ADA-C01 Question 82
Single answerManage user MFA enrollmentA Snowflake account administrator enabled multi-factor authentication (MFA) for all human users in the account. Shortly afterward, several users report that they replaced their mobile phones and can no longer sign in because their authenticator app codes no longer work. The security team wants a solution that restores access quickly without disabling MFA for the account or recreating the affected users. What is the best action for the administrator to take?
- A
Reset the affected users' MFA enrollment so they can enroll a new authenticator device at their next sign-in
- B
Set the affected users' PASSWORD parameter to a temporary value so MFA is bypassed during the next login
- C
Unlock the affected users and ask them to sign in again; Snowflake will automatically detect the new phone and update MFA enrollment
- D
Disable MFA at the account level, allow the affected users to sign in and reconfigure their profiles, then re-enable MFA after enrollment is complete
Show answer and explanation
Correct answer: A
Explanation
The most appropriate administrative response is to reset MFA enrollment for the affected users. In Snowflake, MFA enrollment is tied to the user's enrolled authenticator device or method, so replacing a phone commonly requires an MFA reset before the user can register a new device. This approach restores access while keeping MFA enabled for the account and avoiding unnecessary disruption. Changing passwords or unlocking accounts does not resolve a lost or replaced MFA device, and disabling MFA globally is contrary to least-privilege and security best practices. This aligns with Snowflake guidance for managing user MFA enrollment and recovery workflows through administrative reset actions rather than broad policy rollback.
- A. Correct.
Correct. When a user loses access to the enrolled authenticator device, an administrator can reset that user's MFA enrollment. This preserves the user account while requiring the user to enroll a new MFA method at the next login. This is the appropriate recovery action when the goal is to maintain MFA enforcement and restore access without recreating accounts.
- B. Incorrect.
Incorrect. Resetting or changing a user's password does not bypass MFA requirements. Password authentication and MFA are separate controls. A temporary password may help if the password is unknown, but it will not solve the problem of a user being unable to complete the second authentication factor.
- C. Incorrect.
Incorrect. Unlocking a user addresses account lock conditions, such as repeated failed sign-in attempts, but it does not rebind MFA to a new device. Snowflake does not automatically infer that a replacement phone should become the new enrolled authenticator for an existing MFA setup.
- D. Incorrect.
Incorrect. Disabling MFA at the account level weakens security for all users and is unnecessary for this scenario. Best practice is to perform targeted MFA enrollment resets for only the affected users rather than reducing the account-wide authentication posture.