ADA-C01 Question 108
Single answerAnalyze network policy behavior when both account-level and user-level network rules existA Snowflake administrator applies an account-level network policy named CORP_POLICY that allows connections only from the corporate NAT range 198.51.100.0/24. Later, the administrator assigns a different network policy named ANALYST_HOME_POLICY directly to user JLEE so the user can connect temporarily from a home office IP range 203.0.113.0/24. JLEE attempts to sign in from 203.0.113.25 and the connection succeeds. The security team wants to understand why this happened and how Snowflake evaluates these policies. Which statement correctly explains the behavior?
- A
Snowflake evaluates both account-level and user-level network policies together, and the connection is allowed because either policy can grant access.
- B
The user-level network policy takes precedence over the account-level network policy for that user, so JLEE is evaluated against ANALYST_HOME_POLICY instead of CORP_POLICY.
- C
The account-level network policy is enforced first, but user-level network policies can add temporary exceptions after successful authentication.
- D
Snowflake merges the allowed IP lists from both policies only when the user has the SECURITYADMIN role.
Show answer and explanation
Correct answer: B
Explanation
Snowflake network policies can be assigned at different scopes, including the account and individual users. When both an account-level policy and a user-level policy exist, the user-level network policy takes precedence for that specific user. Snowflake does not merge the rules from both policies for login evaluation. In this scenario, JLEE is allowed because the directly assigned user policy permits the home office IP range, even though the account-level policy would not. This is a common troubleshooting point in environments where administrators use a restrictive account baseline and assign exceptions to selected users. Best practice is to document all user-level overrides carefully because they can explain login behavior that appears inconsistent with the account-wide policy. This aligns with Snowflake documentation on network policies and policy assignment precedence.
- A. Incorrect.
Incorrect. Snowflake does not combine account-level and user-level network policies using a logical OR for a specific user. If a network policy is assigned directly to a user, that user-level assignment is the policy evaluated for that user. A common misconception is to assume Snowflake aggregates network rules from multiple scopes.
- B. Correct.
Correct. In Snowflake, a network policy assigned directly to a user overrides the account-level network policy for that user. That is why JLEE can connect from 203.0.113.25 even though that IP is not allowed by the account-level policy. This behavior is important when troubleshooting access because the effective policy at the user scope can differ from the broader account default.
- C. Incorrect.
Incorrect. Snowflake does not apply the account-level policy first and then allow user-level exceptions afterward. The precedence is based on scope, not on a sequential authentication step where one policy modifies the result of another. This option reflects a plausible but incorrect mental model.
- D. Incorrect.
Incorrect. Network policy evaluation is not based on the user's active role, including SECURITYADMIN. Also, Snowflake does not merge allowed IP lists from account-level and user-level policies for login evaluation. Role privileges affect administration, not how login source IPs are evaluated.