ARA-C01 Question 101
Single answerAuthenticationA global enterprise uses Snowflake across multiple business units and wants to strengthen user authentication without disrupting service accounts used by ETL tools. Human users must authenticate with the corporate identity provider using single sign-on and be required to complete a second factor. At the same time, several legacy batch integrations cannot support browser-based SSO flows and currently connect with username and password. The security architect must design an approach that improves security for both user types while minimizing operational overhead.
Which solution best meets these requirements?
- A
Configure federated authentication with the corporate SAML 2.0 identity provider for interactive users, enforce MFA through the identity provider, and migrate batch integrations to key pair authentication using dedicated service users.
- B
Enable Snowflake native MFA for all users, including service accounts, and keep batch integrations on username/password so they can continue connecting non-interactively.
- C
Use OAuth for all human users and service accounts, storing long-lived refresh tokens in the ETL tool to replace passwords and avoid SAML configuration.
- D
Create network policies that restrict user logins by corporate IP range and continue using Snowflake username/password authentication for both employees and service accounts.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use federated authentication for workforce users and key pair authentication for non-interactive service accounts. In Snowflake, SAML 2.0 federation is the standard approach for enterprise SSO, and MFA is typically enforced at the identity provider when using federated authentication. This centralizes identity lifecycle, access policies, and second-factor requirements. For automated workloads, key pair authentication is a strong alternative to passwords because it supports non-interactive connections and reduces password management risk.
This design follows the principle of using the right authentication mechanism for each access pattern: browser-based or workforce access should use SSO and MFA, while unattended programmatic access should avoid passwords and interactive prompts. Network policies and other controls can still be layered on top, but they are not substitutes for proper authentication architecture.
Relevant Snowflake documentation and best practices include Snowflake support for federated authentication with SAML 2.0, MFA options for human users, and key pair authentication for service users and automated clients.
- A. Correct.
Correct. This approach separates interactive and non-interactive authentication patterns in a way that aligns with Snowflake best practices. For human users, federated authentication with a SAML 2.0 identity provider supports enterprise SSO and allows MFA to be enforced centrally by the IdP. For service accounts and batch processes, key pair authentication is the recommended passwordless option because it avoids interactive login flows and is well suited to automation. Using dedicated service users also improves auditability and credential lifecycle management.
- B. Incorrect.
Incorrect. Requiring native MFA for service accounts breaks many non-interactive integrations because MFA is designed for human authentication, not unattended batch jobs. Keeping legacy integrations on username/password also fails to materially improve their security posture. While native MFA can protect human users in some cases, it is not the best fit here because the requirement specifically calls for corporate IdP SSO for employees and minimal disruption for automated tools.
- C. Incorrect.
Incorrect. OAuth can be appropriate for some client applications, but making it the universal answer for both human users and all service accounts is not the best design in this scenario. Many legacy ETL tools do not handle OAuth token acquisition and rotation cleanly, and storing long-lived refresh tokens can introduce its own security and operational concerns. The requirement explicitly calls for corporate SSO for users, which is more directly addressed with federated SAML authentication.
- D. Incorrect.
Incorrect. Network policies are a useful additional control, but they do not satisfy the requirement for corporate SSO with a second factor. Restricting source IPs also does not address the weakness of password-based authentication for service accounts. This option reflects a common misconception that network controls can substitute for strong authentication; in Snowflake they complement, but do not replace, appropriate authentication methods.