ADA-C01 Question 153
Single answerManage Tri-Secret SecureA government contractor is onboarding a new Snowflake environment that must meet strict key-control requirements. The security team requires Snowflake Tri-Secret Secure so that access to encrypted data depends on both Snowflake-managed key material and a customer-controlled key in the organization's cloud key management service. During a change window, the customer-managed key is accidentally disabled in the cloud KMS. What is the expected outcome, and what is the most appropriate administrator action?
- A
Snowflake continues normal operations because the Snowflake-managed key alone is sufficient; the administrator should re-enable the key only before the next account failover test.
- B
Queries against encrypted data can no longer be served because the customer-controlled key is required as part of Tri-Secret Secure; the administrator should re-enable the KMS key or restore access to it as quickly as possible.
- C
Only new data loads fail, but existing encrypted data remains fully queryable; the administrator should rotate the Snowflake-managed account master key to resynchronize encryption metadata.
- D
The account is permanently unrecoverable because disabling the customer key destroys all encrypted data; the administrator must create a new Snowflake account and reload all data from source systems.
Show answer and explanation
Correct answer: B
Explanation
Tri-Secret Secure is designed for customers who require stronger control over cryptographic access by introducing a customer-managed key from a supported cloud key management service into Snowflake's envelope encryption model. Snowflake still manages its own encryption keys, but access to the account master key also depends on the customer-controlled key. As a result, disabling that external key or revoking Snowflake's ability to use it can prevent Snowflake from accessing encrypted data. From an administration perspective, this means KMS availability, IAM/policy configuration, and key lifecycle controls become operationally critical. Best practice is to tightly govern but carefully monitor the customer-managed key, test recovery procedures, and avoid accidental disablement or permission changes that could interrupt data access. This aligns with Snowflake guidance for Tri-Secret Secure: customer control over the external key provides additional security assurance, but also introduces customer responsibility for maintaining that key's availability.
- A. Incorrect.
Incorrect. In Tri-Secret Secure, Snowflake does not rely solely on Snowflake-managed key material for access to encrypted data. A customer-managed key in the supported cloud KMS is part of the key hierarchy used to protect the account master key. If that external key becomes unavailable or disabled, Snowflake cannot continue normal access to protected data. This option reflects the misconception that Tri-Secret Secure is merely additive for compliance reporting and not actually enforced for decryption access.
- B. Correct.
Correct. Tri-Secret Secure adds a customer-controlled key from the cloud provider's key management service to Snowflake's encryption hierarchy. If that key is disabled or access to it is revoked, Snowflake cannot use the protected account master key to decrypt data, so query access to encrypted data is impacted. The appropriate administrative response is to restore availability of the customer-managed key by re-enabling it or fixing the relevant KMS permissions/policy configuration. This is the operational risk administrators must plan for when managing Tri-Secret Secure.
- C. Incorrect.
Incorrect. The impact is not limited to new writes or loads. Because the customer-controlled key is involved in protecting the account master key, disabling the KMS key affects Snowflake's ability to access encrypted data more broadly. Rotating Snowflake-managed keys would not solve loss of access to the external customer-managed key. This distractor targets a common misunderstanding between key rotation events and key availability dependencies.
- D. Incorrect.
Incorrect. Disabling or revoking access to the customer-managed key does not inherently destroy data or make the account permanently unrecoverable. In a typical Tri-Secret Secure scenario, access is blocked while the key is unavailable, but service can resume after the KMS key is re-enabled or access is restored. This option confuses temporary key unavailability with cryptographic destruction, such as deleting key material irreversibly.