ADA-C01 Question 77
Single answerManage user types (PERSON, NULL and SERVICE)A Snowflake administrator is reviewing identity hygiene after an audit. The audit found that several non-human integration accounts were created as regular interactive users, and some legacy accounts do not yet have a defined user type. The security team wants Snowflake user records to clearly distinguish human users, service accounts used by applications, and legacy users whose type has not been set. Which statement best describes how the administrator should manage Snowflake user types in this situation?
- A
Set employee logins to PERSON, application and automation accounts to SERVICE, and recognize that NULL indicates no user type has been explicitly assigned yet.
- B
Set all users to PERSON unless they authenticate with key-pair authentication, in which case they must be SERVICE.
- C
Use NULL for temporary contractors and PERSON only for permanent employees; SERVICE should be reserved for Snowflake-provided system users.
- D
Convert legacy users to NULL to disable interactive access until the administrator can review them.
Show answer and explanation
Correct answer: A
Explanation
This question tests practical governance of Snowflake user types. In Snowflake, user TYPE helps classify identities as human (PERSON), non-human/service identities (SERVICE), or unspecified (NULL when not explicitly set). In an audited environment, administrators should use PERSON for employee or other human logins and SERVICE for application, automation, and integration accounts. NULL should generally be treated as an unset state that may require cleanup, not as a deliberate substitute for a business identity category or an access control setting. Best practice is to classify users accurately for administration and auditability, then separately manage authentication, network restrictions, and privileges according to least-privilege and security requirements. Refer to Snowflake documentation for CREATE USER / ALTER USER user properties and guidance on managing users and service users.
- A. Correct.
Correct. Snowflake supports user types including PERSON, SERVICE, and NULL. PERSON is appropriate for human users, SERVICE is appropriate for non-human accounts such as applications, automation, or integrations, and NULL means a user type has not been explicitly set. This aligns with governance and identity clarity goals in real environments.
- B. Incorrect.
Incorrect. Authentication method does not determine user type. A human user could use key-pair authentication, and a service account could use other supported authentication mechanisms depending on the design. User type reflects whether the identity is a person or a service, not the login technology used.
- C. Incorrect.
Incorrect. NULL is not a business classification for contractors or other workforce categories. It simply means no user type is set. SERVICE is not limited to Snowflake-managed users; it is intended for non-human accounts such as ETL tools, CI/CD pipelines, and application integrations.
- D. Incorrect.
Incorrect. Setting or leaving a user type as NULL does not disable interactive access. Access is controlled through authentication settings, network policies, password/key configuration, MFA-related controls where applicable, and granted privileges. User type is a classification attribute, not an access-disable mechanism.