SnowflakeProfessional levelARA-C01Page 2 of 5

ARA-C01 exam dumps: questions 101 to 200 of 434

Page 2 of the free ARA-C01 question bank for the SnowPro® Advanced: Architect exam. Questions 101 to 200 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated April 2026

Start timed practice exam Questions 101 to 200

Free ARA-C01 practice questions

Questions 101 to 105 of 434

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

ARA-C01 Question 101

Single answerAuthentication

A global enterprise uses Snowflake across multiple business units and wants to strengthen user authentication without disrupting service accounts used by ETL tools. Human users must authenticate with the corporate identity provider using single sign-on and be required to complete a second factor. At the same time, several legacy batch integrations cannot support browser-based SSO flows and currently connect with username and password. The security architect must design an approach that improves security for both user types while minimizing operational overhead.

Which solution best meets these requirements?

A
Configure federated authentication with the corporate SAML 2.0 identity provider for interactive users, enforce MFA through the identity provider, and migrate batch integrations to key pair authentication using dedicated service users.
B
Enable Snowflake native MFA for all users, including service accounts, and keep batch integrations on username/password so they can continue connecting non-interactively.
C
Use OAuth for all human users and service accounts, storing long-lived refresh tokens in the ETL tool to replace passwords and avoid SAML configuration.
D
Create network policies that restrict user logins by corporate IP range and continue using Snowflake username/password authentication for both employees and service accounts.

Show answer and explanation

Correct answer: A

Explanation

The best answer is to use federated authentication for workforce users and key pair authentication for non-interactive service accounts. In Snowflake, SAML 2.0 federation is the standard approach for enterprise SSO, and MFA is typically enforced at the identity provider when using federated authentication. This centralizes identity lifecycle, access policies, and second-factor requirements. For automated workloads, key pair authentication is a strong alternative to passwords because it supports non-interactive connections and reduces password management risk.

This design follows the principle of using the right authentication mechanism for each access pattern: browser-based or workforce access should use SSO and MFA, while unattended programmatic access should avoid passwords and interactive prompts. Network policies and other controls can still be layered on top, but they are not substitutes for proper authentication architecture.

Relevant Snowflake documentation and best practices include Snowflake support for federated authentication with SAML 2.0, MFA options for human users, and key pair authentication for service users and automated clients.

A. Correct.
Correct. This approach separates interactive and non-interactive authentication patterns in a way that aligns with Snowflake best practices. For human users, federated authentication with a SAML 2.0 identity provider supports enterprise SSO and allows MFA to be enforced centrally by the IdP. For service accounts and batch processes, key pair authentication is the recommended passwordless option because it avoids interactive login flows and is well suited to automation. Using dedicated service users also improves auditability and credential lifecycle management.
B. Incorrect.
Incorrect. Requiring native MFA for service accounts breaks many non-interactive integrations because MFA is designed for human authentication, not unattended batch jobs. Keeping legacy integrations on username/password also fails to materially improve their security posture. While native MFA can protect human users in some cases, it is not the best fit here because the requirement specifically calls for corporate IdP SSO for employees and minimal disruption for automated tools.
C. Incorrect.
Incorrect. OAuth can be appropriate for some client applications, but making it the universal answer for both human users and all service accounts is not the best design in this scenario. Many legacy ETL tools do not handle OAuth token acquisition and rotation cleanly, and storing long-lived refresh tokens can introduce its own security and operational concerns. The requirement explicitly calls for corporate SSO for users, which is more directly addressed with federated SAML authentication.
D. Incorrect.
Incorrect. Network policies are a useful additional control, but they do not satisfy the requirement for corporate SSO with a second factor. Restricting source IPs also does not address the weakness of password-based authentication for service accounts. This option reflects a common misconception that network controls can substitute for strong authentication; in Snowflake they complement, but do not replace, appropriate authentication methods.

ARA-C01 Question 102

Single answerAuthentication

A global enterprise uses Snowflake for analytics across several business units. The security team has mandated the following for all human users: centralized identity management with the corporate IdP, no Snowflake-managed passwords, and support for users accessing multiple Snowflake accounts without repeated sign-ins during the same browser session. Service accounts used by automated ETL jobs must continue to authenticate non-interactively. Which authentication approach best meets these requirements with the least operational overhead?

