ADA-C01 Question 127
Single answerPrevent data exfiltration with PREVENT_UNLOAD_TO_INLINE_URL and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATIONA financial services company wants to reduce the risk of data exfiltration from Snowflake. Security administrators have identified two high-risk patterns they want to block across the account: users unloading query results directly to ad hoc cloud URLs, and developers creating external stages that reference cloud locations without using an approved storage integration. Which account-level configuration best meets both requirements while allowing approved external unload and stage usage to continue?
- A
Set PREVENT_UNLOAD_TO_INLINE_URL = TRUE and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE at the account level.
- B
Set PREVENT_UNLOAD_TO_INTERNAL_STAGES = TRUE and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE at the account level.
- C
Set PREVENT_UNLOAD_TO_INLINE_URL = TRUE and require users to specify ENCRYPTION = (TYPE = 'SNOWFLAKE_SSE') when creating stages.
- D
Set PREVENT_UNLOAD_TO_INLINE_URL = FALSE and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE at the account level, then restrict COPY INTO privileges on warehouses.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to enable both account parameters: PREVENT_UNLOAD_TO_INLINE_URL and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION. In Snowflake, PREVENT_UNLOAD_TO_INLINE_URL prevents users from unloading data directly to external cloud storage locations specified inline in SQL, which helps mitigate exfiltration through ad hoc destinations. REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION ensures that newly created external stages must use a storage integration, centralizing cloud access control and avoiding unmanaged credentials or arbitrary locations. This combination aligns with Snowflake security best practices for controlling data movement to external storage while preserving legitimate use cases through approved integrations. Candidates should distinguish these controls from unrelated parameters such as PREVENT_UNLOAD_TO_INTERNAL_STAGES, which applies to internal stages, and from encryption settings, which do not substitute for storage integration governance.
- A. Correct.
Correct. PREVENT_UNLOAD_TO_INLINE_URL = TRUE blocks unloading data to inline cloud storage URLs specified directly in statements such as COPY INTO
, which is a key control against ad hoc exfiltration. REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE forces creation of external stages to use a named storage integration rather than direct credentials or unmanaged cloud locations. Together, these account parameters reduce exfiltration risk while still allowing approved external stages and unload operations that use governed storage integrations. - B. Incorrect.
Incorrect. PREVENT_UNLOAD_TO_INTERNAL_STAGES controls unloading to internal stages, which is not the risk described in the scenario. The concern is unloading to ad hoc cloud URLs outside governed integrations. Although REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE is appropriate, this option does not address inline external URL unloads.
- C. Incorrect.
Incorrect. PREVENT_UNLOAD_TO_INLINE_URL = TRUE is relevant, but requiring SNOWFLAKE_SSE encryption on stage creation does not enforce the use of a storage integration. Encryption settings and storage integrations address different concerns. A stage can still be created without a storage integration unless REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION is enabled.
- D. Incorrect.
Incorrect. Leaving PREVENT_UNLOAD_TO_INLINE_URL = FALSE fails to block direct unloads to inline cloud URLs, which is one of the explicit requirements. Restricting warehouse privileges is also not the correct control for governing whether unload targets must use inline URLs or approved storage integrations.