ADA-C01 Question 78
Select 3Manage user types (PERSON, NULL and SERVICE)A Snowflake administrator is reviewing account security after an audit found that several non-human integrations were still using interactive user accounts. The company wants to align each account with the correct Snowflake user type and reduce the risk of password-based sign-ins for automated workloads. Which TWO actions should the administrator take to meet this requirement?
- A
Convert the integration-owned accounts to SERVICE users so they can represent non-person identities used by applications and automation.
- B
Keep the integration-owned accounts as PERSON users, but disable MFA so scheduled jobs can authenticate without interruption.
- C
Use NULL user type for identities that should not be classified as either a human user or a service identity when a specific designation is not required.
- D
Create all automated accounts as PERSON users because only PERSON users can own objects and execute SQL statements.
- E
Use SERVICE users for background processes, API integrations, and other machine identities instead of assigning those workloads to named employees.
Show answer and explanation
Correct answers: A, C, E
Explanation
Snowflake supports user types including PERSON, SERVICE, and NULL to help classify identities appropriately. In a real administrative environment, human users should generally be classified as PERSON, while non-human identities such as applications, connectors, CI/CD jobs, and automation accounts should be classified as SERVICE. NULL is also a valid value when no explicit designation is applied or required. From a governance and security perspective, administrators should avoid using named employee accounts for automated processes because doing so complicates ownership, accountability, credential rotation, and employee offboarding. Best practice is to create dedicated machine identities and classify them as SERVICE. This aligns account administration with Snowflake user-type management guidance and broader security best practices for separating human and non-human access.
- A. Correct.
Correct. SERVICE is the appropriate user type for non-human identities such as applications, automation accounts, and integrations. Using SERVICE helps distinguish machine identities from human users for governance and administration purposes.
- B. Incorrect.
Incorrect. PERSON is intended for human users. Disabling MFA on a human-designated account to support automation is a security anti-pattern and does not address the audit finding that non-human workloads are using the wrong user type.
- C. Correct.
Correct. NULL is a valid user type value and can be used when the account is not explicitly designated as PERSON or SERVICE. It is not the preferred classification for known machine identities, but it is valid when no explicit classification is required.
- D. Incorrect.
Incorrect. This is a common misconception. SERVICE users are still Snowflake users and can be granted privileges needed to own objects or execute SQL, subject to role-based access control. There is no requirement that only PERSON users can perform those activities.
- E. Correct.
Correct. SERVICE is designed for machine identities, including background jobs and integrations. Assigning such workloads to named employee accounts creates accountability, lifecycle, and security problems because the credentials are tied to a person rather than the application or process.