ADA-C01 Question 105
Single answerConfigure and manage network rulesA Snowflake administrator needs to restrict outbound connectivity from a Python UDF used by the finance team. The UDF must call only two approved external HTTPS endpoints: api.vendor-a.com on port 443 and files.vendor-b.com on port 443. The security team also wants the configuration to be reusable by multiple external access integrations and easy to maintain if the allowed hosts change later. Which approach should the administrator take?
- A
Create a network rule with MODE = EGRESS, TYPE = HOST_PORT, and VALUE_LIST containing api.vendor-a.com:443 and files.vendor-b.com:443, then reference that network rule in an external access integration.
- B
Create a network policy that allows api.vendor-a.com and files.vendor-b.com, and attach the policy to the finance users who run the Python UDF.
- C
Create a network rule with MODE = INGRESS, TYPE = IPV4, and the public IP addresses of both vendors, then attach the rule directly to the Python UDF.
- D
Create a storage integration for the two vendor endpoints and grant the Python UDF usage on the integration.
Show answer and explanation
Correct answer: A
Explanation
The correct solution is to define the approved destinations in a network rule designed for outbound access and then use that rule in an external access integration. In Snowflake, network rules are reusable schema-level objects that can define allowed destinations or sources depending on their mode and type. For external network access from handler code such as Python UDFs and stored procedures, administrators configure an external access integration and reference one or more network rules with MODE = EGRESS. When the requirement is to allow specific DNS hostnames and ports, TYPE = HOST_PORT is the appropriate choice. This approach aligns with Snowflake best practices: least privilege, centralized administration, and reusable configuration. By contrast, network policies govern inbound client connections to Snowflake and do not control outbound calls from code executed inside Snowflake. Storage integrations also do not apply because they are intended for cloud storage access, not general HTTPS API connectivity.
- A. Correct.
Correct. For outbound access from UDFs or procedures, Snowflake uses external access integrations, which reference network rules that define the allowed destinations. To allow specific hostnames and ports, the network rule should use MODE = EGRESS and TYPE = HOST_PORT. This is also the most maintainable design because the network rule can be reused by multiple external access integrations and updated centrally if approved destinations change.
- B. Incorrect.
Incorrect. Network policies control client connectivity into Snowflake accounts, users, or security integrations based on IP rules; they do not govern outbound connections made by handler code in UDFs or stored procedures. A common misconception is to treat network policies and network rules as interchangeable, but they serve different purposes.
- C. Incorrect.
Incorrect. MODE = INGRESS and TYPE = IPV4 are used for controlling inbound network access scenarios, not outbound external access from Python UDFs. In addition, external access integrations reference network rules; you do not attach a network rule directly to a UDF. Another issue is that vendor public IPs may change, making hostname-based rules more maintainable when supported by the use case.
- D. Incorrect.
Incorrect. Storage integrations are used to authorize access to cloud storage services such as S3, Azure Blob Storage, or Google Cloud Storage for Snowflake features like stages. They are not used to permit arbitrary outbound HTTPS calls from UDFs or procedures to external APIs.