ADA-C01 Question 81
Single answerManage user MFA enrollmentA Snowflake account administrator enabled account-level MFA for all human users after a security review. The help desk reports that one analyst replaced their mobile phone and can no longer complete MFA during sign-in to Snowsight. The analyst must regain access quickly, but the company does not want to weaken MFA requirements for other users. What is the BEST action for the administrator to take?
- A
Disable MFA for the entire Snowflake account, have the analyst sign in, and then re-enable MFA after the user enrolls again
- B
Use a temporary password reset for the analyst, because password changes automatically clear and recreate MFA enrollment
- C
Reset the analyst's MFA enrollment so the user is prompted to enroll a new authenticator at the next login
- D
Create a second Snowflake user for the analyst without MFA and transfer ownership of the analyst's objects to the new account
Show answer and explanation
Correct answer: C
Explanation
The best practice is to handle lost or replaced MFA devices at the user level by resetting the affected user's MFA enrollment, not by weakening account-wide security or creating workaround identities. In Snowflake, MFA enrollment is separate from password management, so password resets are not the right administrative action for replacing a lost authenticator. Account administrators should use the supported MFA reset process so the user can enroll again on the next login while the organization keeps MFA enforced for all other users. This aligns with Snowflake guidance for administering MFA and maintaining least-disruption, least-privilege security operations.
- A. Incorrect.
Incorrect. Disabling MFA at the account level impacts all users and reduces the security posture of the environment. In a real administration scenario, broad security controls should not be relaxed to solve a single user's lost-device issue when a targeted remediation exists.
- B. Incorrect.
Incorrect. Resetting or changing a user's password does not serve as the correct mechanism for managing MFA enrollment. MFA enrollment is managed separately from password lifecycle actions, so a password reset would not appropriately address a lost authenticator device.
- C. Correct.
Correct. When a user loses access to their enrolled authenticator, the administrator should reset that user's MFA enrollment. This preserves the account-wide MFA policy while allowing only the affected user to re-enroll a new MFA method during the next authentication flow.
- D. Incorrect.
Incorrect. Creating a separate user to bypass MFA is poor security practice and introduces unnecessary identity sprawl, auditing complications, and object ownership issues. It also avoids rather than resolves the MFA enrollment problem.