ADA-C01 Question 248
Single answerData exfiltrationA financial services company stores highly sensitive customer data in Snowflake and must reduce the risk of data exfiltration by privileged users. Security administrators want to ensure that even if a user can run SELECT statements on protected tables, they cannot copy query results to an external cloud storage location unless that location has been explicitly approved. Which Snowflake control should the administrator implement to best meet this requirement?
- A
Create a network policy that restricts user logins to the corporate IP range
- B
Use a masking policy on sensitive columns and allow all users to create external stages as needed
- C
Configure an external access integration and restrict it to approved destinations
- D
Use a storage integration and apply an allowed locations restriction for unloading data to approved cloud storage paths
Show answer and explanation
Correct answer: D
Explanation
The best answer is to use a storage integration with restricted allowed storage locations. In Snowflake, storage integrations provide a secure, managed way to authorize access to external cloud storage without embedding long-lived cloud credentials in stages or commands. Administrators can define which storage locations are allowed, helping prevent users from unloading data to arbitrary buckets or paths. This is a key best practice for reducing data exfiltration risk. Network policies are useful for restricting where users authenticate from, but they do not govern data unload targets. Masking policies protect data visibility but do not stop approved users from exporting visible results. External access integrations are for controlled outbound network access from supported Snowflake features, not for securing standard unload-to-cloud-storage workflows. Snowflake documentation on storage integrations, external stages, and COPY INTO
- A. Incorrect.
Incorrect. A network policy limits where users can connect from, which helps reduce unauthorized access, but it does not directly control whether an authenticated user can unload query results to external cloud storage. A user connecting from an approved corporate IP could still exfiltrate data if unload paths are not properly restricted.
- B. Incorrect.
Incorrect. Masking policies can reduce exposure of sensitive fields for certain roles, but they do not by themselves prevent data unloading to external locations. In addition, allowing users to create external stages freely increases exfiltration risk rather than reducing it.
- C. Incorrect.
Incorrect. External access integrations are used to allow Snowflake code, such as external network calls from specific features, to access external network locations. They are not the primary control for governing COPY INTO
unload operations to cloud storage. This option reflects a common confusion between outbound network access controls and data unload controls. - D. Correct.
Correct. A storage integration is the recommended control for secure access to cloud storage for loading and unloading data. By using storage integrations together with allowed storage locations, administrators can restrict unload operations so data can be written only to explicitly approved buckets, containers, or prefixes. This directly addresses the exfiltration scenario by preventing arbitrary external destinations from being used.