ADA-C01 Question 68
Single answer1.5 Set up and manage Snowflake authentication.A company uses Snowflake with SAML 2.0 federation to Microsoft Entra ID (Azure AD) for interactive user logins. Security policy now requires service accounts used by CI/CD pipelines to authenticate without passwords and without any browser-based sign-in flow. The pipelines run from a fixed set of Linux hosts and connect through the SnowSQL CLI and the Python connector. The Snowflake administrator must implement an authentication method that satisfies the requirement while minimizing operational overhead.
Which authentication approach should the administrator choose?
- A
Configure key pair authentication for the service users and register each user's RSA public key in Snowflake
- B
Use SAML 2.0 federation for the service users and enforce IdP-initiated login from the pipeline hosts
- C
Enable MFA for the service users and store the generated TOTP seed securely on each Linux host
- D
Configure OAuth authorization code flow for the service users so the pipeline can obtain tokens interactively when needed
- E
Use external browser authentication in SnowSQL and the Python connector so the pipeline inherits the workstation's SSO session
Show answer and explanation
Correct answer: A
Explanation
For unattended service accounts in Snowflake, key pair authentication is the most appropriate choice when the requirement is to avoid passwords and browser-based sign-in. In this model, the administrator generates an RSA key pair, assigns the public key to the Snowflake user, and the automation platform securely stores the private key. This aligns well with SnowSQL and Snowflake connectors for non-interactive workloads.
SAML 2.0 federated authentication and external browser authentication are primarily designed for interactive user sign-in, not headless automation. MFA similarly targets interactive assurance rather than unattended jobs. OAuth can be valid in Snowflake depending on the integration pattern, but the authorization code flow is explicitly interactive and therefore not suitable here.
This reflects Snowflake authentication best practices: use federated SSO for workforce users and key pair authentication for service users and automation where non-interactive access is required. Administrators should also manage key rotation and protect private keys using secure secret-management tooling.
- A. Correct.
Correct. Key pair authentication is designed for programmatic access without passwords and without browser-based interaction. A service user can authenticate by proving possession of the private key, while Snowflake stores the matching public key on the user object. This is a common best practice for automation with SnowSQL and Snowflake drivers/connectors because it removes password management and avoids interactive SSO flows.
- B. Incorrect.
Incorrect. SAML federation is appropriate for human users performing interactive sign-in through an identity provider, typically involving a browser redirect or SSO flow. It is not the best fit for non-interactive service accounts running unattended jobs from CLI tools and connectors.
- C. Incorrect.
Incorrect. MFA increases assurance for interactive user authentication, but storing TOTP secrets on servers for unattended automation is not a recommended pattern and does not satisfy the goal of avoiding password-based and browser-based authentication overhead. It also introduces operational and security complexity.
- D. Incorrect.
Incorrect. OAuth can support non-password authentication in some architectures, but the authorization code flow specifically is an interactive browser-based flow intended for user consent and sign-in. That conflicts with the requirement for unattended CI/CD jobs. Other OAuth patterns may be used in some environments, but this option is explicitly the interactive flow.
- E. Incorrect.
Incorrect. External browser authentication depends on launching a browser-based login experience and is intended for interactive users leveraging SSO. It is not suitable for headless CI/CD pipelines running unattended on Linux hosts.