ADA-C01 Question 249
Select 2Data exfiltrationA financial services company stores highly sensitive customer data in Snowflake. The security team must reduce the risk of data exfiltration by ensuring users can only unload query results to approved cloud storage locations and cannot freely copy data out of Snowflake. Which actions should the Snowflake administrator take to best meet this requirement?
- A
Use storage integrations with explicitly allowed locations, create named external stages that use those integrations, and restrict users to unloading only through those named stages.
- B
Grant users the ability to create their own external stages so they can manage unload destinations without administrator involvement.
- C
Create and enforce a network policy to restrict which client IP addresses can connect to Snowflake.
- D
Disable or tightly control the use of ad hoc COPY INTO
statements and avoid granting privileges that let users write to arbitrary external locations. - E
Increase the statement timeout for data export sessions so large unload jobs complete before users retry with other methods.
Show answer and explanation
Correct answers: A, D
Explanation
To reduce data exfiltration risk in Snowflake, administrators should control outbound data movement rather than relying only on login restrictions or session settings. The strongest fit for this scenario is to use storage integrations with approved locations and require unloading through administrator-managed named external stages. This aligns with Snowflake best practices for securing data unload operations because storage integrations provide centralized, auditable access to cloud storage without exposing long-lived cloud credentials to users. In addition, administrators should avoid permitting users to unload to arbitrary locations with ad hoc COPY INTO
- A. Correct.
Correct. Storage integrations are a core control for limiting unload targets to approved cloud storage locations. By defining allowed locations in the integration and exposing only administrator-managed named stages, the administrator can constrain where data is unloaded. This is a recommended approach for reducing exfiltration risk because it removes the need for users to embed cloud credentials and helps centralize control over outbound data paths.
- B. Incorrect.
Incorrect. Allowing users to create their own external stages weakens control over unload destinations and can increase exfiltration risk, especially if users can point stages to unapproved buckets or containers. The security objective here is centralized control, not user self-service for export endpoints.
- C. Incorrect.
Incorrect. Network policies are useful for restricting which networks or IP addresses can access Snowflake, which can reduce exposure to unauthorized access. However, they do not directly ensure that data can only be unloaded to approved cloud storage locations. This control is valuable but does not best address the specific exfiltration requirement described.
- D. Correct.
Correct. Preventing unrestricted ad hoc unloads is an important exfiltration control. Administrators should avoid enabling patterns that let users write query results to arbitrary external locations. Combined with named stages backed by storage integrations, this helps ensure data egress occurs only through approved, monitored paths.
- E. Incorrect.
Incorrect. Statement timeout settings affect query or command execution duration, not where users can export data. Increasing timeouts does nothing to reduce exfiltration risk and may even allow larger exports to complete.