A
Configure federated authentication with the corporate IdP for human users, enable SSO across Snowflake accounts, and use key-pair authentication for service accounts.
B
Enable MFA on all Snowflake local users, disable password caching in clients, and use username/password authentication for service accounts.
C
Use External OAuth for all users and service accounts so Snowflake no longer needs to manage any user identities.
D
Configure SCIM provisioning from the corporate IdP and keep Snowflake username/password authentication enabled for all users to provide a fallback option.

Show answer and explanation

Correct answer: A

Explanation

The best answer is to combine federated authentication for human users with key-pair authentication for service accounts. In Snowflake, federated authentication using a SAML 2.0-compliant identity provider is the standard approach for enterprise SSO. This satisfies centralized identity management and removes the need for Snowflake-managed passwords for human users. Snowflake also supports single sign-on across multiple Snowflake accounts, reducing repeated sign-ins when users access more than one account in the same browser session. For automated ETL and other non-interactive processes, key-pair authentication is a common best practice because it is designed for programmatic access and avoids password rotation challenges. SCIM is complementary for provisioning but not a substitute for authentication. External OAuth is valid for certain application integration patterns, but it is not the most direct or lowest-overhead solution for this specific mix of interactive enterprise users and non-interactive service accounts. These align with Snowflake best practices around SSO/federation, key-pair authentication for service users, and account-level authentication architecture.

A. Correct.
Correct. Federated authentication with SAML 2.0 allows Snowflake to delegate authentication for human users to the corporate IdP, which satisfies centralized identity management and avoids Snowflake-managed passwords for those users. Snowflake also supports SSO across multiple Snowflake accounts so users can access more than one account without signing in again during the same browser session, assuming the accounts are configured appropriately with the same IdP context. For non-interactive automated workloads, key-pair authentication is a standard best practice because it avoids interactive login flows and is designed for programmatic access.
B. Incorrect.
Incorrect. MFA on Snowflake local users improves security, but it does not satisfy the requirement to avoid Snowflake-managed passwords or centralize authentication in the corporate IdP. It also does not address seamless SSO across multiple Snowflake accounts in the same way federated SSO does. Using username/password for service accounts is operationally heavier and generally less secure than key-pair authentication for automation.
C. Incorrect.
Incorrect. External OAuth is useful for authorizing client applications to access Snowflake using OAuth tokens, but it is not the best fit here for all human interactive access plus all service accounts. The requirement is specifically about centralized human authentication via the corporate IdP and cross-account browser SSO, which is more directly addressed by federated SSO. Also, saying Snowflake no longer needs to manage any user identities is misleading; user objects and authorization still exist in Snowflake even when authentication is delegated.
D. Incorrect.
Incorrect. SCIM helps automate user and group provisioning but does not perform user authentication by itself. Keeping Snowflake username/password enabled for all users conflicts with the requirement of no Snowflake-managed passwords for human users. While some organizations retain break-glass access under tightly controlled conditions, that is not what the scenario asks for, and enabling local passwords for all users increases operational and security complexity.

ARA-C01 Question 103

Single answerAuthentication policies

A financial services company uses Snowflake with federated SSO for employees and username/password for a small number of service accounts. The security architect must reduce the risk of password-based compromise without disrupting existing SSO access. The company wants to enforce stricter controls only for users who authenticate with Snowflake-managed passwords, while allowing federated users to continue signing in through the identity provider. Which action should the architect take?

A
Create an authentication policy that restricts allowed authentication methods to password-based authentication, and assign it at the account level.
B
Create an authentication policy that allows SAML and password authentication, require MFA for password authentication, and assign the policy to only the service users or their dedicated role/user scope.
C
Create a network policy that limits login locations for service accounts, because network policies are the only way to enforce stronger authentication for password users.
D
Modify the password policy to require MFA, and assign the password policy to the service accounts.

Show answer and explanation

Correct answer: B

Explanation

The best answer is to use an authentication policy, because authentication policies in Snowflake are intended to manage sign-in behavior such as permitted authentication methods and MFA requirements. In this scenario, the key design requirement is selective hardening: federated SSO users must continue authenticating through the identity provider, while password-based Snowflake users need stronger protection. Applying a narrowly scoped authentication policy meets that requirement more precisely than changing account-wide settings.

