ADA-C01 Question 111
Single answerImplement and manage cloud provider interfaces and private endpoints for internal stagesA financial services company stores sensitive files in an internal stage and must ensure that all access from users in its AWS VPC to Snowflake uses private network connectivity rather than the public internet. The Snowflake account is already configured to support private connectivity. The security team wants users to browse and manage files in the internal stage from Snowsight and through SQL commands while enforcing private access to the Snowflake service endpoints. Which action should the Snowflake administrator take to meet this requirement?
- A
Create a network rule that allows only the corporate VPC CIDR range, and attach it to the internal stage so stage traffic is forced through AWS PrivateLink.
- B
Configure an AWS PrivateLink endpoint for the Snowflake account and have users connect to the account using the account URL associated with the private connectivity configuration.
- C
Create an external volume mapped to the internal stage and bind it to an AWS interface endpoint so internal stage operations use private routing.
- D
Enable Tri-Secret Secure for the account so encryption keys are managed privately, which also ensures internal stage access does not traverse the public internet.
Show answer and explanation
Correct answer: B
Explanation
To provide private connectivity for users accessing Snowflake, including operations against internal stages, the administrator must configure the cloud provider's private endpoint service for the Snowflake account and ensure clients use the private account URL. On AWS, this is done with AWS PrivateLink interface endpoints. Internal stages are Snowflake-managed and do not require or support customer configuration of storage endpoints in the same way external stages do. Network policies can complement the solution by restricting allowed client sources, but they do not create private transport. Likewise, encryption features such as Tri-Secret Secure protect data keys rather than network paths. Snowflake documentation on private connectivity and internal stages makes this distinction clear: private connectivity is established at the account/service endpoint level, and internal stages remain Snowflake-managed storage accessed through Snowflake service endpoints.
- A. Incorrect.
Incorrect. Network rules and network policies can restrict which client IP addresses are allowed to connect to Snowflake, but they do not by themselves establish private network transport. Internal stages are Snowflake-managed storage, so you do not attach a network rule directly to an internal stage to force AWS PrivateLink usage. Private connectivity is achieved by configuring the cloud provider private endpoint and using the corresponding Snowflake private URL.
- B. Correct.
Correct. For AWS, private access to Snowflake is implemented with AWS PrivateLink. After the Snowflake account is enabled for private connectivity, the customer creates and approves the relevant interface endpoint(s) in AWS and users connect using the Snowflake account URL for private connectivity. This ensures client traffic to Snowflake service endpoints, including operations such as browsing and managing files in internal stages through Snowsight or SQL, uses private network paths instead of the public internet.
- C. Incorrect.
Incorrect. External volumes are used for features such as Apache Iceberg tables and reference customer-managed cloud storage; they are not used to back or reconfigure Snowflake internal stages. Internal stages use Snowflake-managed storage, so creating an external volume would not make internal stage access private.
- D. Incorrect.
Incorrect. Tri-Secret Secure is related to encryption key management and stronger data protection controls. It does not provide network-level private connectivity. Encrypting data and routing traffic privately are separate concerns; enabling Tri-Secret Secure does not replace AWS PrivateLink or other private endpoint configurations.