ADA-C01 Question 109
Single answerEstablish private connectivity to Snowflake internal stages and the Snowflake serviceA financial services company must ensure that all traffic from its on-premises network to Snowflake stays on private network paths and does not traverse the public internet. The company uses Snowflake on AWS and has strict controls for both user access to the Snowflake service and data transfer to Snowflake internal stages. During testing, administrators discover that users can connect privately to the Snowflake account URL, but uploads to an internal stage still fail unless outbound internet access is allowed. Which action should the Snowflake administrator recommend to satisfy the requirement for both workloads?
- A
Create and use only a private connectivity endpoint for the Snowflake service because internal stage traffic automatically uses the same private endpoint.
- B
Configure private connectivity for the Snowflake service and also configure private connectivity to Snowflake internal stages using the cloud provider's private endpoint/service pattern for stage access.
- C
Use network policies to restrict users to private IP ranges; this also forces internal stage PUT/GET commands to use private connectivity.
- D
Set the internal stage encryption type to client-side encryption so files can be uploaded securely without requiring public internet access.
Show answer and explanation
Correct answer: B
Explanation
This scenario tests an important operational distinction in Snowflake private networking: private access to the Snowflake service endpoint does not by itself provide private access to Snowflake internal stages. Administrators must plan for both paths separately when organizations require end-to-end private routing. In Snowflake documentation, private connectivity for the Snowflake service and private connectivity for internal stages are documented as separate capabilities and may require separate cloud-provider endpoint configuration. Network policies help restrict source IPs but do not create private transport. Likewise, encryption settings secure data but do not change the network path. For exam purposes, remember that internal stage connectivity is not automatically covered by private connectivity to the Snowflake account/service URL.
- A. Incorrect.
Incorrect. Private connectivity to the Snowflake service and private connectivity to Snowflake internal stages are related but distinct. Accessing the Snowflake account URL privately does not automatically make internal stage data transfers private. In practice, organizations often need separate private connectivity configuration for the Snowflake service endpoint and for internal stage endpoints.
- B. Correct.
Correct. To keep both control-plane/service access and internal stage data transfers on private network paths, the administrator must configure private connectivity for the Snowflake service and separately enable private connectivity for Snowflake internal stages. On AWS, this typically involves using the relevant private endpoint model for the Snowflake service and the private endpoint/service configuration required for stage access. This aligns with Snowflake guidance that private connectivity to internal stages is a separate setup from private connectivity to the main Snowflake service.
- C. Incorrect.
Incorrect. Network policies control which client IP addresses can authenticate to Snowflake, but they do not establish private routing. They are an access control mechanism, not a transport mechanism. A common misconception is that restricting allowed IPs somehow converts traffic to private connectivity, but actual private network paths require cloud-provider private endpoint configuration.
- D. Incorrect.
Incorrect. Encryption protects data confidentiality, but it does not determine whether traffic traverses the public internet or a private path. Client-side encryption for stage files can be useful for security, but it does not replace private connectivity requirements. The scenario specifically requires traffic to remain off the public internet, which is a networking configuration issue rather than an encryption-setting issue.