This is also aligned with Snowflake security best practices: use federated authentication for workforce users where possible, minimize the use of Snowflake-managed passwords, and apply stronger authentication controls to any remaining password-based accounts. Network policies and password policies are complementary controls, but they solve different problems. Network policies restrict source network locations; password policies regulate password attributes. Neither is the primary mechanism for enforcing MFA or selectively allowing specific authentication methods.

Relevant Snowflake documentation areas include authentication policies, MFA/authentication methods, password policies, and network policies. Candidates should recognize the difference between these control types and choose the one that directly addresses authentication-path governance with minimal operational disruption.

A. Incorrect.
Incorrect. Restricting the account to password-only authentication would block federated SSO users from authenticating with SAML, directly conflicting with the requirement to preserve existing SSO access. This is a common mistake when administrators confuse 'tightening authentication' with 'reducing supported methods globally.' Authentication policies can control allowed authentication methods, but applying a password-only rule at the account level would be overly broad and disruptive.
B. Correct.
Correct. Authentication policies are designed to control how users authenticate, including allowed client authentication methods and MFA requirements for supported sign-in paths. In this scenario, the architect should create an authentication policy that continues to permit SAML for federated employees while enforcing stronger controls, such as MFA, for users who authenticate with Snowflake-managed passwords. Scoping the policy to the service users (rather than broadly at the account level) satisfies the requirement to harden password-based access without impacting the federated SSO population.
C. Incorrect.
Incorrect. Network policies control where users can connect from, based on allowed or blocked IP addresses, but they do not replace authentication policies and are not the only mechanism for strengthening access controls. They can complement authentication controls, but they do not directly satisfy the requirement to enforce stricter authentication behavior specifically for password-based logins while preserving SSO behavior.
D. Incorrect.
Incorrect. Password policies govern password complexity, rotation, lockout, and related password characteristics, but they do not require MFA. MFA enforcement is handled through authentication controls, not password policy settings. This option reflects a common misconception that all login security settings belong to password policies.

ARA-C01 Question 104

Single answerFederated authentication

A global company uses Snowflake with Okta as its identity provider for SAML 2.0 federated authentication. The security team is rolling out a new policy that requires users to authenticate through the corporate IdP for all interactive logins, while still allowing existing service accounts used by ETL jobs to connect with key-pair authentication. During testing, several analysts can still sign in with their Snowflake passwords through the web interface, bypassing the IdP. Which configuration change should the architect implement to meet the requirement with the least impact to service accounts?

A
Set the account-level SSO parameter so the IdP is enforced for interactive sign-ins, and ensure service users continue to use non-password authentication such as key-pair authentication.
B
Disable all user passwords in Snowflake, including for service accounts, because federated authentication requires passwordless access for every user type.
C
Configure SCIM provisioning from Okta to Snowflake, because SCIM automatically prevents direct Snowflake password logins.
D
Create a network policy that only allows connections from the corporate office IP range, because network restrictions force web users to authenticate with the IdP.
E
Convert the ETL service accounts to browser-based SAML users so they can inherit the same interactive sign-in policy as analysts.

Show answer and explanation

Correct answer: A

Explanation

The key architectural decision is to enforce federated authentication for human interactive access while preserving non-interactive authentication for service accounts. In Snowflake, SAML 2.0 federated authentication integrates with IdPs such as Okta for SSO. Architects should ensure users cannot bypass the IdP with native Snowflake password login when the organization's policy requires centralized authentication controls like MFA and conditional access at the IdP. At the same time, ETL or application service accounts should typically use supported non-interactive methods such as key-pair authentication rather than browser-based SSO. SCIM is relevant for identity lifecycle management, not for enforcing authentication paths. Network policies are also separate; they limit allowed client networks but do not enforce SAML. This aligns with Snowflake best practices for separating human and machine identities and using federated authentication appropriately for workforce users.

