ADA-C01 Question 79
Single answerManage passwords and password policiesA Snowflake administrator needs to enforce stricter password controls for a group of local Snowflake users in the FINANCE database role hierarchy, while leaving federated SSO users unaffected. The security team requires the following for these local users: passwords must be at least 14 characters, users cannot reuse the last 8 passwords, and passwords must expire every 60 days. The administrator also wants to avoid changing account-wide behavior for all users. What is the BEST approach?
- A
Create a custom password policy with the required settings and attach it directly to each local FINANCE user.
- B
Create a custom password policy with the required settings and assign it to the FINANCE role so that all users with that role inherit the policy.
- C
Alter the account-level password parameters so the FINANCE users receive the stricter settings, then exempt SSO users from password expiration.
- D
Create a network policy for FINANCE users and set password length, password history, and password expiration in that policy.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to create a custom password policy and assign it directly to the relevant local users. In Snowflake, password policies are used to manage password-related requirements such as minimum length, password history, and password expiration. They can be applied at the account level or user level, and the user-level approach is appropriate when only a subset of local users should be affected. This is especially important in mixed environments where some users authenticate with Snowflake-managed passwords and others use federated authentication through SSO. Roles are not valid targets for password policy assignment, and network policies are unrelated because they govern network access rather than password rules. This approach follows Snowflake security administration best practices by applying the least broad scope necessary and avoiding unnecessary account-wide impact.
- A. Correct.
Correct. In Snowflake, password policies can be created as schema-level security objects and assigned to individual users or at the account level. To avoid changing behavior for all users, the administrator should create a custom password policy and set it on the specific local users who need it. This also aligns with the requirement to leave federated SSO users unaffected, since SSO users typically authenticate through the identity provider rather than Snowflake password authentication.
- B. Incorrect.
Incorrect. Password policies are not assigned to roles for inheritance. A common misconception is that role-based access control objects can also carry authentication settings to users, but password policy assignment is not role-scoped in that way. Roles manage privileges; password policies are applied to users or the account.
- C. Incorrect.
Incorrect. Setting account-level password parameters would affect all Snowflake password users in the account, which conflicts with the requirement to avoid changing account-wide behavior. In addition, Snowflake does not use a per-user exemption model for account-level password expiration in the way described here. This option reflects a misunderstanding of the scope of account-level password policy enforcement.
- D. Incorrect.
Incorrect. Network policies control allowed network locations such as IP allowlists and blocklists. They do not manage password complexity, reuse history, or expiration settings. This distractor targets the common confusion between authentication controls and network access controls.