ADA-C01 Question 128
Select 2Prevent data exfiltration with PREVENT_UNLOAD_TO_INLINE_URL and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATIONA financial services company discovered that several engineers created ad hoc external stages pointing to personal cloud storage locations and also used COPY INTO with direct cloud URLs to unload sensitive query results. The security team wants to reduce data exfiltration risk without blocking legitimate unloads that use approved storage integrations. As the Snowflake administrator, which account-level changes should be implemented to meet this requirement?
- A
Set PREVENT_UNLOAD_TO_INLINE_URL = TRUE and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE at the account level.
- B
Set PREVENT_UNLOAD_TO_INTERNAL_STAGES = TRUE and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE at the account level.
- C
Set PREVENT_UNLOAD_TO_INLINE_URL = TRUE and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE, then require users to create external stages that reference approved STORAGE INTEGRATION objects.
- D
Grant only the SECURITYADMIN role the ability to run COPY INTO
statements, because this blocks unloads to direct cloud URLs for all other roles. - E
Disable all external stages and require data sharing instead, because storage integrations cannot be used to control unload destinations.
Show answer and explanation
Correct answers: A, C
Explanation
To reduce exfiltration risk while still permitting approved data unloads, Snowflake provides account parameters that directly target the two risky behaviors in the scenario. PREVENT_UNLOAD_TO_INLINE_URL = TRUE prevents users from unloading data with COPY INTO statements that specify a raw cloud storage URL inline, such as an arbitrary S3, GCS, or Azure path. REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE enforces the use of a STORAGE INTEGRATION when creating stages, preventing users from defining external stages with unmanaged locations or embedded credentials. In practice, administrators pair these controls with approved storage integrations and tightly governed external stages. This aligns with Snowflake security best practices for controlling external access paths and reducing the chance of data being written to unauthorized cloud storage locations.
- A. Correct.
Correct. PREVENT_UNLOAD_TO_INLINE_URL = TRUE blocks unloading data directly to an inline cloud storage URL in COPY INTO statements, which helps prevent users from sending data to arbitrary locations. REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE requires the use of a storage integration when creating stages, which prevents creation of external stages with embedded credentials or uncontrolled cloud locations. Together, these settings address both direct URL unloads and ad hoc stage creation patterns associated with exfiltration risk.
- B. Incorrect.
Incorrect. PREVENT_UNLOAD_TO_INTERNAL_STAGES is not the control needed for this scenario. The problem is users unloading to direct cloud URLs and creating external stages that bypass approved integrations. Blocking unloads to internal stages would not address inline URL exfiltration and would interfere with common internal Snowflake workflows.
- C. Correct.
Correct. This option includes the same two required account parameters and correctly applies them in practice: approved unloads should occur through external stages that use vetted STORAGE INTEGRATION objects. That allows legitimate business processes to continue while preventing direct URL-based unloads and uncontrolled external stage definitions.
- D. Incorrect.
Incorrect. There is no account-level mechanism where simply restricting COPY INTO
to SECURITYADMIN solves this problem, and COPY permissions are not controlled in the simplistic way described. Users with appropriate object privileges can still perform unload operations unless governed by the relevant exfiltration controls. This option reflects a common misconception that role restriction alone replaces parameter-based controls. - E. Incorrect.
Incorrect. Disabling all external stages is not the recommended or necessary solution. Storage integrations are specifically designed to securely control access to approved external cloud storage for stages. The requirement is to allow legitimate unloads through approved integrations, not to eliminate external stages entirely.