ADA-C01 Question 89
Single answerReset passwords and temporarily disable MFA for usersA Snowflake user in your account reports that they forgot their Snowflake password and replaced the phone used for MFA. They must regain access immediately to support a production incident. As the security administrator, you want to restore access with the least privilege and without weakening authentication for other users. Which action should you take?
- A
Use ALTER USER to set a temporary password for the user and disable MFA for that user so they can sign in and re-enroll MFA.
- B
Grant the user the ACCOUNTADMIN role temporarily so they can reset their own password and MFA settings after login.
- C
Delete and recreate the user with the same name so all authentication factors are cleared automatically.
- D
Ask the user to sign in with their old password and use a session policy to bypass MFA until they register a new device.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's supported administrative controls to reset the user's password and temporarily disable MFA for that specific user. This aligns with real-world incident handling: restore access quickly, scope the exception narrowly, and require the user to re-establish strong authentication afterward. Granting high-level roles such as ACCOUNTADMIN for self-service recovery is a security anti-pattern. Deleting and recreating users is operationally unsafe and unnecessary. Snowflake documentation and administrative best practices support managing user authentication through ALTER USER and user-level MFA recovery actions rather than broad account changes or role escalation.
- A. Correct.
Correct. In Snowflake, an administrator with sufficient privileges can reset a user's password and temporarily disable MFA for that specific user. This is the appropriate operational response when a user has both forgotten their password and lost access to their MFA device. It restores access quickly while limiting the scope of the security exception to a single user. After the user signs in, they can set a new password if required and re-enroll MFA.
- B. Incorrect.
Incorrect. Granting ACCOUNTADMIN violates least-privilege principles and is not necessary for the user to recover access. Users should not be elevated to powerful administrative roles simply to resolve authentication issues. Password reset and temporary MFA disablement are administrative actions that should be performed by an authorized admin, not delegated through broad role assignment.
- C. Incorrect.
Incorrect. Deleting and recreating the user is disruptive and risky. It can affect ownership, grants, object access, and auditability, and it is not the standard way to clear authentication settings. Snowflake provides direct administrative mechanisms to reset passwords and temporarily disable MFA without recreating the user.
- D. Incorrect.
Incorrect. If the user forgot their password, they cannot authenticate with the old password. In addition, session policies are not used to bypass MFA for a single locked-out user in this manner. The supported administrative recovery action is to reset the password and temporarily disable MFA for that user.