ADA-C01 Question 67
Single answer1.5 Set up and manage Snowflake authentication.A company uses Snowflake with federated SSO through its corporate identity provider (IdP) for all human users. The security team now requires two additional controls: (1) service accounts used by ETL tools must not depend on interactive SSO, and (2) administrators must be able to immediately block a compromised service account from authenticating without affecting other users. Which authentication approach best meets these requirements?
- A
Configure the ETL service accounts to use key pair authentication and, if compromise is suspected, disable the Snowflake user or remove/rotate the registered public key for that user.
- B
Configure the ETL service accounts to use the same SAML SSO integration as human users and, if compromise is suspected, force a password reset in the IdP.
- C
Configure the ETL service accounts to use MFA with password authentication and, if compromise is suspected, require the user to re-enroll their MFA device.
- D
Configure the ETL service accounts to use OAuth through Snowsight and, if compromise is suspected, change the network policy assigned to the ACCOUNTADMIN role.
Show answer and explanation
Correct answer: A
Explanation
For Snowflake authentication, administrators should choose methods that align with the actor type and access pattern. Human users commonly authenticate with federated SSO (for example, SAML 2.0 via an external IdP), while non-interactive service accounts are better suited to programmatic authentication such as key pair authentication. Key pair authentication is widely used for connectors, drivers, SnowSQL, and automated pipelines because it removes dependency on interactive login prompts. It also provides straightforward revocation and rotation: administrators can disable the user account, replace or unset the stored RSA public key, and rotate keys according to security policy. This is more operationally appropriate than trying to force service accounts through SSO or MFA workflows designed for people. Snowflake documentation and best practices distinguish between federated authentication for workforce users and key pair authentication for automated clients, and they emphasize using user-level controls and key rotation to manage compromise scenarios.
- A. Correct.
Correct. Key pair authentication is a recommended approach for non-interactive service accounts because it avoids dependence on browser-based or interactive SSO flows. Snowflake supports key pair authentication by associating an RSA public key with a user, while the client holds the private key. If the service account is compromised, administrators can quickly block access by disabling the user, unsetting/replacing the public key, or rotating the key pair. This directly addresses both requirements: non-interactive authentication and immediate, user-specific revocation.
- B. Incorrect.
Incorrect. SAML SSO is primarily designed for federated interactive user authentication, typically involving browser-based sign-in through an IdP. It is not the best fit for unattended ETL service accounts. Forcing a password reset in the IdP also does not align with typical SSO patterns for service principals and may not immediately address token/session behavior the way disabling the Snowflake user or revoking the key would.
- C. Incorrect.
Incorrect. MFA with password authentication is intended to strengthen human user access, not unattended service accounts. ETL tools and automated jobs generally cannot reliably complete MFA challenges without additional interactive or workaround mechanisms, which weakens the security design. Re-enrolling an MFA device also does not provide the clean service-account revocation model required here.
- D. Incorrect.
Incorrect. OAuth can be valid for some programmatic access patterns, but the option is flawed in two ways. First, 'through Snowsight' is not how ETL service authentication is typically designed. Second, changing a network policy assigned to the ACCOUNTADMIN role is unrelated to immediately revoking one specific service account's authentication. Network policies affect allowed source IPs and are not the primary per-user revocation control described in the scenario.