The scenario specifically requires access only from resources inside approved VPCs and no public internet path. A common misconception is that IP allowlisting alone guarantees private connectivity; it does not.
B. Correct.
This is correct. For AWS PrivateLink-based restrictions, Snowflake supports network rules and network policies that can evaluate private connectivity identifiers such as AWS VPCE IDs. By defining a network rule with the approved VPC endpoint IDs and then using a network policy to allow only those private endpoints, the administrator can ensure that connections are accepted only when they come through the company’s authorized PrivateLink endpoints. Assigning the policy at the account level or to specific users further enforces that users cannot connect from home networks or other non-approved paths, even with valid credentials.
C. Incorrect.
This is incorrect. Tri-Secret Secure is a key management and encryption feature involving customer-managed keys in addition to Snowflake-managed protections. It does not control network path selection, PrivateLink enforcement, or client source restrictions. Someone might choose this option because it sounds security-related, but it addresses encryption governance rather than network connectivity controls.
D. Incorrect.
This is incorrect. Client redirect helps reroute clients during failover or business continuity scenarios and can abstract connection endpoints for applications, but it does not force use of private connectivity or block public internet access. It is not a network access control mechanism. This distractor targets the misconception that endpoint-routing features also enforce network isolation.

ADA-C01 Question 103

Single answerEstablish network rules

A Snowflake administrator needs to restrict outbound access for external network calls made by a Python UDF that integrates with an internal REST API. The security team requires that only the API host api.corp.example.com over HTTPS be allowed, and that the configuration be reusable by future external access integrations. Which action should the administrator take to meet this requirement?

A
Create a NETWORK RULE in EGRESS mode with TYPE = HOST_PORT that allows api.corp.example.com on port 443, and reference that rule in an EXTERNAL ACCESS INTEGRATION.
B
Create a NETWORK POLICY that allows api.corp.example.com, then attach it to the user who owns the Python UDF.
C
Create a NETWORK RULE in INGRESS mode with TYPE = IPV4 that includes the IP address of api.corp.example.com, and assign it directly to the Python UDF.
D
Create a SECRET that stores the API endpoint and port, then reference the secret from the UDF without creating any network rule.

Show answer and explanation

Correct answer: A

Explanation

To restrict outbound connectivity for Snowflake handler code such as Python UDFs, administrators should use external network access. The standard pattern is: create a NETWORK RULE describing the allowed destination, create an EXTERNAL ACCESS INTEGRATION that references that rule (and any required secrets), and then reference the integration from the UDF or procedure. Because the requirement is to allow only one hostname over HTTPS, an egress rule with TYPE = HOST_PORT is the best fit. NETWORK POLICY is a separate feature for controlling inbound client connections to Snowflake, not outbound calls from Snowflake runtime environments. This aligns with Snowflake best practices of least privilege and reusable integration-based configuration.

A. Correct.
Correct. For outbound connectivity from Snowflake handlers such as Python UDFs or stored procedures, Snowflake uses external network access with EXTERNAL ACCESS INTEGRATION objects. Those integrations can reference NETWORK RULE objects that define the allowed destinations. To permit HTTPS access to a specific host, the appropriate rule is an egress network rule using TYPE = HOST_PORT and the destination host/port combination, such as api.corp.example.com:443.
B. Incorrect.
Incorrect. NETWORK POLICY controls client access to Snowflake, such as which IP addresses users can connect from. It does not govern outbound connections made from UDFs, procedures, or other external network access features. This is a common confusion because both features relate to network restrictions, but they apply in different directions and contexts.
C. Incorrect.
Incorrect. INGRESS mode is not the right choice for outbound calls from Snowflake code to an external service. In addition, assigning a network rule directly to a Python UDF is not how Snowflake enables external access. The rule must be associated through an EXTERNAL ACCESS INTEGRATION. Using TYPE = IPV4 could also make management harder when the requirement is specifically to allow a hostname over HTTPS.
D. Incorrect.
Incorrect. A SECRET can store credentials or other sensitive values used by the handler, but it does not authorize network destinations. Even if the endpoint information is stored in a secret, Snowflake still requires an EXTERNAL ACCESS INTEGRATION and an appropriate NETWORK RULE to allow outbound communication.

ADA-C01 Question 104

Single answerEstablish network rules

A Snowflake administrator must restrict a new external access integration so that Python UDFs can call only two approved HTTPS endpoints: api.vendor-a.com and api.vendor-b.com. The security team also wants the configuration to be maintainable if additional approved hosts are added later. Which approach should the administrator take?

A
Create a network rule with MODE = EGRESS, TYPE = HOST_PORT, and VALUE_LIST containing api.vendor-a.com and api.vendor-b.com, then reference that network rule in the external access integration.
B
Create a network rule with MODE = INGRESS, TYPE = IPV4, and VALUE_LIST containing the public IP addresses for api.vendor-a.com and api.vendor-b.com, then reference that rule in the external access integration.
C
Create a network policy that allows outbound connections only to api.vendor-a.com and api.vendor-b.com, then attach that policy to the external access integration.
D
Create two secrets for the vendor endpoints and attach the secrets to the external access integration; Snowflake will infer the allowed destinations from the secret definitions.

