ADA-C01 Question 99
Select 2Analyze how Snowflake OAuth is impacted by federated authentication, network policies, and private connectivityA company uses Snowflake with SSO through an external identity provider for interactive users. The security team is now enabling Snowflake OAuth so a custom internal web application can obtain access tokens and connect to Snowflake on behalf of employees. At the same time, the company plans to restrict user access with network policies and move all Snowflake traffic to private connectivity. During testing, administrators notice inconsistent login behavior and want to understand what controls still apply when OAuth is used. Which TWO statements are correct?
- A
If Snowflake OAuth is used for user authorization, federated authentication through the external identity provider is bypassed for the Snowflake sign-in step because Snowflake issues the OAuth token.
- B
A Snowflake network policy can still affect whether a client using Snowflake OAuth is allowed to connect, because network policies are evaluated when the session is established.
- C
After private connectivity is enabled, Snowflake OAuth cannot be used because OAuth requires public internet endpoints for token issuance and session creation.
- D
Private connectivity changes the network path to Snowflake, but it does not remove the need to configure clients to use the appropriate Snowflake account URL or private endpoint for connectivity.
- E
When Snowflake OAuth is enabled, network policies apply only to Snowsight browser logins and no longer apply to programmatic clients using OAuth access tokens.
Show answer and explanation
Correct answers: B, D
Explanation
The key point is that Snowflake OAuth, federated authentication, network policies, and private connectivity address different layers of access. Snowflake OAuth is about delegated authorization and token-based access to Snowflake. Federated authentication can still participate in user authentication flows depending on the OAuth pattern and account configuration. Network policies remain an important enforcement point and can block a connection even when the client has a valid OAuth token. Private connectivity changes the route and endpoint used to access Snowflake, but it does not inherently disable OAuth; administrators must ensure clients use the proper private URLs/endpoints. This aligns with Snowflake guidance on OAuth integrations, network policies, and private connectivity features: authentication and token issuance do not override network-based access restrictions, and private connectivity requires endpoint-specific client configuration.
- A. Incorrect.
Incorrect. This is a common misconception. Snowflake OAuth does not automatically eliminate the role of federated authentication in all user-based flows. In an authorization-code style flow, the user can still be redirected to authenticate, and if the Snowflake account is configured for federated authentication, the IdP can remain part of the authentication experience. Snowflake OAuth governs delegated authorization and token issuance by Snowflake, but that does not mean external SSO is universally bypassed.
- B. Correct.
Correct. Network policies are enforced by Snowflake to control whether connections are allowed from specific IP ranges. Even when a client presents a valid Snowflake OAuth access token, Snowflake can still deny the connection if the originating network does not satisfy the applicable network policy. A valid token is not a substitute for network access control.
- C. Incorrect.
Incorrect. Private connectivity does not disable Snowflake OAuth. OAuth can still be used when clients reach Snowflake over private connectivity, provided the required endpoints and routing are correctly configured. The misconception is assuming OAuth is tied to public internet access only; in practice, private connectivity affects how traffic reaches Snowflake, not whether OAuth as an authentication/authorization mechanism is supported.
- D. Correct.
Correct. Private connectivity changes how clients reach Snowflake endpoints, such as through AWS PrivateLink, Azure Private Link, or Google Cloud private connectivity patterns, but clients still must be configured to use the correct Snowflake hostnames/endpoints associated with that private setup. Moving to private connectivity is not transparent if applications continue to target the old public account URL.
- E. Incorrect.
Incorrect. Network policies are not limited to Snowsight interactive logins. They can apply to connections made by drivers, connectors, and applications as well. OAuth changes how the client proves authorization, but it does not exempt programmatic connections from Snowflake network controls.