ADA-C01 Question 76
Single answerImplement and manage passwords and multi-factor authentication (MFA)A Snowflake administrator is reviewing authentication controls for users who sign in with Snowflake-native credentials (username and password). The company has decided that all interactive users must use multi-factor authentication (MFA), but service accounts used by automated jobs must continue to connect non-interactively. The administrator wants to implement this with the least disruption and without relying on each user to opt in individually. Which action should the administrator take?
- A
Configure an authentication policy that requires MFA for password-based sign-ins, assign it to the account or relevant users, and exclude service accounts by assigning them a different policy or authentication method.
- B
Set a password policy with stricter complexity and rotation settings, because strong passwords automatically enforce MFA enrollment for interactive users.
- C
Enable MFA once at the Snowflake account level; this will apply only to human users and will not affect service accounts that use passwords.
- D
Reset all user passwords and mark them as must-change-at-next-login, because Snowflake prompts users to register MFA during password reset workflows.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use an authentication policy to require MFA for password-based interactive sign-ins and scope that policy appropriately. This approach aligns with Snowflake best practices by separating password management from authentication requirements. Password policies control password rules, while authentication policies control sign-in behavior, including MFA requirements. In real environments, administrators should avoid using password-based service accounts for automation when possible and instead use supported non-interactive authentication methods such as key-pair authentication. This reduces operational risk and avoids MFA conflicts for unattended processes. Snowflake documentation on authentication policies, MFA, and password policies supports this distinction and the use of policy-based enforcement rather than ad hoc user-by-user configuration.
- A. Correct.
Correct. Authentication policies are the appropriate Snowflake control for managing sign-in requirements such as MFA. An administrator can require MFA for users authenticating with Snowflake credentials and apply the policy at the account or user level. This supports centralized enforcement rather than depending on individual user enrollment decisions. Service accounts should not be treated like interactive users; they should either be assigned a different authentication policy or, preferably, use a non-password authentication approach suitable for automation, such as key-pair authentication where applicable.
- B. Incorrect.
Incorrect. Password policies govern password characteristics such as length, complexity, lockout, and age, but they do not enforce MFA. This option reflects a common misconception that strengthening passwords is equivalent to enabling multi-factor authentication. In Snowflake, password policies and authentication policies are separate controls with different purposes.
- C. Incorrect.
Incorrect. Snowflake does not use a simple global MFA toggle that automatically distinguishes human users from service accounts in the way described here. MFA enforcement is managed through authentication policy configuration and user authentication setup. Also, if service accounts are using password-based authentication, blindly enforcing MFA on all password users could break automation.
- D. Incorrect.
Incorrect. Forcing password resets may cause users to reauthenticate, but it is not a valid mechanism for centrally enforcing MFA requirements. It also creates unnecessary disruption and does not solve the core requirement of establishing durable, policy-based MFA enforcement for interactive users while preserving non-interactive access for service accounts.