Show answer and explanation

Correct answer: A

Explanation

To allow Snowflake code such as Python UDFs or stored procedures to access external network locations, administrators create an external access integration and associate it with one or more network rules that define permitted destinations. For hostname-based HTTPS targets, the appropriate rule uses TYPE = HOST_PORT and, for outbound access, MODE = EGRESS. This is more maintainable than pinning IP addresses because SaaS provider IPs can change. Network policies are a separate feature used to restrict client access to Snowflake, not outbound external calls from handlers. Secrets complement external access integrations by providing authentication material, but they do not replace destination controls. This aligns with Snowflake guidance for external network access and network rule usage.

A. Correct.
Correct. External access integrations use network rules to define allowed outbound destinations. For this use case, the rule should be created for outbound traffic with MODE = EGRESS and should identify hostnames and optional ports using TYPE = HOST_PORT. Including both approved hosts in VALUE_LIST makes the configuration easy to extend later by altering the network rule rather than redesigning the integration.
B. Incorrect.
Incorrect. MODE = INGRESS is used for inbound client connectivity controls, not outbound destinations for external network access from UDFs or procedures. TYPE = IPV4 is also the wrong abstraction for this requirement because the scenario is about approved HTTPS endpoints by host, and external services may change IPs over time.
C. Incorrect.
Incorrect. Network policies control how users and clients connect to Snowflake accounts, including allowed and blocked client IPs, but they do not govern outbound calls made through external access integrations. This is a common confusion because both features involve network restrictions, but they apply in different directions and contexts.
D. Incorrect.
Incorrect. Secrets are used to store credentials or tokens that handlers can use when authenticating to external services. They do not define or infer the destination allowlist. The approved destinations must still be explicitly controlled through network rules referenced by the external access integration.

ADA-C01 Question 105

Single answerConfigure and manage network rules

A Snowflake administrator needs to restrict outbound connectivity from a Python UDF used by the finance team. The UDF must call only two approved external HTTPS endpoints: api.vendor-a.com on port 443 and files.vendor-b.com on port 443. The security team also wants the configuration to be reusable by multiple external access integrations and easy to maintain if the allowed hosts change later. Which approach should the administrator take?

A
Create a network rule with MODE = EGRESS, TYPE = HOST_PORT, and VALUE_LIST containing api.vendor-a.com:443 and files.vendor-b.com:443, then reference that network rule in an external access integration.
B
Create a network policy that allows api.vendor-a.com and files.vendor-b.com, and attach the policy to the finance users who run the Python UDF.
C
Create a network rule with MODE = INGRESS, TYPE = IPV4, and the public IP addresses of both vendors, then attach the rule directly to the Python UDF.
D
Create a storage integration for the two vendor endpoints and grant the Python UDF usage on the integration.

Show answer and explanation

Correct answer: A

Explanation

The correct solution is to define the approved destinations in a network rule designed for outbound access and then use that rule in an external access integration. In Snowflake, network rules are reusable schema-level objects that can define allowed destinations or sources depending on their mode and type. For external network access from handler code such as Python UDFs and stored procedures, administrators configure an external access integration and reference one or more network rules with MODE = EGRESS. When the requirement is to allow specific DNS hostnames and ports, TYPE = HOST_PORT is the appropriate choice. This approach aligns with Snowflake best practices: least privilege, centralized administration, and reusable configuration. By contrast, network policies govern inbound client connections to Snowflake and do not control outbound calls from code executed inside Snowflake. Storage integrations also do not apply because they are intended for cloud storage access, not general HTTPS API connectivity.

A. Correct.
Correct. For outbound access from UDFs or procedures, Snowflake uses external access integrations, which reference network rules that define the allowed destinations. To allow specific hostnames and ports, the network rule should use MODE = EGRESS and TYPE = HOST_PORT. This is also the most maintainable design because the network rule can be reused by multiple external access integrations and updated centrally if approved destinations change.
B. Incorrect.
Incorrect. Network policies control client connectivity into Snowflake accounts, users, or security integrations based on IP rules; they do not govern outbound connections made by handler code in UDFs or stored procedures. A common misconception is to treat network policies and network rules as interchangeable, but they serve different purposes.
C. Incorrect.
Incorrect. MODE = INGRESS and TYPE = IPV4 are used for controlling inbound network access scenarios, not outbound external access from Python UDFs. In addition, external access integrations reference network rules; you do not attach a network rule directly to a UDF. Another issue is that vendor public IPs may change, making hostname-based rules more maintainable when supported by the use case.
D. Incorrect.
Incorrect. Storage integrations are used to authorize access to cloud storage services such as S3, Azure Blob Storage, or Google Cloud Storage for Snowflake features like stages. They are not used to permit arbitrary outbound HTTPS calls from UDFs or procedures to external APIs.

Timed practice exam

Take a ADA-C01 practice test under exam conditions

65 questions in 115 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

ADA-C01 practice questions 101 to 200 of 565

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 6 pages of up to 100 questions.