ADA-C01 Question 106
Single answerConfigure and manage network rulesA Snowflake administrator needs to restrict outbound connectivity from a Python UDF so it can call only an internal REST service hosted at api.corp.example.com over HTTPS. The security team also requires that the allowed destination be managed centrally and reused by multiple external access integrations. Which approach should the administrator take?
- A
Create a NETWORK RULE with MODE = EGRESS, TYPE = HOST_PORT, and VALUE_LIST containing api.corp.example.com:443, then reference that network rule in an EXTERNAL ACCESS INTEGRATION used by the Python UDF.
- B
Create a NETWORK POLICY that allows api.corp.example.com and attach it to the user that owns the Python UDF, because network policies control outbound destinations for code running in Snowflake.
- C
Create a NETWORK RULE with MODE = INGRESS and TYPE = IPV4 for the public IP address of api.corp.example.com, then attach it directly to the Python UDF.
- D
Create a SECURITY INTEGRATION for api.corp.example.com and grant USAGE on the integration to the Python UDF owner, because security integrations are the required object for outbound HTTPS access.
Show answer and explanation
Correct answer: A
Explanation
To allow a UDF or stored procedure to make outbound calls, Snowflake requires an EXTERNAL ACCESS INTEGRATION. The integration defines what external destinations are permitted and can also reference secrets for credentials. The allowed destinations themselves are defined in NETWORK RULE objects. For this scenario, the destination is a specific HTTPS endpoint identified by hostname, so the best practice is to create a reusable NETWORK RULE with MODE = EGRESS and TYPE = HOST_PORT and include api.corp.example.com:443 in the VALUE_LIST. Then the administrator references that rule from one or more EXTERNAL ACCESS INTEGRATION objects used by the Python UDFs. This cleanly separates destination management from code deployment and aligns with Snowflake documentation on external network access and network rules. By contrast, NETWORK POLICY controls inbound client access to Snowflake, not outbound traffic from handler code.
- A. Correct.
Correct. For outbound connections from UDFs or procedures using external network access, Snowflake uses EXTERNAL ACCESS INTEGRATION objects. Those integrations can reference NETWORK RULE objects that define the allowed destinations. For hostname-based HTTPS access, the appropriate rule uses MODE = EGRESS and TYPE = HOST_PORT with the destination host and port, such as api.corp.example.com:443. This satisfies the requirement to centrally manage and reuse the destination definition across multiple integrations.
- B. Incorrect.
Incorrect. NETWORK POLICY is used to control how clients connect into Snowflake, such as restricting sign-ins by IP address or network identifier. It does not govern outbound connections from Snowflake-managed code such as Python UDFs or stored procedures. This option reflects a common confusion between inbound access controls and external network access controls.
- C. Incorrect.
Incorrect. MODE = INGRESS is for incoming connectivity scenarios, not outbound access from Snowflake code. In addition, external access integrations do not work by attaching a network rule directly to a UDF; the UDF references an EXTERNAL ACCESS INTEGRATION, and that integration references allowed network rules. Using TYPE = IPV4 here is also less aligned with the stated requirement because the target is a hostname-based internal REST service and the question specifically emphasizes central management and reuse of the destination object.
- D. Incorrect.
Incorrect. SECURITY INTEGRATION objects are used for security-related integrations such as SSO, SCIM, OAuth, and certain external service trust configurations, but they are not the object used to define allowed outbound destinations for UDF network access. Outbound access control for handler code is implemented with EXTERNAL ACCESS INTEGRATION plus NETWORK RULE, optionally along with secrets for authentication.