A. Correct.
Correct. In Snowflake, federated authentication with SAML can be configured so that users must authenticate through the identity provider for interactive logins rather than using native Snowflake passwords. This is the appropriate control when the goal is to prevent analysts from bypassing SSO in the web interface. At the same time, service accounts used for automation typically should not use interactive SSO; they commonly use key-pair authentication or other non-interactive methods. This approach meets the requirement while minimizing disruption to ETL jobs.
B. Incorrect.
Incorrect. Disabling passwords for every user is broader than required and can create unnecessary operational risk. Snowflake service accounts often use key-pair authentication and do not need interactive SSO, but the requirement is specifically about enforcing IdP-based authentication for interactive users. Also, federated authentication does not mean every possible login path for every user type must be passwordless in the same way; the architect should distinguish between human interactive access and programmatic service access.
C. Incorrect.
Incorrect. SCIM is used for automated user and group lifecycle management, such as provisioning and deprovisioning identities and group memberships. It does not itself enforce SSO usage or block direct Snowflake password authentication. A candidate might choose this if they confuse identity provisioning with authentication enforcement, but they are separate controls.
D. Incorrect.
Incorrect. Network policies restrict where users can connect from based on IP addresses, but they do not determine whether a user authenticates through SAML SSO versus a Snowflake username/password. Restricting source IPs can complement security posture, but it will not solve the bypass problem described in the scenario.
E. Incorrect.
Incorrect. Browser-based SAML authentication is designed for human interactive users, not unattended ETL service accounts. Converting service accounts to browser-based SAML would likely break automation because scheduled jobs cannot generally complete interactive browser SSO flows. Best practice is to keep service principals on non-interactive authentication methods such as key-pair authentication.

ARA-C01 Question 105

Single answerFederated authentication

A global enterprise uses Okta as its corporate identity provider and has configured SAML 2.0 federated authentication for Snowflake. The security team wants to reduce the risk of users authenticating through Snowflake with passwords that are not governed by Okta MFA policies. At the same time, a small number of service accounts used by batch integrations must continue to authenticate non-interactively with username and password. Which configuration approach best meets these requirements?

A
Set SSO_REQUIRED = TRUE at the account level so all users, including service accounts, must use federated authentication.
B
Set SSO_REQUIRED = TRUE only for human users who should authenticate through Okta, and leave service accounts without this setting so they can continue using password-based authentication.
C
Disable passwords for all Snowflake users and use key-pair authentication for both human users and service accounts.
D
Configure network policies to allow only Okta IP addresses, which will force all human users to authenticate through federated SSO while preserving password logins for service accounts.

Show answer and explanation

Correct answer: B

Explanation

The best answer is to enforce federated authentication selectively for human users by setting the Snowflake user property SSO_REQUIRED = TRUE on those identities, while leaving batch/service accounts configured for native Snowflake authentication as needed. This design is commonly used when enterprises want workforce identities governed by the corporate IdP, including MFA and conditional access, but still need non-interactive accounts for legacy or automated integrations. In Snowflake, SAML 2.0 federated authentication enables SSO through an external IdP such as Okta, and SSO_REQUIRED helps prevent users from bypassing that control by logging in with a Snowflake password. Account-wide enforcement would be too broad in this scenario because it would also impact service accounts. Relevant Snowflake documentation covers federated authentication with SAML, user-level SSO enforcement using SSO_REQUIRED, and the distinction between authentication controls and network policies.

A. Incorrect.
Incorrect. Setting SSO_REQUIRED = TRUE at the account level would enforce SSO for all users in the account, including service accounts. That conflicts with the requirement that certain batch integration accounts must continue using non-interactive username/password authentication. This option reflects a common misunderstanding that account-wide enforcement can selectively exempt specific users; it cannot unless you avoid applying it globally.
B. Correct.
Correct. Snowflake supports the SSO_REQUIRED user property to require federated authentication for specific users. Applying it to human users helps prevent fallback to native Snowflake password authentication, ensuring their access is governed by the IdP's MFA and sign-in policies. Leaving service accounts without SSO_REQUIRED allows them to continue authenticating with Snowflake-native credentials where needed for non-interactive workloads. This is the most targeted approach that satisfies both security and operational requirements.
C. Incorrect.
Incorrect. Human users do not typically use key-pair authentication for interactive access in place of SAML SSO, and the scenario specifically states the organization already uses Okta with SAML federated authentication. Also, the requirement says service accounts must continue with username/password, not be migrated to key-pair authentication. While key-pair authentication is valid for some programmatic use cases, it does not match the stated requirements.
D. Incorrect.
Incorrect. Network policies restrict where connections can originate, but they do not force SAML-based authentication or prevent users from using Snowflake passwords if password authentication is otherwise allowed. Okta authentication occurs through an identity flow, not by simply originating from Okta IP ranges. This option confuses network-level controls with authentication-method enforcement.

Timed practice exam

Take a ARA-C01 practice test under exam conditions

65 questions in 115 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

ARA-C01 practice questions 101 to 200 of 434

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 5 pages of up to 100 questions.