ADA-C01 Question 103
Single answerEstablish network rulesA Snowflake administrator needs to restrict outbound access for external network calls made by a Python UDF that integrates with an internal REST API. The security team requires that only the API host api.corp.example.com over HTTPS be allowed, and that the configuration be reusable by future external access integrations. Which action should the administrator take to meet this requirement?
- A
Create a NETWORK RULE in EGRESS mode with TYPE = HOST_PORT that allows api.corp.example.com on port 443, and reference that rule in an EXTERNAL ACCESS INTEGRATION.
- B
Create a NETWORK POLICY that allows api.corp.example.com, then attach it to the user who owns the Python UDF.
- C
Create a NETWORK RULE in INGRESS mode with TYPE = IPV4 that includes the IP address of api.corp.example.com, and assign it directly to the Python UDF.
- D
Create a SECRET that stores the API endpoint and port, then reference the secret from the UDF without creating any network rule.
Show answer and explanation
Correct answer: A
Explanation
To restrict outbound connectivity for Snowflake handler code such as Python UDFs, administrators should use external network access. The standard pattern is: create a NETWORK RULE describing the allowed destination, create an EXTERNAL ACCESS INTEGRATION that references that rule (and any required secrets), and then reference the integration from the UDF or procedure. Because the requirement is to allow only one hostname over HTTPS, an egress rule with TYPE = HOST_PORT is the best fit. NETWORK POLICY is a separate feature for controlling inbound client connections to Snowflake, not outbound calls from Snowflake runtime environments. This aligns with Snowflake best practices of least privilege and reusable integration-based configuration.
- A. Correct.
Correct. For outbound connectivity from Snowflake handlers such as Python UDFs or stored procedures, Snowflake uses external network access with EXTERNAL ACCESS INTEGRATION objects. Those integrations can reference NETWORK RULE objects that define the allowed destinations. To permit HTTPS access to a specific host, the appropriate rule is an egress network rule using TYPE = HOST_PORT and the destination host/port combination, such as api.corp.example.com:443.
- B. Incorrect.
Incorrect. NETWORK POLICY controls client access to Snowflake, such as which IP addresses users can connect from. It does not govern outbound connections made from UDFs, procedures, or other external network access features. This is a common confusion because both features relate to network restrictions, but they apply in different directions and contexts.
- C. Incorrect.
Incorrect. INGRESS mode is not the right choice for outbound calls from Snowflake code to an external service. In addition, assigning a network rule directly to a Python UDF is not how Snowflake enables external access. The rule must be associated through an EXTERNAL ACCESS INTEGRATION. Using TYPE = IPV4 could also make management harder when the requirement is specifically to allow a hostname over HTTPS.
- D. Incorrect.
Incorrect. A SECRET can store credentials or other sensitive values used by the handler, but it does not authorize network destinations. Even if the endpoint information is stored in a secret, Snowflake still requires an EXTERNAL ACCESS INTEGRATION and an appropriate NETWORK RULE to allow outbound communication.