ADA-C01 Question 101
Single answer1.6 Set up and manage network and private connectivity.A company uses Snowflake Business Critical Edition on AWS and must ensure that data engineers connect to Snowflake only through private network paths from their VPC. Security policy prohibits any access from the public internet, even if source IPs are allowlisted. The team also wants to continue using Snowsight and JDBC/ODBC drivers with minimal application changes. Which action should the Snowflake administrator take to meet these requirements?
- A
Create a network policy that allows only the corporate NAT gateway public IP addresses and attach it at the account level.
- B
Configure AWS PrivateLink for Snowflake, use the private connectivity URL for users and applications, and optionally enforce access with a network rule or network policy that restricts connectivity to the private endpoint path.
- C
Enable Tri-Secret Secure so that all traffic between the VPC and Snowflake is forced over a private channel instead of the public internet.
- D
Deploy a customer-managed VPN tunnel to Snowflake and update JDBC/ODBC clients to connect through the VPN endpoint.
- E
Use an internal stage with server-side encryption so that all access to Snowflake services remains on the AWS backbone and bypasses public endpoints.
Show answer and explanation
Correct answer: B
Explanation
The key requirement is to eliminate public internet access to Snowflake while preserving usability for browser-based and driver-based clients. In Snowflake, this is achieved through private connectivity rather than through IP allowlisting alone. For AWS-hosted Snowflake accounts, the supported approach is AWS PrivateLink. Private connectivity provides private endpoints and private URLs so traffic stays on private network paths within the cloud provider environment. Network policies and network rules are complementary controls: they can restrict who may connect and from where, but they do not themselves convert public connectivity into private connectivity. Security-focused features such as Tri-Secret Secure address encryption and key management, not routing. Best practice is to set up the cloud-provider private endpoint, configure the required DNS/private URL resolution, validate client access through the private endpoint, and then use Snowflake network controls to restrict or deny undesired public access paths. This aligns with Snowflake documentation for private connectivity and network policies.
- A. Incorrect.
Incorrect. An account-level network policy that allowlists the company's public NAT IP addresses can restrict who connects, but the traffic still uses Snowflake public endpoints over the internet. The scenario explicitly requires private network paths only and disallows public internet access even when IPs are allowlisted. This is a common misconception: network policies control allowed source locations, not whether connectivity is public or private.
- B. Correct.
Correct. On AWS, Snowflake private connectivity is implemented with AWS PrivateLink for eligible editions such as Business Critical. PrivateLink allows clients in the customer's VPC to reach Snowflake through private endpoints rather than public internet routes. Using the private connectivity URL supports common tools such as Snowsight and JDBC/ODBC with limited client-side change, typically just endpoint configuration and DNS setup. Administrators can further tighten access using Snowflake network controls so users connect only through approved private paths.
- C. Incorrect.
Incorrect. Tri-Secret Secure is related to key management and encryption control, not network routing. It does not change how clients reach Snowflake endpoints and does not provide private network connectivity. Someone might choose this option because it sounds security-related, but it addresses encryption governance rather than access path isolation.
- D. Incorrect.
Incorrect. Snowflake does not require or support a customer-managed site-to-site VPN as the standard mechanism for private service connectivity in this scenario. On AWS, the supported private connectivity pattern is AWS PrivateLink. This distractor targets the common assumption that all private access requirements are solved with VPNs.
- E. Incorrect.
Incorrect. Internal stages and encryption settings affect data storage and file staging behavior, not how users and applications establish sessions to Snowflake services. Snowflake account access still depends on the configured service endpoints. This option confuses storage security features with network connectivity controls.