ADA-C01 Question 129
Single answerManage service accounts, API integration, and automated authentication (for example, key-pair authentication)A company is replacing password-based authentication for an ETL service account that loads data into Snowflake every 15 minutes from an external orchestration platform. The security team requires that the solution minimize the risk of credential exposure, support non-interactive authentication, and allow periodic key rotation without changing application code. A Snowflake administrator creates a dedicated user for the ETL process and must choose the best authentication approach. Which solution should the administrator implement?
- A
Configure key-pair authentication for the service user, store the private key securely in the orchestration platform's secret manager, and register the corresponding public key on the Snowflake user.
- B
Enable MFA on the service user and have the orchestration platform cache the MFA token so scheduled jobs can log in without user intervention.
- C
Use a network policy to restrict the service user's source IP addresses, but continue using a username and password stored in the ETL job configuration file.
- D
Create a personal user for the ETL developer, grant it the required roles, and share the developer's password securely with the operations team that maintains the scheduler.
Show answer and explanation
Correct answer: A
Explanation
For automated Snowflake access, a dedicated service account using key-pair authentication is the best fit when the goals are non-interactive authentication, reduced credential exposure, and manageable rotation. In Snowflake, the administrator associates a public key with the user, and the client authenticates by proving possession of the corresponding private key. This is preferable to password-based authentication for many API and scheduled workloads. Snowflake also supports public key rotation patterns, including maintaining registered key material on the user to help clients transition during rotation windows. Additional controls such as least-privilege role grants, network policies, and secure secret storage should complement the design, but they do not replace the need for a secure authentication mechanism. These practices align with Snowflake guidance for key-pair authentication, service users, and automated access patterns.
- A. Correct.
Correct. Key-pair authentication is a recommended approach for Snowflake service accounts and automated clients because it supports non-interactive login and reduces reliance on reusable passwords. The private key can be stored in a secure secret manager outside application code, while Snowflake stores only the public key on the user object. This design also supports key rotation by updating the registered public key(s) in Snowflake and rotating the private key in the secret store, which aligns with service-account best practices.
- B. Incorrect.
Incorrect. MFA is intended for interactive human authentication and is generally not appropriate for unattended service accounts or scheduled integrations. Caching MFA tokens for automated jobs undermines the purpose of MFA and does not provide a robust long-term solution for non-interactive processes.
- C. Incorrect.
Incorrect. Restricting source IPs with a network policy is a useful additional control, but it does not solve the core requirement to replace password-based authentication. Storing a username and password in a job configuration file increases the risk of credential exposure and is weaker than key-pair authentication for automated integrations.
- D. Incorrect.
Incorrect. Service processes should use dedicated service users rather than personal user accounts. Sharing a developer's credentials creates audit, governance, and operational risks, including poor accountability, difficulty rotating credentials safely, and dependence on an individual's account lifecycle.