ADA-C01 Question 104
Single answerEstablish network rulesA Snowflake administrator must restrict a new external access integration so that Python UDFs can call only two approved HTTPS endpoints: api.vendor-a.com and api.vendor-b.com. The security team also wants the configuration to be maintainable if additional approved hosts are added later. Which approach should the administrator take?
- A
Create a network rule with MODE = EGRESS, TYPE = HOST_PORT, and VALUE_LIST containing api.vendor-a.com and api.vendor-b.com, then reference that network rule in the external access integration.
- B
Create a network rule with MODE = INGRESS, TYPE = IPV4, and VALUE_LIST containing the public IP addresses for api.vendor-a.com and api.vendor-b.com, then reference that rule in the external access integration.
- C
Create a network policy that allows outbound connections only to api.vendor-a.com and api.vendor-b.com, then attach that policy to the external access integration.
- D
Create two secrets for the vendor endpoints and attach the secrets to the external access integration; Snowflake will infer the allowed destinations from the secret definitions.
Show answer and explanation
Correct answer: A
Explanation
To allow Snowflake code such as Python UDFs or stored procedures to access external network locations, administrators create an external access integration and associate it with one or more network rules that define permitted destinations. For hostname-based HTTPS targets, the appropriate rule uses TYPE = HOST_PORT and, for outbound access, MODE = EGRESS. This is more maintainable than pinning IP addresses because SaaS provider IPs can change. Network policies are a separate feature used to restrict client access to Snowflake, not outbound external calls from handlers. Secrets complement external access integrations by providing authentication material, but they do not replace destination controls. This aligns with Snowflake guidance for external network access and network rule usage.
- A. Correct.
Correct. External access integrations use network rules to define allowed outbound destinations. For this use case, the rule should be created for outbound traffic with MODE = EGRESS and should identify hostnames and optional ports using TYPE = HOST_PORT. Including both approved hosts in VALUE_LIST makes the configuration easy to extend later by altering the network rule rather than redesigning the integration.
- B. Incorrect.
Incorrect. MODE = INGRESS is used for inbound client connectivity controls, not outbound destinations for external network access from UDFs or procedures. TYPE = IPV4 is also the wrong abstraction for this requirement because the scenario is about approved HTTPS endpoints by host, and external services may change IPs over time.
- C. Incorrect.
Incorrect. Network policies control how users and clients connect to Snowflake accounts, including allowed and blocked client IPs, but they do not govern outbound calls made through external access integrations. This is a common confusion because both features involve network restrictions, but they apply in different directions and contexts.
- D. Incorrect.
Incorrect. Secrets are used to store credentials or tokens that handlers can use when authenticating to external services. They do not define or infer the destination allowlist. The approved destinations must still be explicitly controlled through network rules referenced by the external access integration.