ADA-C01 Question 135
Single answer2.1 Manage organizations and accounts.A global company uses a Snowflake organization with several accounts across AWS and Azure. The organization administrator wants to centralize user authentication and apply a consistent network policy to every current and future account in the organization with the least ongoing administrative effort. Which approach should the administrator take?
- A
Configure the security integration and network policy separately in each account, because organization-level security settings are not supported for these controls.
- B
Use the organization account to configure an organization-level SAML2 security integration and an organization-level network policy so the settings can be applied across accounts.
- C
Create an account hierarchy and inherit the SAML2 security integration and network policy from the primary account to all child accounts.
- D
Replicate the security integration and network policy database objects from one account to all other accounts using database replication.
Show answer and explanation
Correct answer: B
Explanation
The key requirement is centralized administration across multiple accounts with minimal ongoing maintenance. For Snowflake organizations, the organization account is designed for organization-wide administration tasks. Snowflake supports organization-level SAML2 integration for organization users and organization-level network policies, which allows administrators to standardize authentication and network access controls across accounts more efficiently than configuring each account independently.
The main misconceptions tested here are: (1) assuming every security control must be configured per account, (2) assuming Snowflake accounts form an inheritance hierarchy, and (3) confusing account/organization security objects with database objects that can be replicated. According to Snowflake best practices and product documentation for organizations and accounts, administrators should use organization-level capabilities when they need consistency and centralized governance across multiple accounts.
- A. Incorrect.
Incorrect. This approach increases administrative overhead and does not meet the requirement for centralized management with the least ongoing effort. Snowflake supports certain organization-level controls specifically to help standardize settings across accounts, including organization users for SAML2 authentication and organization-level network policies.
- B. Correct.
Correct. In the organization account, an administrator can configure organization-level security features for centralized management. Snowflake supports organization users authenticated through an organization-level SAML2 security integration, and Snowflake also supports organization-level network policies that can be applied across accounts. This is the best fit for a multi-account organization seeking consistent controls with reduced operational effort.
- C. Incorrect.
Incorrect. Snowflake organizations do not use a parent-child account inheritance model where one account's objects or security settings automatically cascade to other accounts. Accounts within an organization are managed centrally in some areas, but inheritance from a primary account is not how SAML integrations or network policies are propagated.
- D. Incorrect.
Incorrect. Security integrations and network policies are not database objects that are distributed through database replication. Database replication is designed for supported database-level objects and failover/replication use cases, not for centrally propagating account- or organization-level security configurations.