ADA-C01 Question 130
Single answerManage service accounts, API integration, and automated authentication (for example, key-pair authentication)A company runs nightly ELT jobs from an external orchestration platform into Snowflake using a dedicated service user named ETL_SVC. Security policy requires the jobs to authenticate without storing passwords, support regular credential rotation with minimal downtime, and avoid broad privileges on the service account. The Snowflake administrator needs to implement the authentication design and ensure the orchestration platform can continue running during key rotation. Which approach best meets these requirements?
- A
Configure key-pair authentication for ETL_SVC, assign only the required roles to the user, store the private key securely in the orchestration platform, and rotate keys by setting RSA_PUBLIC_KEY_2 before removing the old public key.
- B
Enable password authentication for ETL_SVC, enforce a strong password policy, and rotate the password through the orchestration platform's secret manager during each deployment.
- C
Use SSO with MFA for ETL_SVC so that the orchestration platform can inherit the administrator's session and avoid managing any credentials directly.
- D
Grant ACCOUNTADMIN to ETL_SVC so automated jobs do not fail because of missing privileges, and use a single RSA public key that is replaced in place during rotation.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use key-pair authentication with a dedicated service user and least-privilege role assignments. In Snowflake, key-pair authentication is a standard pattern for service accounts and API-based integrations that need non-interactive access without storing passwords. For rotation, Snowflake supports dual public keys on the user object through RSA_PUBLIC_KEY and RSA_PUBLIC_KEY_2, which enables a staged rollover: add the new public key, update the automation platform to use the new private key, test connectivity, and then remove the old public key. This minimizes downtime and aligns with operational best practices. Snowflake documentation on key-pair authentication and user management describes using RSA keys for programmatic clients and supports public key rotation using the two key properties. Least privilege remains essential: the service account should be granted only the roles and object privileges required by the ELT process, rather than elevated administrative roles.
- A. Correct.
Correct. Key-pair authentication is the recommended approach for non-interactive service accounts when the goal is to avoid stored passwords. Snowflake supports associating RSA public keys with a user, and the client proves identity by signing with the corresponding private key. For rotation with minimal downtime, Snowflake supports two public key slots on the user (RSA_PUBLIC_KEY and RSA_PUBLIC_KEY_2), allowing administrators to add the new public key, update clients to use the new private key, validate connectivity, and then remove the old key. Assigning only the necessary roles follows least-privilege best practice and is important for service accounts used by automation.
- B. Incorrect.
Incorrect. Although strong password policies can improve password-based authentication, this option does not satisfy the requirement to avoid storing passwords. It also does not provide the same operational pattern for non-interactive authentication that key-pair authentication offers. A candidate might choose this because secret managers are commonly used for automation, but the scenario explicitly prefers passwordless automated authentication and controlled rotation with minimal disruption.
- C. Incorrect.
Incorrect. SSO with MFA is intended for interactive human users, not unattended batch jobs or service accounts. An orchestration platform should not depend on inheriting an administrator's session, and MFA introduces an interactive factor that conflicts with fully automated job execution. This option reflects a common misconception that all secure authentication should use SSO, even for machine identities.
- D. Incorrect.
Incorrect. Granting ACCOUNTADMIN to a service account violates least-privilege principles and creates unnecessary risk. Also, replacing a single RSA public key in place can cause downtime if the client has not yet switched to the corresponding new private key. Snowflake provides dual public key support specifically to enable safer rotation. This option is plausible because administrators sometimes overgrant privileges to reduce job failures, but it is not an acceptable design.